EU Data Act notice

The EU Data Act (Regulation (EU) 2023/2854) applies from 12 September 2025. MoatDefender is a data processing service under the Act (a software service you use online), so Chapter VI on switching between data processing services applies. Chapter II (data from connected products) does not, because MoatDefender makes no connected products.

These terms form part of the Terms of Service.

1. Your right to switch and export

1. You can ask to move your data to another provider or to your own systems, or to have it deleted, at any time.
2. Notice: none is needed for self-service export. For an assisted switch, the maximum notice period is two months.
3. Transition: we complete the switch within a transition period of at most 30 calendar days after the notice period. If that is technically impossible, we tell you within 14 working days, explain why, and set an alternative period of at most seven months, during which the Service keeps running.
4. Retrieval window: after the transition you have at least 30 calendar days to retrieve your data.
5. Erasure: after the retrieval window, we erase all exportable data, unless you ask otherwise or the law requires us to keep it.
6. Charges: none. We charge nothing for switching or data egress, now or later. The Act phases switching charges out entirely from 12 January 2027; we start at zero.
7. Your agreement ends when the switch is done, if you ask for that.

2. What you can export

The export at /api/account/export (signed in; soon a button in Settings → Your data) is one JSON file with the schema moatdefender.export/v1, containing:

• your profile (email, display name, handle, role, plan, token balance);
• every dossier: company, source kind, source fingerprint, file name, extracted facts, and the version that produced them;
• every reading: Moat Index, range, band, confidence, powers, independent check, context readings, method version, model names, evidence fingerprint, timestamp;
• share links and their settings (never password hashes);
• ideas, theses and notes, if you use those features.

Not exportable, because we don't keep it: the original deck files. Not exportable, because they are our internal workings and trade secrets, which the Act lets a provider exclude: prompts, model configurations and internal scoring code. The method itself is public at /methodology.

3. Interoperability

The export uses JSON with stable field names. The same data is available through the MoatDefender API and MCP server, so another service can import it without a manual conversion.

4. Where the infrastructure is, and government access

Our infrastructure runs on Vercel (application functions in the EU, Stockholm; static delivery from the nearest edge) and Supabase (EU, Stockholm). Model providers are in the United States (see Sub-processors). We take technical, legal and organisational measures, including encryption in transit and contractual commitments from processors, to prevent international governmental access to non-personal data held in the EU where that access would conflict with EU or member-state law (Art. 32). If we receive such a request, we disclose only the minimum legally required and tell you first, unless that is prohibited.

5. Contact

hello@moatdefender.com