Privacy policy

Version 1 · effective 15 October 2026 · All versions · This is the current version

Eureka helps you read EU legislation: as a browser extension on EUR-Lex, as the act reader on this website (eureka.legal/lex), and through the Eureka service behind both. This policy says, in plain words, which personal data they process, why, for how long, and what you can do about it.

1. Who is responsible

The controller of your personal data is Eureka.legal, Denmark.

For anything about your data, use the contact form. Organisations with an organisation account find the data processing agreement on this site.

2. Your account

From version 1.0.0 an account is needed to open definitions, references, case law and the other features, in the extension and in the reader. The page itself, with its marks and structure, shows without one. You sign in with your e-mail address and a link we send you: there is no password. Your account holds your e-mail address, your plan and, if you belong to one, your organisation; your e-mail alert settings (digest and language); your follows; the notifications about the acts you follow; your connected browsers (when each was added and last seen); and the articles you have shared (section 5).

3. What the extension sends

The extension works only on EUR-Lex and, to connect itself after you sign in, on eureka.legal. It never reads or sends the content of other websites you visit. On EUR-Lex it sends the following to the Eureka service:

• An install id: a random number created when the extension is installed. It identifies the browser, not you, until you sign in.
• The acts you read: the address (URL) and CELEX number of each act you open, the language, the extension's version and, as with any connection, your IP address.
• How you use Eureka: which of its features you use, such as the links, cards and tabs you open and the searches you make in it. We use this to see which features help, to find errors and to improve Eureka. It never includes the text of the page.
• Follows: the acts and articles you follow.
• Your e-mail address, once you sign in, so that your follows, alerts and plan are the same in every browser you connect.
• Feedback and problem reports that you send yourself from the extension. You need to be signed in to send one, so that we can answer you; it is linked to your account.

4. What the website and the reader store

• A session while you are signed in: your account number, e-mail address and plan, kept in a session cookie (section 11).
• The act reader (eureka.legal/lex) sends the Eureka service the same kind of data as the extension: an install id made on this website and kept in your browser, the acts and languages you read, how you use the reader's features, and the searches you type to find an act or a term. Signed in, it uses your account.
• Definition pages (eureka.legal/lex/…/def/…) are public pages that show a definition as published. They store nothing about you beyond the request log (section 6) and the visitor statistics below.
• Sign-in links and codes: one-time links e-mailed to you and the short-lived codes that connect the extension to your account.
• Messages you send through the contact form.

Visitor statistics. The website, including the reader, counts page views and clicks (for example on "Get the EUR-Lex extension", "Sign in" or a share button) with Umami, an analytics tool we run ourselves on our own server; nothing goes to a third party. It sets no cookies, stores no IP address and no personal data, honours your browser's "Do Not Track" setting, and only shows us totals: how many visits a page had, from which websites people came, which country and which kind of browser. The reader's install id belongs to the Eureka service, not to these statistics.

5. Shared articles

You can share an article of an act as a link (eureka.legal/lex/…?s=…). The link carries a share id. For each link we store the act, language and article, the channel you chose (copy, LinkedIn, X, Bluesky, e-mail or your device's share sheet), when you made it, that it was made from your account or your install, and how many times it was opened. Only a limited number of a person's links per day become active (an active link lets anyone read that article with its definitions and references, without an account); the limit protects the service and does not identify the readers. People who open your link are not identified by it beyond the request log (section 6). The share buttons are plain links: no script from LinkedIn, X or Bluesky runs on our pages. When you post a link there, that network fetches a preview image and title from us, and its own privacy statement applies to your post. If you delete your account, your links keep working but are no longer linked to you.

6. Request logs

The Eureka service and this website log each request: time, address requested, answer, the install id or account number, the browser's description (user agent) and the IP address. We use the logs to run the service, to keep it secure, to limit abuse and to find errors.

7. Why we process it

• To provide the service you asked for (performance of our agreement, GDPR article 6(1)(b)): showing acts, follows, alerts, sign-in, your plan and the links you share.
• Our legitimate interests (article 6(1)(f)): usage data, statistics, the limit on shared links and request logs, to improve Eureka and keep it secure. We keep these under a pseudonym (section 8) so that they say as little about you as possible.
• Legal obligations (article 6(1)(c)), for example bookkeeping once paid plans start.

8. How long we keep it

• Page views, usage data and request logs are kept under a stable pseudonym, the install id or the account number, and not under your name or e-mail address. They are kept without a fixed time limit, because the statistics need them.
• IP addresses are shortened after 30 days (the last part is removed), so they no longer point to a single connection.
• Sign-in links and connect codes are deleted as soon as they are used or expire.
• Your account, follows, notifications, connected browsers and shared links are kept until you delete the account.
• When you delete your account, your e-mail address, follows and notifications are deleted, your browsers are disconnected, your shared links are unlinked from you, and the pseudonym is unlinked from your e-mail address and your organisation. What remains of the history is anonymous: it can no longer be traced back to you.
• Messages sent through the contact form are kept as long as needed to answer and follow up on them.

9. Who processes it for us

• Hetzner (Germany) hosts the Eureka service, its database, the visitor statistics and this website on servers in the EU.
• Porkbun is our e-mail provider. It sends sign-in links and e-mail alerts and receives the recipient's address and the message.
• Anthropic produces the AI evaluations. It receives the published text of acts and, when a search for an act finds nothing, the text of that search, so that it can name the act you mean; it never receives data about you.
• EUR-Lex and the Cellar of the Publications Office of the EU are the source of the acts. The service fetches acts from them; it sends them no data about you. The extension runs on EUR-Lex pages, but inside your browser and separately from EUR-Lex: EUR-Lex does not see what the extension does, and the extension sends EUR-Lex nothing. EUR-Lex's own privacy statement applies to your visit there, as it would without the extension.

We do not sell personal data and do not share it with anyone else, unless the law requires it. When paid plans start, the payment provider will be added to this list, in a new version of this policy, before any payment is taken.

10. Your rights

Under the General Data Protection Regulation (GDPR) you have the right to access your data, to have it corrected, to have it deleted, to restrict or object to its processing, and to receive it in a portable form. You can:

• see and change your e-mail alerts, follows and connected browsers, and delete your account, on the account page;
• uninstall the extension, which stops it from sending anything further; what it sent before is kept as described in section 8;
• ask for anything else through the contact form. We answer within one month.

You can also complain to a data protection authority, in Denmark Datatilsynet (datatilsynet.dk), or the authority where you live.

11. Cookies

This website sets one cookie, the session cookie, and only when you sign in or use a form (together with the security cookie that protects forms against forgery). It ends when you sign out or after two weeks. The reader keeps its install id and your reading position in the browser's local storage, not in a cookie. There are no analytics, advertising or tracking cookies, and no third-party scripts that track you; the visitor statistics (section 4) work without cookies.

12. Changes to this policy

When Eureka starts to process data in a new way, we publish a new version of this policy here before it applies. Every version is kept, with its date and a list of what changed, under all versions. We may also announce important changes in the extension or by e-mail.