Privacy Policy

1. Who We Are

3RA Intelligence (“3RA”, “we”, “us”) provides AI-powered competitive intelligence software. Our registered address is Amsterdam, Netherlands. For privacy matters, contact us at privacy@3ra.io.

2. Data We Collect

Account Data

When you register, we collect:

• Name and email address
• Company name and website URL
• Password (stored as a salted hash — we never see it)
• Plan and billing information (processed by Stripe; we store only plan tier)

Usage Data

While you use 3RA, we collect:

• Competitor URLs you configure for monitoring
• Report preferences and notification settings
• Feature usage patterns (aggregated)
• IP address and browser type (for security and analytics)

Competitor Data (Not Your Personal Data)

Our crawler collects publicly available information from competitor websites you specify. This data belongs to those third parties and is processed solely to generate your competitive intelligence reports.

3. How We Use Your Data

• Provide the service: Generate battlecards, monitor competitors, deliver reports
• Account management: Authentication, billing, plan limits
• Communications: Transactional emails (reports, alerts), product updates
• Security: Fraud prevention, abuse detection, audit logs
• Product improvement: Aggregated, anonymised usage analytics

We do not sell your data, share it with advertisers, or use it to train AI models without your consent.

4. Legal Basis (GDPR)

• Contract performance: Processing necessary to deliver the service you subscribed to
• Legitimate interests: Security, fraud prevention, product analytics
• Consent: Marketing emails (you can unsubscribe at any time)
• Legal obligation: Compliance with applicable laws

5. Data Sharing

We share data only with:

• Stripe: Payment processing (PCI DSS Level 1 certified)
• Postmark: Transactional email delivery
• Hetzner / Vercel: Infrastructure hosting (EU data centres)
• Plausible Analytics: Privacy-focused, cookieless analytics (no personal data)

All sub-processors are contractually bound to GDPR-equivalent data protection standards. We do not share your data with any other third parties.

6. Data Retention

• Active accounts: Data retained for the duration of your subscription
• After cancellation: Data deleted within 30 days unless you request export first
• Billing records: Retained for 7 years for tax compliance
• Anonymised analytics: Retained indefinitely in aggregate form

7. Your Rights (GDPR)

You have the right to:

• Access: Request a copy of all data we hold about you
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your account and personal data
• Portability: Export your data in a machine-readable format
• Objection: Object to processing based on legitimate interests
• Restriction: Request we limit how we use your data

To exercise any of these rights, email privacy@3ra.io. We will respond within 30 days.

8. Security

We protect your data with AES-256 encryption at rest, TLS 1.3 in transit, strict tenant isolation, and role-based access controls. We conduct regular security reviews and are working toward SOC 2 Type II certification. See our Security page for full details.

9. Cookies

We use cookies for authentication, preferences, and privacy-focused analytics. See our Cookie Policy for details.

10. Data Transfers

Your data is stored on servers within the European Economic Area (EEA). If any data is transferred outside the EEA, we ensure adequate safeguards are in place (Standard Contractual Clauses or equivalent).

11. Children

3RA is a B2B service not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

12. Changes to This Policy

We may update this policy. We'll notify you of material changes via email with 30 days notice. Continued use after changes constitutes acceptance.

13. Contact & Complaints

Questions or concerns? Contact our privacy team at privacy@3ra.io.

If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens.