01Data controller
Zuelen is a product and service operated by TradinGo SARL-S, registered with the Luxembourg Trade and Companies Register under number B272247, with its registered office at 244, rue de Luxembourg, L-8077 Bertrange, Luxembourg.
TradinGo SARL-S acts as controller for operation of the website, accounts, commercial relationship, support and service security. For certain data imported by an organisation into its Zuelen workspace, its role may depend on the context and the instructions of that organisation.
02Data we process
Depending on the features used, Zuelen may process the following categories:
- account and authentication data, including name, email address, technical identifiers, language preferences and Google OAuth information when that sign-in method is chosen;
- activity, company, organisation, member, role and professional-profile information;
- financial and accounting data, transactions, invoices, documents, imported statements and bank-related information, VAT, tax, CCSS and compliance data;
- messages sent to support or through the contact form;
- subscription and billing information, such as plan, status, and Stripe customer and subscription references; complete card details are processed by Stripe and are not stored directly by Zuelen;
- technical and security information needed to operate the service, such as logs, IP address, session information, security events and diagnostics.
03Purposes and legal bases
Data is processed to provide and secure the service, create and administer accounts and workspaces, perform requested features, manage subscriptions, answer enquiries, prevent abuse, improve product reliability and comply with legal obligations.
Depending on the processing, the legal bases are performance of a contract or pre-contractual steps, compliance with legal obligations, TradinGo SARL-S’s legitimate interests in securing and improving the service, and consent where it is specifically required.
04Providers and recipients
Data is available only to authorised people and providers needed to deliver the service, within the limits of their role.
- Supabase: authentication, database and application storage;
- Vercel: hosting, deployment and operation of the website and application;
- Stripe: payment, subscriptions, billing portal and payment-related fraud prevention;
- Resend: delivery of transactional emails and contact-form messages;
- OpenAI: processing of user-initiated Copilot or extraction requests when those features are used;
- Trustpilot A/S (Denmark): when you subscribe to Premium, we share your name and email address with Trustpilot so it can invite you to review Zuelen. Responding is optional.
- Google: OAuth authentication when the user chooses Continue with Google; Google Analytics and Google Ads for audience measurement, conversion attribution and campaign measurement, according to the user’s consent choices (without consent, no measurement cookies are used).
- Meta Platforms Ireland: measurement of Facebook and Instagram ad performance (Meta Pixel) on the website and the application’s sign-up pages, only with the user’s consent.
05Artificial-intelligence features
Some features, including Zuelen Copilot and document or statement analysis, may send OpenAI the content needed for a request initiated by the user. Zuelen limits the context sent to what is useful for the feature and configures application requests with storage disabled where that option is available.
AI output may be inaccurate and should be reviewed. AI does not grant access, determine permissions, replace professional judgement or constitute an official filing.
06International transfers
Some providers may process data from countries outside the European Economic Area. Where the GDPR requires it, transfers rely on a recognised mechanism such as an adequacy decision or standard contractual clauses, supplemented by appropriate safeguards where necessary.
07Retention
Data is retained for as long as needed to provide the service, maintain the user or organisation relationship, ensure security, resolve disputes and meet legal, accounting or tax obligations. Retention periods vary by data type. Deleted data may remain temporarily in secured backups until they rotate.
08Security
Zuelen applies proportionate technical and organisational measures, including access controls, workspace isolation, encryption in transit, data-level security policies, relevant logging and server-side secret protection. No system can guarantee zero risk.
09Your rights
Subject to the GDPR’s conditions, you may request access, correction, erasure, restriction and portability of your data, or object to certain processing. You may also withdraw consent without affecting processing that was lawful before withdrawal.
Send requests to contact@zuelen.lu. Reasonable identity verification may be required to protect your data.
10Complaints
You may lodge a complaint with Luxembourg’s National Commission for Data Protection (CNPD), including through https://cnpd.public.lu, without prejudice to any other administrative or judicial remedy.
11Changes to this policy
This policy may be updated to reflect changes to Zuelen, its providers or legal requirements. The latest-update date appears at the top of this page.