uetr.ai

Privacy Policy

Last updated: 15 September 2026

This policy explains what data uetr.ai (the "Service") collects, how it is used, and your rights. uetr.ai ("we", "us") operates the Service. For privacy enquiries use our contact form. Our registered address is on the legal notice.

0. Controller

uetr.ai acts as the data controller for personal data processed through the Service and decides the purposes and means of that processing. For eligible Stripe Managed Payments transactions, Link is the merchant of record. Link and the applicable Stripe entities process payment data as independent controllers under Stripe's privacy policy. See also our merchant-of-record disclosure.

1. Data we collect

  • Tracking input: UETR, payment amount, currency, payment date, optional sender / beneficiary BIC and reference.
  • Contact: email address (required to send status alerts and account communications).
  • Account: if you sign in, your authentication identifier and basic profile.
  • Billing: processed by our payment processor (Stripe); we receive transaction metadata but not full card details.
  • Technical: standard request logs (IP, user agent, timestamps) for security and abuse prevention.

2. How we use it

  • To query supported transfer-status sources for the UETR and payment details you provide and present available results to you.
  • To send transactional emails (status changes, account, billing).
  • To operate, secure and improve the Service.
  • To meet legal, accounting and regulatory obligations.
  • To compile and publish aggregated statistics about how transfers behave and how the Service is used, for example the share of tracked transfers reporting each status code and how long completion took. See section 2b.

2a. Legal basis for processing

  • Performance of a contract (GDPR Art. 6(1)(b)), to provide the Service you have requested: looking up the UETR, running monitoring, sending status emails, providing access to your account.
  • Legitimate interests (GDPR Art. 6(1)(f)), to secure and improve the Service, prevent abuse, measure use, and compile and publish aggregate statistics. You may object as described below.
  • Legal obligation (GDPR Art. 6(1)(c)), to keep accounting records and comply with applicable legal obligations.
  • Consent (GDPR Art. 6(1)(a)), for optional analytics, marketing, and communications. You may withdraw consent at any time.

2b. How we protect you in published statistics

Public statistics use aggregation and disclosure controls intended to prevent a person or individual transfer from being singled out. We do not publish UETRs, email addresses, or sender or beneficiary identities. You may object under GDPR Art. 21 using our contact form.

2c. How we measure use of the Service

We measure how the Service is used in two ways.

Limited cookie-free product measurement (on by default unless you object). Cloudflare and PostHog EU process limited service-use data. It may include the IP address, user agent, site hostname, and page or action. It excludes email addresses, UETRs, and account identifiers. We use it only to understand and improve the Service, not for advertising or cross-site tracking. Our GDPR basis is legitimate interest (Art. 6(1)(f)), and retention follows the criteria in section 4. You may object under Art. 21 through Reject all, by saving Analytics off, on the Cookie Policy page, through Global Privacy Control, or using our contact form.

Consent-based analytics and marketing (off by default). With your consent we use PostHog for product analytics, Google Analytics 4 for site analytics, and Microsoft Clarity for heatmaps and session replay. Clarity records interactions such as clicks and scrolls; input fields are masked. With marketing consent, Microsoft may also set campaign measurement identifiers. The Cookie Policy lists the related storage, purposes, and typical durations. Google explains how it uses information from sites or apps that use its services; see also the Microsoft Privacy Statement. You can withdraw consent at any time from Cookie settings in the footer.

3. What we do not do

  • We do not sell your personal data.
  • We do not share UETRs or transfer details with third parties for their own marketing or advertising. To perform the lookup you request, we may submit the UETR and related lookup details you provide to supported publicly available tracker endpoints.

4. Storage and retention

Archived transfers do not use active monitoring slots. Their saved timelines and payment records remain accessible while the paid subscription stays active. For cancellations after the account-retention notice is presented, the account and all active and archived transfers are permanently deleted 15 days after paid access ends. You can download your records or resubscribe during that period. Earlier cancellations are not enrolled retrospectively. The legal retention duties below continue to apply separately.

Data is stored on Lovable Cloud infrastructure (hosted on Supabase / Cloudflare). Retention is determined by the continued need for the purposes described in this Policy, applicable statutory retention requirements, and any scoped preservation duty. We assess valid erasure requests under applicable law. Three concrete rules apply today: billing data is held by Stripe under its own retention policy; accounting records are kept for 10 years where Portuguese tax law requires it; and the suppressed-email list is retained indefinitely to honour unsubscribes.

You may request deletion at any time, subject to legal-retention obligations, and we assess such requests under applicable law.

4a. Recipients and sub-processors

We use the following recipients for the purposes described in this Policy:

  • Hosting and database: Supabase (database, auth) and Cloudflare (edge runtime, CDN).
  • Payment provider / merchant of record: Link and the applicable Stripe entities (checkout, card processing, supported indirect taxes, receipts and invoices, fraud controls, transaction support and disputes), where Stripe Managed Payments applies.
  • Transactional email: our email delivery provider, used to send account, status-alert and billing emails.
  • Supported tracker sources: publicly available bank or payment-status tracker endpoints queried only to provide the lookup or monitoring you requested.
  • Usage measurement: Cloudflare, Inc. and PostHog, Inc. (EU-hosted product measurement). With your consent: Google Ireland Limited (Google Analytics 4, Google Tag Manager), Microsoft Ireland Operations Limited and Microsoft Corporation (Clarity session replay), each as described in section 2c and the Cookie Policy. Where personal data leaves the EEA, transfers rest on the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses, per vendor.
  • Authorities and legal process: only if disclosure is required by applicable law.

We do not sell your personal data, and we never share UETRs or transfer details with advertisers or data brokers. If you accept marketing cookies, Microsoft sets advertising identifiers on its own domains as listed in the Cookie Policy; your transfer details are never part of that data flow.

5. Your rights

Subject to applicable data protection law, including the GDPR, you may request access, correction, deletion, portability, restriction, or object to processing of your personal data, and you may withdraw consent at any time, using our contact form or by writing to us at the registered address on our legal notice. We respond within one month of receiving a valid request unless applicable law permits an extension. You also have the right to lodge a complaint with your local data-protection supervisory authority. In Portugal that is the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.

5c. Automated decision-making

We do not carry out automated decision-making producing legal or similarly significant effects on you (GDPR Art. 22).

5d. Children

The Service is not directed at, and we do not knowingly collect personal data from, children under 16.

5a. International transfers

Our infrastructure providers may process data outside your country, including in the EEA and the United States. Where personal data leaves the EEA we rely on a European Commission adequacy decision where one applies, including the EU-U.S. Data Privacy Framework for certified US recipients, and otherwise on appropriate safeguards such as the European Commission's Standard Contractual Clauses, per vendor, as listed in section 4a. Where United Kingdom data protection law applies to you, the same transfers rely on UK adequacy regulations, the UK extension to the Data Privacy Framework for certified US recipients, or the UK International Data Transfer Addendum, as applicable to the vendor.

5b. Security

We apply appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS), access controls, audit logging, and row-level security on our database. No method of transmission or storage is 100% secure; if you believe your account has been compromised, tell us immediately using our contact form.

6. Cookies

We use strictly necessary cookies plus, with your consent, analytics and marketing cookies. The Cookie Policy lists current cookies and similar storage, including their party and duration. It also explains the purpose of each consent-category entry, the cookie-free measurement that runs without cookies (section 2c), and where you change your choice at any time.

7. Contact

Reach uetr.ai through our contact form, or by post at the registered address on our legal notice.