Legal

Privacy Policy

Last updated 28 September 2026

1. Data Controller

LeMans Labs OÜ · Estonian Commercial Registry 16872044 · Valukoja 8/1, 11415 Tallinn, Estonia · operating the ewpire platform (ewpire.com) · Contact: privacy@ewpire.com. We operate under the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus). A statutory Data Protection Officer is not required; data-protection queries reach us at the contact address above.

What ewpire is. ewpire is one AI workspace: you tell it what you want to do, and it answers, writes code, generates images, video and music, or runs a multi-model consensus, using leading AI models from several developers, with one account and one prepaid credit balance. It comprises:

Chat – questions, writing and analysis, including of files you attach.
Code – generation and editing of a website or application, with an in-browser preview and export or deployment at your request (formerly Validation).
Image and Video – generation and editing of images and videos from your prompts and reference files.
Music – songs and instrumental tracks generated from your prompts, where available.
Consensus – several models answer independently, critique each other's anonymised answers, and a synthesis shows where they agree and disagree; the Idea validation template (formerly Ideation) applies this to a business idea.
API – programmatic access to chat models with an API key.
Projects, the Founder workflow, AI Visibility (formerly Traffic: AI-readable presence and an audit of how AI assistants describe a project), and team workspaces that share a balance and projects.

Nature of the output (important for your rights). ewpire delivers AI-generated content, structured deliberation and estimates, not advice, and gives no guarantees. Consensus results show where the models agree and disagree and, for some formats, a confidence based on the models' positions – which themselves serve as the disclaimer of certainty. AI Visibility is designed to increase the probability of an accurate, consistent description of a project by AI systems; it never promises guaranteed visibility. This characterisation also governs how automated processing is described in Section 8 (Article 22).

AI interaction and AI-generated content (EU AI Act transparency). ewpire uses artificial intelligence throughout the Service. Under Article 50 of the EU AI Act (Regulation (EU) 2024/1689), whose transparency obligations apply from 2 August 2026 (and as informed by the AI Act Code of Practice published 10 June 2026): we disclose that, when you use Chat, the Code conversation, Consensus and the other interactive features, you are interacting with an AI system (Art. 50(1)); every generated image, video and music track carries a visible "AI-generated" label, generated PNG images carry machine-readable metadata naming the model, music tracks keep the provider's watermark and provenance data (or carry ewpire's own marker where the provider adds none), and other AI-generated outputs are marked as artificially generated in a machine-readable form where technically feasible (Art. 50(2)); the model that produced an output is shown with it; and any AI-generated or AI-manipulated image, audio, video, or text that could be taken for authentic is disclosed as such (Art. 50(4)). In this arrangement, ewpire generally acts as the provider of the AI system and you, as the user deploying our outputs in your own business, generally act as the deployer; both roles carry their own transparency duties under Article 50, and you are responsible for the deployer-side disclosures when you publish or distribute outputs you generate with the Service.

2. What Data We Collect

2.1 Account Data: email address and name (and, where supplied, a display name or organisation name), and your declaration whether you buy as a personal or a business customer. Authentication is by one-time code (OTP) or, if you choose it, by signing in with Google, in which case Google tells us your email address, name and Google account identifier; we do not store passwords. We also keep your workspaces, your role in each (owner, admin, member), and invitations you send or receive (the invitee's email address, role and the inviter).
2.2 Payment and Billing Data (via Stripe): name, email, billing address, country, and VAT ID where provided. Card numbers and CVV are never stored by ewpire – they are handled by Stripe (PCI DSS Level 1). Each workspace that buys credits gets a Stripe customer record, so that its invoices and payment methods are kept together. Where you choose to save a payment method (for example, in the billing portal), Stripe stores that payment method; ewpire holds only a token identifying it, never the card itself, and you may remove it at any time in your billing settings. Payment methods saved for a subscription bought before 25 September 2026 stay stored until that subscription ends, as needed to perform it (Art. 6(1)(b) GDPR).
2.3 Prompts, Conversations, Files and Project Inputs: what you type into Chat, Code, Image, Video, Music and Consensus (prompts, questions, instructions, lyrics you write, the conversation history), files you attach (PDF, DOCX, text, CSV, JSON, code, images) and the text we extract from them to pass to a model, reference images, project names and descriptions, the audience you describe in the Founder workflow, brand names, website URLs and content you supply to AI Visibility, and environment variables you add to a Code project (stored encrypted). This is the core content you entrust to the Service and may be commercially sensitive; see Section 5 on how it is processed by model providers.
2.4 Generated Output Data: chat answers, code versions and their files, previews and deployments, generated images and videos (with the metadata marking them as AI-generated and naming the model), generated music tracks and their lyrics (with the provider's watermark and provenance data), consensus sessions (each model's answer and critique, the synthesis, the confidence), and AI Visibility results. These are stored in your workspace.
2.5 Credit and Request Records: your workspace's balance, each top-up and its lot of credits with its expiry, credit holds, and one usage entry per charged request (which product, which model, how many credits); legacy credit history from before 25 September 2026 and its expiry. For every call to a model we keep a technical record – model, provider, token counts, latency, cost, credits charged, status and error code – without the content of the prompt or the answer. Team owners and admins see the usage and spend of each member of their team.
2.6 Usage Data: IP address (used for geo detection via the Cloudflare CF-IPCountry header, and as the key of short-lived rate-limit counters, including for visitors who use the prompt box before signing in, which are deleted after about a day), browser and device information, and basic interaction logs needed for functionality, security, and fraud prevention. Where the bot check is enabled, Cloudflare Turnstile evaluates browser signals when you ask for a sign-in code (Section 5.3).
2.7 Cookie Data and Browser Storage: a consent-preference record (browser storage); a cookie remembering which workspace is active; your theme choice (browser storage); the draft of a request you type before signing in, with any files you attach to it, kept in your own browser for up to seven days and not sent to us until you start it after signing in; and, where you opt in, first-party referral-attribution and first-touch cookies (see 2.8 and Section 5). Display currency is derived from network/geo signals and not stored on your device. Product and funnel analytics (PostHog, EU Cloud) load only after you accept the Analytics category; PostHog then stores an anonymous identifier in your browser's local storage (no advertising cookie). We set no advertising or cross-site tracking cookies. See the Cookie Policy.
2.8 Referral Programme Data: the referrer's identity (name, email, referral code), referral attribution records (which referred user signed up through the link, and each qualifying top-up that user made within twelve months, its service fee and the commission), and payout information. Payouts run over Stripe Connect Express, which stores the referrer's bank or debit details – ewpire does not. Attribution uses a 30-day click window via a consent-gated, first-party referral cookie. See Section 5.6 and Section 14.
2.9 Communications Data: transactional emails we send (via Resend) – sign-in codes, receipts, notices that a generation or consensus is ready, low-balance and payment notices, team invitations – in-app notifications, your notification preferences, and any support correspondence you initiate (general support: hello@ewpire.com). We do not operate any messenger, voice, or Telegram channel for the Service.
2.10 API Data: API keys (we store only a keyed hash and a short prefix, never the key itself), their names, limits and last use, and per-request records as in 2.5. We do not keep the content of API requests and responses, except that a response sent with an Idempotency-Key is cached for 24 hours so that a retried request is not charged twice.
2.11 Before you sign in: if you type a request into the prompt box before creating an account, the text is sent to our server to choose a mode and model and estimate the cost, is not sent to any AI model provider, and is not stored on our server; the draft stays in your browser (2.7).
2.12 Voice typing: if you use the microphone in a prompt box, your browser's own speech recognition (the Web Speech API) turns what you say into text. We receive only that text, as part of your request, never the audio. Some browsers (for example Google Chrome) send the audio to their vendor's servers to transcribe it, under that vendor's own terms and privacy policy; if you do not want that, type instead.

3. Legal Basis for Processing

3.1 Performance of a Contract (Art. 6(1)(b)): account data (including sign-in with Google, if you choose it); workspace and team membership; payment and billing data; prompts, conversations, files, project inputs and generated outputs (delivering the Service you asked for); credit and request records; API keys; referral records for participants; transactional communications and in-app notifications; account recovery. Showing a team member's usage and spend to the team's owners and admins is part of the team arrangement the member joins (Art. 6(1)(b)), and in any case rests on the team's legitimate interest in controlling its shared balance (Art. 6(1)(f)).
3.2 Legitimate Interest (Art. 6(1)(f)): IP for geo detection and for rate limits; usage and server logs for functionality, security, abuse and fraud prevention; bot protection on sign-in (Cloudflare Turnstile, where enabled); screening image and video prompts against prohibited content before they reach a model; the technical request records in 2.5 for billing accuracy, reliability and model routing; application error and performance monitoring (Sentry); and privacy-preserving, cookieless website measurement (Cloudflare Web Analytics, which sets no cookie and stores nothing on your device). A balancing test has been conducted; you may object (Section 8). Product and funnel analytics (PostHog) do not run on this legitimate-interest basis - they run only on your consent (Section 3.3); see Section 2.7.
3.3 Consent (Art. 6(1)(a)): the referral-attribution and first-touch cookies; opt-in marketing communications; and product/funnel analytics (PostHog, EU Cloud), which loads only after you accept the Analytics category and stores an anonymous identifier in local storage (see Sections 2.7 and 5.9). Withdrawable at any time without affecting prior lawful processing.
3.4 Legal Obligation (Art. 6(1)(c)): payment, invoicing and VAT records (7-year retention under Estonian accounting law, Raamatupidamise seadus); tax-onboarding and any tax-reporting obligations arising for referral payouts (note: we do not treat the referral programme as DAC7-reportable – see Section 14); responses to lawful authority requests.

4. How We Use Data

Service delivery (running Chat, Code, Image, Video, Consensus, AI Visibility and the API; choosing a model in Auto mode by fixed routing rules; storing your projects, conversations, files, outputs and credit records; notifying you when a generation or consensus is ready or your balance is low); billing and payments (top-ups, service fee, invoices, VAT; legacy subscriptions until they end); referral attribution and payout; support and communication; legal and tax compliance; and security (fraud, abuse and incident response). Product and funnel analytics (PostHog, EU Cloud) load only after you accept the Analytics category; see Sections 2.7 and 5.9. We do not use your prompts, files, conversations or generated content to train our own or any third party's models, and we obtain model access on no-training commercial terms (Section 5), except for the music models marked as third-party access, for which no such terms are available (Section 5.1).

5. Data Sharing

We share personal data only with the sub-processors listed below, each engaged under a GDPR Article 28 data-processing agreement and bound to act on our documented instructions. We do not operate on a "bring your own key" basis at launch: the model providers below are our direct sub-processors and we sell our own model usage to you.

5.1 AI Model Providers (the content of your requests is sent for inference). To answer a request, the content it needs – your prompt and the conversation it belongs to, files you attach (or the text extracted from them), reference images, for Code the project files concerned, and, only if you switch on "Share project context", a summary of the project – is transmitted over TLS to the provider of the model that handles it, which runs inference and returns the result. A Consensus session sends the question (and attached files) to several models' providers. We reach models through two API aggregators – services that give one connection to many models. The models in our catalog come from, among others, Anthropic (US), OpenAI (US), Google (US), xAI (US), Mistral AI (France, EU), Meta (open-weight models served by third-party hosting providers), and the China-based labs DeepSeek, Alibaba Cloud / Qwen, Moonshot AI (Kimi) and Z.ai (GLM) – see Section 6.
- An API aggregator for image, video and music models marked in the catalog as provided through it (United States), once enabled. It states that it keeps generated files for 14 days.
  - Suno (Suno, Inc., United States), reached through that aggregator – for the Suno music models, which are marked in the catalog as third-party access. The aggregator forwards your prompt, and any lyrics you write, to Suno under an arrangement we cannot verify, and we have no agreement with Suno. Suno's terms allow it to use what is submitted to it to improve its services and models, so the no-training commitment below does not apply to these models. They are used only when you select one, never by Auto; do not include personal data in a request to them.
We do not publish the names of the two API aggregators, because our supply arrangements are commercially confidential; we tell you who they are if you ask at privacy@ewpire.com (Art. 15(1)(c) GDPR), and business customers can get them under our Data Processing Agreement (Annex III).

Which provider receives your request depends on the model you choose, or on the model our Auto mode selects under published routing rules; the model is shown before and after the request. We use these providers on their commercial / API tiers and configure our model access to exclude endpoints that use inputs for training. Retention is tier-dependent: several providers retain inputs and outputs for up to approximately 30 days for abuse-monitoring and safety purposes and then delete them, unless a zero-retention arrangement applies, in which case content is not retained beyond what is needed to return the response. We do not retain inference content with providers as a store of record (Section 7).
5.2 Daytona (sandboxed build runtime of the former Validation builder). Used only for builds made through that builder; Code does not use it. Receives the project brief, builder instructions and generated code in order to execute such a build in an isolated environment.
5.3 Cloudflare (CDN, edge security and DDoS protection for ewpire.com and for sites you deploy; R2 object storage for the files you upload and the images, videos and music you generate; Pages hosting for sites you deploy from Code; and, where enabled, Turnstile bot protection when you ask for a sign-in code). Processes traffic data including IP addresses and browser signals, and provides the geo-detection header. When you deploy a site from Code, the deployed site and its content are hosted on Cloudflare.
5.4 Stripe Payments Europe Limited and/or other Stripe entities as applicable (billing and payments; Connect Express for referral payouts). Stores card data (PCI DSS Level 1) and, for referral participants, the financial-account and identity-verification details needed for payouts; ewpire receives payout status only. stripe.com/privacy
5.5 Resend (transactional email delivery – one-time codes, receipts, account and service notices). Receives the recipient email address and message content. resend.com/legal/privacy-policy
5.6 Referral Payouts (Stripe Connect Express). As in 5.4: for referrers who connect a payout account, Stripe collects identity and financial-account details directly; we receive only the payout status. See Section 14.
5.7 Infrastructure note. Our application and database run on Hetzner servers located in the EU (Germany). User-deployed apps are not co-located on Hetzner – they run on Cloudflare. Persistent personal data is stored on EEA infrastructure (Cloudflare EU and Hetzner Germany); the model providers in 5.1 process transient inference data only and do not serve as our store of record.
5.8 Sentry (Functional Software, Inc.). Application error and performance monitoring for reliability and security. Receives error and exception events, which may include IP address and technical request context. Events are stored in Sentry's EU region (Frankfurt). No analytics cookie is set; this processing rests on our legitimate interest in a secure, reliable Service (Section 3). sentry.io/privacy/
5.9 PostHog (PostHog, Inc., EU Cloud). Product and funnel analytics (page views and product events), processed only after you accept the Analytics cookie category (Art. 6(1)(a) consent). Data is stored on PostHog's EU Cloud (Frankfurt); an anonymous identifier is stored in your browser's local storage (no advertising cookie). We disable session recording and autocapture. posthog.com/privacy
5.10 Google (Sign in with Google – only if you choose it). Google authenticates you and tells us your email address, name and Google account identifier; Google acts as an independent controller of your Google account under its own privacy policy (policies.google.com/privacy).
5.11 GitHub (only if you connect it). If you connect a GitHub account to export code, we receive an access token for that connection and push the code you choose to the repository you choose; GitHub processes it under its own terms as your provider, not ours.
5.12 Other members of your team workspace. Content you create in a team workspace, and your usage and spend there, are visible to the members of that workspace as described in Section 3.1.
5.13 No Selling of Data. We do not sell, rent, or trade your personal data to any third party, ever.

6. International Data Transfers

Persistent personal data is stored on EEA infrastructure (Hetzner Germany for the database and application; Cloudflare R2 for files and generated media, see the note in Section 5.3). Certain sub-processors process data outside the EEA: the United States (the two API aggregators and the US model developers and hosting providers they forward to, Stripe, Resend, Cloudflare's global edge, Google for sign-in, and Suno for the music models reached through an API aggregator), Singapore or China (models of Alibaba Cloud / Qwen), and China (models of DeepSeek, Moonshot AI and Z.ai / GLM, when served by their developers).

For transfers to US recipients that are certified under the EU-US Data Privacy Framework (DPF), we rely primarily on the European Commission's adequacy decision for the DPF (Commission Implementing Decision of 10 July 2023) as the transfer mechanism for data falling within that recipient's active certification. For US recipients that are not DPF-certified, and for all transfers to Singapore (Alibaba Cloud / Qwen) and China (DeepSeek, Zhipu / GLM), we rely on the European Commission's Standard Contractual Clauses (Module 2, controller-to-processor, or Module 3, processor-to-processor, for requests an API aggregator forwards) together with a transfer-impact assessment and supplementary technical and organisational measures (encryption in transit via TLS, data minimisation, no-training and limited-retention contractual terms). The SCCs also serve as our fallback for DPF-certified recipients to the extent any transfer falls outside the scope of their certification.

Models from China-based labs – specific note. China is not the subject of a European Commission adequacy decision, and its legal regime may permit state access to data in ways that are difficult to challenge. Our model catalog lists models developed by DeepSeek, Alibaba Cloud / Qwen, Moonshot AI (Kimi) and Z.ai (GLM). They are labelled with their developer, are used only when you select one yourself, and are not selected by our Auto mode. When such a model is open-weight, the API aggregator may have it served by a hosting provider outside China, but we cannot guarantee that. If you do not want your content to reach a China-based provider, do not select these models. For requests that do reach them we rely on the SCCs (Module 3, through the API aggregator) and a heightened transfer-impact assessment.

Copies of the safeguards relied upon for any transfer are available at privacy@ewpire.com.

7. Data Retention

Account and project data (prompts, conversations, uploaded files, code versions, generated images, videos and music tracks, consensus sessions, AI Visibility results): for the life of your account, unless you delete an item or a conversation earlier; deleting a file or a generated image, video or track also deletes the stored object. On account termination, this data is deleted from live systems within 30 days, except where longer retention is legally required (see the billing/tax and referral carve-outs below). We will certify completion of live-system deletion within that 30-day period on request.
Backups: residual copies of your data may persist in encrypted backups after live deletion. These backups are overwritten on a rolling cycle of at most 90 days, are not restored except for disaster-recovery purposes, and are kept encrypted in the interim.
Credit records and technical request records: for the life of your account. On erasure, usage entries and request records (what you spent credits on) are deleted or de-identified; entries that evidence a payment (top-ups, and legacy subscription and pack purchases) are retained for the 7-year accounting period with your identity removed (anonymised).
Drafts typed before signing in: in your own browser only, for up to 7 days or until you start them.
Rate-limit counters keyed by IP address: about one day.
Cached API responses sent with an Idempotency-Key: 24 hours.
API keys: until you revoke them or close the account (only a keyed hash is stored).
Payment, invoicing and VAT records: 7 years (Estonian accounting law, Raamatupidamise seadus).
Referral programme and related financial records: for as long as the Stripe Connect account is active, plus 7 years (Estonian accounting law, Raamatupidamise seadus) to the extent the records form part of bookkeeping or invoicing. This bookkeeping retention is a carve-out from the 30-day live-deletion rule above.
Cookie and consent records: per the durations in Section 2.7 and the Cookie Policy. On account erasure, proof of your consent choices is retained in minimised form, decoupled from your identity, for approximately 3 years (to evidence consent and to defend potential legal claims, Art. 7(1) and Art. 17(3)(e)), then deleted.
Server and security logs: 90 days.
Transient inference data sent to model providers (Section 5.1): not retained by ewpire as a store of record; provider-side retention is governed by the no-training, limited-retention terms in Section 5.1.

8. Your Rights Under GDPR (Art. 15–22)

You have the rights of: Access (Art. 15), Rectification (Art. 16), Erasure (Art. 17, subject to the retention obligations in Section 7), Restriction (Art. 18), Data Portability (Art. 20), Objection (Art. 21), and rights concerning automated individual decision-making (Art. 22). You may also withdraw consent at any time (Art. 7(3)).

Automated decision-making (Art. 22). ewpire's outputs are structured deliberation and estimates, not advice, and they do not produce a decision that has legal or similarly significant effects on you. A chat answer, a consensus synthesis, generated code or media, or an AI Visibility audit is delivered to you as an input to your own judgement; consensus results carry the areas of agreement and disagreement and, where applicable, a confidence based on the models' positions; you remain the decision-maker. Auto mode picks a mode and a model for your request by fixed rules; that is a technical routing choice, which you can override, not a decision about you. We do not carry out solely-automated decisions producing legal or similarly significant effects within the meaning of Article 22.

Deleting your account in-app. You can erase your account yourself at any time from Settings -> Account -> Delete account. Because you are already signed in and we require a fresh one-time code at the moment of deletion, this satisfies our identity check (Art. 12(6)) and we act on it near-immediately: we revoke your sessions on every device, delete your profile, projects, idea reports, builds and operational history, delete your uploaded files and generated images and videos from storage, take down the sites we host for you (unless you choose to keep them running), and email you a durable confirmation of what was deleted and what we must retain (billing/VAT records and consent proof, as in Section 7). You can download your data first from the same screen (Art. 20).

How to exercise your rights (DSAR flow).

Submit a request. Email privacy@ewpire.com from the address associated with your account, stating which right(s) you wish to exercise (for example, access, erasure, portability). Requests on behalf of another person must include evidence of authority.
Identity verification. To protect your data we must be reasonably satisfied of your identity before we act. We may ask you to confirm details we already hold or to verify control of your account email (for example, via a one-time code). We collect only what is necessary to verify you and do not use it for other purposes. If we cannot verify your identity, we may decline to act and will tell you why.
Timing. We respond without undue delay and within one month (30 days) of receiving a verifiable request. This clock starts only once identity verification is complete. Where a request is complex or you have made a number of requests, we may extend by up to two further months; if we do, we will inform you of the extension and the reasons within the first month.
No fee, with limited exceptions. We do not charge for handling a request unless it is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act, and will explain our reasoning.

You also have the right to lodge a complaint with a supervisory authority (Section 17).

9. California (CCPA / CPRA)

Categories of personal information collected in the preceding 12 months: identifiers (name, email, IP); commercial information (top-ups, credit balance and usage; legacy subscriptions); internet and network activity; professional, employment or business information you include in idea/brand inputs; and inferences drawn within reports. We do not knowingly collect information from individuals under 16. Sources: directly from you, your interactions with the Service, Stripe, Cloudflare, and the model providers' returned outputs.

We do not sell personal information (§1798.140(ad)). We do not share personal information for cross-context behavioural advertising (§1798.140(ah)).

California rights: to know, delete, correct, opt out of sale/sharing (the default for us), limit the use of sensitive personal information, and non-retaliation. To exercise: privacy@ewpire.com, subject line "California Privacy Request – [access | delete | correct]"; response within 45 days (extendable by a further 45 days). An authorised agent may submit a request on your behalf. Shine the Light (§1798.83): we do not share personal information with third parties for their direct-marketing purposes.

10. Client-Side Registration Obligations

Some jurisdictions may require a controller to register with a supervisory authority or pay a data-protection fee (for example, the UK ICO data-protection fee, Poland's UODO, Bulgaria's CPDP). For data you process through the Service in your own business, you act as the controller and ewpire acts as your processor; any such registration on your side is your responsibility. ewpire does not file, pay, or advise on these registrations.

11. Account Recovery

Access to your account is via one-time code (OTP) sent to your account email (delivered through Resend), or via Sign in with Google if you use it. If you lose access to that email, contact privacy@ewpire.com so we can verify your identity and assist. Recovery links and codes are time-limited and single-use.

12. Children's Privacy

The Service is intended for founders and businesses and is not directed at anyone under 18. We do not knowingly collect personal data from minors and will delete any such data promptly on becoming aware of it.

13. Changes

We will notify material changes by email (via Resend) and/or an in-product notice at least 30 days before they take effect, and will post the updated effective date.

14. Referral Programme – Tax and Disclosure Framework

The referral programme pays a referrer 20% of ewpire's service fee on every top-up made by a referred user within twelve months of that user's sign-up (1% of the top-up amount at a 5% fee, excluding VAT). Each commission is held for about 30 days (until the refund and withdrawal window has closed) and then paid via Stripe Connect Express; it is voided if the top-up is withdrawn, fully refunded or charged back before payout, and reduced in proportion to a partial refund. Attribution uses a 30-day click window via a consent-gated, first-party referral cookie. There is no minimum payout. Commissions earned under the earlier rules (20% of one month of a first deposit) are paid under those rules.

Tax responsibility. Referral rewards may be taxable income to the referrer. The referrer is solely responsible for declaring and paying any tax due in their jurisdiction. ewpire does not provide tax advice.
Nature of the reward / DAC7. The referral reward is a marketing commission paid for introducing a customer; it is not consideration for a "relevant activity" within the scope of EU Council Directive (EU) 2021/514 (DAC7), which covers the rental of immovable property, personal services, the sale of goods, and the rental of transport. Accordingly, we do not consider ewpire to act as a reporting platform operator under DAC7 in respect of the referral programme and we do not undertake a DAC7 reporting role for referral rewards. We collect tax-onboarding information through Stripe (for example, W-8 / W-9 forms – see below) for payout and ordinary tax-compliance purposes, not for DAC7 reporting.
Tax forms. Stripe may require the referrer to complete the appropriate tax documentation (for example, IRS Form W-9 for US persons, or Form W-8BEN / W-8BEN-E for non-US persons) before payout.
No withholding. ewpire does not withhold tax from referral payouts; gross amounts are remitted via Stripe Connect, subject to any deduction Stripe is itself legally required to make.
VAT / place of supply. Where a referrer acts in a business capacity, the reward may be treated as consideration for a service, with VAT and place-of-supply rules applying according to the referrer's status and location; the referrer is responsible for any VAT obligations arising on their side.
Disclosure obligation (FTC / EU / UK / DSA). Referrers must clearly and conspicuously disclose their material connection to ewpire whenever they promote the Service, in line with the US FTC Endorsement Guides, EU and UK consumer-protection law, and the EU Digital Services Act transparency requirements. Undisclosed or deceptive promotion is prohibited and may result in removal from the programme and clawback of rewards.

15. EU Consumer Right of Withdrawal – Waiver for Immediately Performed Digital Services

The Service supplies digital content and digital services that are performed immediately – credits are made available at once on payment, and an answer, a file, an image, a video or a consensus is generated when you ask for it. To lose the 14-day right of withdrawal under Article 16(m) of Directive 2011/83/EU (Consumer Rights Directive) for such content, three conditions must all be met, and we implement each:

Prior express consent. On the payment page of each top-up, you tick a checkbox that is not pre-ticked, requesting immediate access to the credits.
Acknowledgment. In the same step, you acknowledge that once you use any credit from that top-up, you lose your right of withdrawal for it; a top-up from which no credit has been used can be withdrawn in full within 14 days if you bought it as a personal customer.
Durable-medium confirmation (Art. 8(7)). We provide you with confirmation of the contract on a durable medium within a reasonable time and at the latest at the time performance begins, including confirmation of the consent and acknowledgment above. In practice, we send a post-purchase confirmation email recording these.

This waiver does not affect any non-waivable statutory rights you may have, including under EU and Estonian consumer-protection law for non-conforming digital content.

Online withdrawal function. Where you retain a right of withdrawal, you may exercise it using the online withdrawal function ("withdrawal button") we make available, in addition to any other clear statement. We provide this function as required by Directive (EU) 2023/2673, which mandates it from 19 June 2026.

16. Contact

LeMans Labs OÜ · Valukoja 8/1, 11415 Tallinn, Estonia.

Privacy, data-protection and data-subject (DSAR) requests: privacy@ewpire.com
Legal notices: hello@ewpire.com
General support: hello@ewpire.com

17. Supervisory Authority

Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee. You may also lodge a complaint with the supervisory authority in your EU Member State of residence, place of work, or place of the alleged infringement.