What data we keep, why, and for how long.

Version 2026-10-19-final, 19 October 2026.

It covers the app.techmerion.gr website, the Techmerion Χρηματοδοτήσεις app when you use it from AI apps such as ChatGPT, payments, service emails and support.

The techmerion.gr website and its contact form have their own privacy policy. Your conversations in ChatGPT or another AI app are covered by the policy of the company that provides it.

The controller is TECHMERION Ε.Ε., Πινδάρου 10, 15126 Μαρούσι, VAT number (ΑΦΜ) 803296625.

General Commercial Registry (ΓΕΜΗ) number: 194033803000.

For any matter about your personal data, write to us at [email protected] or, if you have an account, from the “Support” page.

We have not appointed a Data Protection Officer (DPO). The company handles your requests directly, at the contact details above.

• Google account. When you sign in, Google gives us a permanent identifier of your account, your name, your email (only if it is verified) and the verification flag. We do not receive your password, your contacts or other data from your Google account.
• Settings and acceptances. Your preferred language, optionally your company name, and which version of the terms you accepted and when.
• Usage record. For each search: when it happened, the channel (for example ChatGPT), which connected app made it, how many results were found, whether it counted and against which allowance. We do not store the text of your question. For a short time we keep a fingerprint of the search, made with a secret key, from which the text cannot be rebuilt, so that the same search does not count twice.
• Search results. For 24 hours we keep the list of programmes a search found, so that further pages can load. We also keep which programmes have been shown to your account, so that you can ask for their details.
• App connections. Which apps you have connected, when, with which permissions and when they were last used. We store access tokens only as cryptographic hashes.
• Support. The messages you send us, including withdrawal statements and complaints, and our replies.
• Payments. For each order: product, amount, currency, status, whether you buy as an individual or as a business, country, payment provider and the provider's payment identifiers, the access periods, refunds, and the statements you made before payment (acceptance of the terms, request for an immediate start) with the version of the terms. Only the payment provider handles your card details; we neither see nor store them.
• Invoice details and tax documents. If you buy as a business, the details you give for the invoice: company name, tax number (ΑΦΜ), tax office (ΔΟΥ) and address. For each payment or refund, the type and number of the tax document.
• Service emails. To which address, when and what kind of service email we sent you (for example a payment confirmation or an expiry reminder), without its full text.
• Record of actions. We record key actions on your account, such as its creation and deletion, acceptance of the terms, app connections, orders, payments and withdrawals. When a member of our team takes an action on your account, for example a refund or a suspension, we record who did it, when and why.
• Technical logs. For the security and operation of the service: time, request path without parameter values, response code, duration and IP address in partly masked form, as well as temporary request counters per IP address or network to prevent abuse. We do not log the contents of requests.
• Demand totals. Per week, without your account and without the text of your question, we count how often each filter, each topic we recognise from a fixed list (for example “energy” or “hiring”), each band of result counts, each programme's details and each answer language was asked for, and, when a search seems not to have been understood, the reason from a fixed list (for example “unknown words” or “no results”), without the words. In “Settings” you can ask us not to count your searches.

Purchases are not open yet. Until they open, no payments are made and we send no data to the payment providers; what this policy says about payments, tax documents and refunds will apply from then on.

• From you: settings, invoice details, statements before payment and support messages.
• From Google, when you sign in: identifier, name and email.
• From the AI app you connected: the inputs of each tool call, the app's identifier and its language, as the section “When you connect an AI app” explains.
• From the payment provider: whether the payment was completed, refunded or disputed, with its identifiers.
• From our systems: the usage record, technical logs and request counters.

Searches do not need personal data. Do not write names, identity numbers, tax numbers, IBANs, card details, passwords, health information or other people's details in your questions.

If you search as a private person, for example for housing, a scholarship or disability support, general facts are enough, such as the region, the kind of home or the kind of support. Do not write identity or social security numbers (ΑΜΚΑ), your income or health details.

The app does not ask for your business's facts to compare them with programme conditions; the tools take only the search text, the filters and programme or document codes.

Where we rely on legitimate interest, that interest is the security and proper operation of the service, the fair use of the free searches, improving the catalogue from anonymous totals of what is asked for, staff accountability and proving or defending our rights. We use as little data as possible, for example masked IP addresses and fingerprints instead of text. You can object to this processing, as explained in the section “Your rights”.

The Google data are needed to create the account, and the invoice details to issue an invoice, which the law requires. Without them we cannot provide the service or complete the purchase. The company name in the settings is optional.

We do not base any processing on your consent. The statements you make before payment concern the contract and the right of withdrawal, not your personal data.

We do not use your data for advertising, we do not build profiles, and we do not use your data to train AI models.

We do not send you newsletters or marketing emails without your explicit, separate consent.

• Google, for signing in with your Google account. For your own Google account, Google acts as an independent controller.
• Stripe or Viva Wallet, depending on the provider used for your payment. We give them your email and, for Viva Wallet, also your name. For some purposes, such as fraud prevention and their regulatory duties, the provider acts as an independent controller with its own privacy policy. For purchases through Stripe the seller is Link (a Stripe company), which acts as an independent controller for the transaction.
• Hosting provider for the server and the database, with data centres in the European Union, as our processor.
• Cloudflare, as our processor, for content delivery, DNS, protection against attacks and storing the encrypted backups in storage located in the European Union.
• Google Workspace, as our processor, for our business email, from which we reply and send service messages.
• OpenAI (ChatGPT) and, once the connection is available, Anthropic (Claude), only when you connect the app and ask questions. They receive the results of our tools, as described in the section “When you connect an AI app”, which also explains who is responsible for your conversations. They do not process data on our behalf, nor we on theirs; each is responsible for its own processing.
• Accountants and legal advisers, as far as needed for issuing tax documents, bookkeeping and legal matters, under a duty of confidentiality.
• Public authorities, such as the tax authority (AADE, for transmitting tax documents), supervisory authorities or the courts, only when the law requires it.
• Successor to the service, if the service is transferred to another company, for example in a merger, with the same protection and after we tell you.

Providers acting as processors handle the data only on our instructions and are bound by contract terms under GDPR Article 28. For the hosting provider these terms are part of its general terms, and we have asked it to confirm in writing that they cover our service.

We do not sell your data and we do not give it to third parties for their own marketing.

With each call to a tool, the app sends us only what that tool needs, never your conversation: for a search, the search text (up to 300 characters), the filters chosen (type of funding, region, who the programme is for, status, checked programmes only, deadline within how many days), the number of results per page, the page and a retry key, so that a search sent again does not count twice; for a programme's details, its code and, optionally, the catalogue version it came from; for a document, its code and the words of the question; for your access status, nothing. Each call also carries the connection token, which tells us the account and the app, and technical details the app adds, such as its language. We use all this only to answer, and the language only to answer in it. We do not store the search text or the technical details; we keep the usage record, for a short time the search fingerprint, and the anonymous weekly demand totals described above.

We return programme details from our catalogue and your access status (for example how many searches are left and when the plan ends) to the app. We do not return your name, email or payments.

Your conversations are handled by the company that provides the app, under its own terms and privacy policy; we do not see them. For personal accounts in the European Union, the controller is OpenAI Ireland Limited for ChatGPT and Anthropic Ireland, Limited for Claude. If you use an account given to you by a business or organisation, for example ChatGPT Business or Enterprise, or Claude Team or Enterprise, the organisation is usually responsible for the conversations and the app's company processes them on its behalf; your account administrator can tell you more.

If you revoke the connection from the “Connections” page or disconnect the app, we stop receiving requests from it. This does not delete the conversations the app keeps; for those, contact the company that provides it.

The service database and the backups are in the European Union. Some providers, such as Google, Cloudflare and Stripe, or their sub-processors may also process data outside the European Economic Area, mainly in the United States.

In these cases, transfers rely on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for certified providers, or on the Commission's standard contractual clauses with additional measures where needed.

You can ask us for information about the safeguards for each transfer at [email protected].

When you delete your account, all your connections and sessions are revoked at once and the account data is deleted as described in the table. Any data we must keep by law or to defend legal claims is kept only for as long as required and is not used for any other purpose.

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you, and we do not build profiles. The service does not judge your eligibility for any programme.

Some rules are applied automatically, such as the search allowances, the daily cap and temporary request limits to prevent abuse, as described in the terms. If you believe such a rule was applied wrongly, write to us and a person will look at it.

• Access: to find out which of your data we hold and to receive a copy.
• Rectification: to have incorrect or incomplete data corrected.
• Erasure: to have your data deleted, except what we must keep by law or to defend legal claims.
• Restriction: to have processing limited for a time, for example while a correction request is checked.
• Portability: to receive the data you gave us in a machine-readable file.
• Objection: to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest. We then stop, unless we have compelling legitimate grounds that override your interests or the data is needed for legal claims.
• Withdrawing consent: if we ever ask for your consent to something, you can withdraw it at any time, without affecting what was done before.

You can do most of this yourself from the “Your data” page of your account: download all your data as a JSON file and delete the account. In “Settings” you can change the language, the company name and whether your searches count in the demand totals, and in “Connections” your connections.

For anything else, write to us at [email protected]. Exercising your rights is free of charge. We reply within one month; if the request is complex or we have many requests, the deadline may be extended by up to two more months, as the GDPR allows, and we will tell you within the first month.

To protect your data, we may ask you to confirm that the request comes from you, for example by signing in to your account or writing from the account's email.

If you believe the processing breaks the law, you have the right to lodge a complaint with the Hellenic Data Protection Authority, 1-3 Kifisias Avenue, 115 23 Athens, Greece, tel. +30 210 6475600, www.dpa.gr, or with the supervisory authority of the country where you live or work. We would be glad to discuss it with you first.

We use only cookies needed for the service you ask for to work. We do not use analytics or advertising cookies and we do not load third-party measurement tools. That is why, as the law allows, we do not ask for cookie consent.

• All connections use encrypted HTTPS.
• Sessions, one-time codes and access tokens are stored only as cryptographic hashes.
• IP addresses in the access logs are stored partly masked, and request parameter values are not logged.
• Our staff have access only as far as needed for support, payments and security, are bound by confidentiality, and every action is recorded.
• Backups are encrypted before they leave the server, with a key that only we hold.

If a breach affecting your data occurs, we notify the Data Protection Authority within 72 hours where the law requires it, and we tell you without undue delay where the breach is likely to put you at high risk.

The Techmerion account is for businesses and adults. You must be at least 18 years old to create an account. If we learn that an account belongs to a minor, we will delete it and refund anything paid.

If we change this policy in a material way, for example with a new purpose, a new type of data or a new recipient, we will email you before the change applies, saying what changes. The version and date of the current policy are shown at the top of the page; we keep every earlier version and send it to you on request.

For questions about this policy or your data, write to us at [email protected].