Overview
ScopeSense is a bid-preparation tool for EU electrical and MEP contractors. This policy explains what personal data we collect, why we collect it, where we store it, and your rights under the EU General Data Protection Regulation (GDPR).
Data controller
Core Engineering Kft., Budapest, Hungary. Contact: info@coreeng.eu.
What we collect
- Account data: name, work email, company, hashed password, and the country you signed up from (a two-letter code looked up from your IP address at sign-up; the IP address itself is not stored).
- Project data: uploaded PDFs, drawings, specifications, BOQs, vendor quotes and the analysis outputs derived from them.
- Usage data: we count page views with our own cookieless counter, hosted on our EU servers — no third-party analytics. For each page view we store the page path (without query parameters), the time, the country (a two-letter code looked up from your IP address), and an anonymous visitor code derived from your IP address and browser type with a secret key that changes every day. Your IP address and browser details are not stored, and the code cannot link your visits across days. Browsers that send Do Not Track or Global Privacy Control are not counted. These records are deleted after 12 months and are used only for aggregate visitor statistics.
- Billing data: processed by Stripe (Stripe Payments Europe, Ltd.), which sells our paid plans and credit packs as merchant of record and calculates tax. We do not store card numbers; we keep your Stripe customer and subscription identifiers and your purchase history.
Where your data lives
All data is stored in the EU on netcup infrastructure (Vienna, Austria). Backups are kept in the EU as well (see Retention). We do not transfer personal data outside the EU without explicit consent and standard contractual clauses.
AI processing
Some analyses use large language models. Depending on the task, the content needed for that task — which can include your uploaded documents (text, PDFs and images) and chat messages in full — is processed by:
- Anthropic PBC (Claude models), or
- Microsoft Azure AI Foundry — open-weight models (such as DeepSeek) hosted by Microsoft in the EU Data Zone. No data is sent to the model's original developer.
Requests to Azure pass through our own AI gateway on our EU servers (netcup, Vienna). The gateway does not store your documents; it keeps only the generated answer and usage metadata for quality control and cost accounting. Neither provider uses your data to train their models, and we do not use your project documents to train any model. We do not send your data to other AI providers without written notice.
Cookies
We use one essential cookie to keep you logged in. We do not use advertising, analytics or tracking cookies.
Your rights
Under GDPR you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Delete your data (right to be forgotten), unless we have a legal obligation to retain it.
- Restrict or object to processing.
- Portability — receive a copy of your data in a machine-readable format.
- Lodge a complaint with a supervisory authority. Our lead authority is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9-11, naih.hu. You may also complain to the authority in the EU country where you live or work.
Retention
Account data is retained while your account is active. When you delete your account (Settings → Danger zone), it is closed immediately and your account, projects and documents are permanently deleted automatically 30 days later. Within those 30 days you can cancel the deletion or ask for an export of your data by writing to info@coreeng.eu. We confirm the deletion by email, stating the date of permanent deletion and the date by which the data has also left our backups. Project audit logs are deleted together with their project.
Backups. Backups of the database and uploaded files are stored in Microsoft Azure (Sweden, EU) for 13 days and then deleted. Backup data older than 14 days cannot be accessed. Data you delete may therefore remain in backups for up to 14 days after the permanent deletion date. If we ever have to restore a backup, we first delete again everything that was deleted after that backup was taken. To be able to do this we keep a deletion record for 90 days: an internal identifier, the type of record and the date — no name, email or content.
Billing and tax records. Invoices and tax records for purchases are issued and kept by Stripe as merchant of record for the period the law requires (in Hungary generally 8 years under the Accounting Act, Act C of 2000, section 169). They are not deleted when you delete your ScopeSense account; the right to erasure does not apply to records we or Stripe must keep by law (GDPR Article 17(3)(b)).
Proof of acceptance. When you create an account we record which version of the Terms, Privacy Policy and Disclaimer you accepted, when, and how (sign-up checkbox or Google sign-in), together with your internal user ID and a one-way hash of your email address — no name, no IP address. This record is not deleted with your account; we keep it for 5 years after the account is deleted (Hungarian Civil Code section 6:22) so that we can prove what was agreed in case of a legal claim (GDPR Article 17(3)(e)).
AI providers. Anthropic and Microsoft may keep the requests we send them for up to 30 days under their published terms (for example for abuse monitoring) and then delete them. They do not use them to train their models.
Contact
For any privacy request, write to info@coreeng.eu. We respond within 30 days.