I built an app with AI. Do I need a GDPR representative?

This guide is for you if you built an app with Lovable, Bolt, Cursor, Replit or v0, and people in the EU use it. You live outside the EU, and you may not have a company yet. In most cases you need to name a representative in an EU country where your users are, a contact point there for officials and users, and list it in your privacy policy. The UK has its own version of the rule, covered near the end.

What is a GDPR representative?

The GDPR is the EU's data protection law: the rules on how apps and businesses handle information about people. A GDPR representative is a person or company in an EU country where your users are that you name in writing to act for you under those rules.^[1] Officials and your users can contact it about anything to do with how your app handles their data.^[1] If the law reaches you from outside the EU, you need one, unless a narrow exemption fits.^[1]

Think of it as your app's address in the EU. Say the data protection authority in France, the official body that enforces the GDPR there, has a question about your signups table. It can write to your representative instead of you, or as well as you.^[1]

Does the rule apply to your app?

It depends on what your app does and who uses it. In our reading, it makes no difference which tool you used or how fast you built it. The law asks three things:^[1]

1. Do you offer your app to people in the EU? A free app counts too.^[1]
2. Do you monitor what people in the EU do? That means tracking their behaviour for a purpose, such as choosing ads.^[2]
3. Do you have a real base in the EU? The rule covers only those not "established" there, which implies real activity through a stable set-up.^[1] In our view, an EU office or an EU company that runs your app is the usual example.

A yes to the first or second question, and a no to the third, means you need an EU representative, unless the narrow exemption below fits.^[1]

"Offering" means you intend people in the EU to use your app.^[2] The European Data Protection Board (EDPB), which publishes official guidance on the GDPR, looks at signals together. They include naming an EU country, marketing to an EU audience, an EU phone number or domain, and offering your app in a language or currency that is not the one used in your own country, especially an EU country's.^[2] If you build from Toronto, an English page is not a signal; a German translation is. A site people in the EU can merely reach, or a contact email address, is not enough.^[2] In our view, open signups combined with signals like euro prices usually make your app an offer to the EU.

"Monitoring" covers a wide range of tracking. The EDPB's examples include behavioural advertising, meaning ads chosen from what someone has done. They also include online tracking through cookies or similar techniques.^[2] One of its examples is an app developer in Canada with no EU base that monitors people in the EU. The GDPR applies to it.^[2]

Monitoring implies "a specific purpose in mind" for data about someone's behaviour. Not every online collection or analysis of data counts automatically.^[2] So a PostHog or Vercel Analytics snippet means checking your purpose. In our view, plain visitor counts are the weakest case, and following individual users is a strong one.

Does an EU server region count as an EU base?

In our view, no. Say you run your app from Austin, with your Supabase database or Vercel deployment in Frankfurt. The GDPR's introductory notes say establishment implies "the effective and real exercise of activity through stable arrangements".^[1] A server region you pick in a dashboard is a hosting setting, not activity of that kind.

Does it matter that you are just one person?

No. The rule follows the controller, meaning whoever decides why and how personal data (information about people) is used. The controller can be a "natural or legal person": an individual or a company.^[1] If you decide what your app collects and what it is for, that usually makes you the controller.

If you build an app for a client who decides what happens to the data, you may be their processor. That means you handle the data on the client's behalf.^[1] The rule covers processors too, so you and your client can each need a representative.^[1]

There is an exception for private life. The GDPR does not apply to a person's "purely personal or household activity".^[1] Its introductory notes add that this means "no connection to a professional or commercial activity". Examples are letters, keeping addresses, and social networking within that private setting.^[1]

A paid app is the clear case. In our view, once a Stripe checkout takes money, your app is a commercial activity, and the exception does not fit.^[1] The GDPR still applies to controllers or processors (whoever decides on the data, or handles it for someone who does) that provide the means for such personal or household activities.^[1]

For a free app, the EU's top court gives a pointer. In a case under the law before the GDPR, which used the same words, it said the exception covered only private or family life.^[3] Publishing personal data on the internet for "an indefinite number of people" was clearly outside it.^[3] In our view, a free app that anyone can sign up for is much closer to that case than to private life.

Does it matter that your app is free?

No. The rule covers offering a service "irrespective of whether a payment" is required.^[1] A free AI note-taker that stores signups in Supabase is treated like a paid app when it comes to offering a service.

What if you only have a waitlist?

The guidance we rely on does not mention waitlists, so this is our view. A waitlist form on its own, with nothing else aimed at the EU, is an unclear case. Being merely reachable is not enough.^[2] A plain landing page that collects emails is weak evidence of an offer to the EU. Add a language or currency that isn't your own country's, or a launch post in an EU community, and the picture changes. Check again before you open the app, and whenever you add tracking for ads.

Does it matter that you only have a few users in the EU?

No. The exemption turns mainly on whether your handling of data is "occasional". A small number of users does not make regular handling occasional.^[2] The exemption applies only if all three of these are true:^[1]

1. Your handling of the data is occasional.
2. It does not include, on a large scale, the especially sensitive types of data the GDPR lists separately, or data about criminal convictions.
3. It is unlikely to create a risk for the people whose data it is.

The EDPB says handling data is occasional only if it is not done regularly and happens outside the normal course of your business or activity.^[2] In our view, a live app that takes signups every day is regular, however few the users. The third condition is strict too. The test is whether a risk is unlikely, not whether a risk is high.^[2]

Not sure whether this applies to you? Take the 3-minute check →

What happens if you skip it?

In our view, the realistic first consequence for a small app is not a fine. It is a European customer or partner asking for the representative line in your privacy policy. Say a Berlin agency wants to use your tool for its clients. Its supplier questionnaire asks for your EU representative, and you have nothing to put there.

Fines do exist. Under the GDPR's fine rules, not naming a required representative can lead to a fine of up to €10 million. For a business, the cap is 2% of last year's worldwide turnover, meaning revenue, if that is higher (Article 83(4)).^[1]

The Dutch data protection authority has used it. In a decision announced on 12 May 2021, it fined the website LocateFamily.com €525,000 for having no EU representative.^[4][5] The site also faced €20,000 for every two weeks without one, up to €120,000 more.^[6] The exemption did not help, because its handling of data was regular.^[6]

What does a representative do, and not do?

A representative is your contact point in the EU, not your compliance team.

• It is the EU address for officials and users.^[1]
• It is named in your privacy policy, next to your own contact details.^[1]
• It keeps your record of processing too, meaning your record of how your app handles data. The record also names the representative.^[1]
• It does not take over your responsibility. Naming one does not shift your own liability, meaning your legal responsibility.^[2] An English court held that a representative is not liable in your place.^[7] Fines aimed at you can still be addressed to it.^[2]

So a representative will not lock down a Supabase table that anyone can read, or write your privacy policy for you. Those jobs stay with you. See what Gabsor's GDPR representative service includes.

Do you need a UK representative too?

Yes, if you have no base in the UK and you offer your app to people there or monitor them.^[8] The UK rule requires a representative in the UK, with the same exemption for occasional, low-risk handling.^[8] The EU rule requires a representative in an EU country where your users are,^[1] so you need two appointments, one in each. Say you sell to customers in London and Berlin. You need both. Gabsor's plans include EU and UK representation.

How to appoint one, in five steps

1. Check whether you are in scope. Work through Figure 1, or take the 3-minute self-assessment. Your Stripe dashboard and your launch posts show where your users are and where you market.
2. Choose a representative in an EU country where your users are. The law requires one there.^[1] If you also serve people in the UK, choose one in the UK too.^[8]
3. Make the appointment in writing, as the GDPR requires;^[1] in practice you sign a letter. Keep a signed copy.
4. Add the line to your privacy policy. It must give your representative's name and contact details.^[1] We suggest a simple line: "EU representative: [name], [postal address], [email]." Apple and Google require a privacy policy link for every app in their stores, so update the one your listing points to.^[9][10]
5. Keep your record of processing. Name your representative in it and share it with them.^[1] Organisations with fewer than 250 staff can skip it only if their handling is occasional, unlikely to create a risk and free of sensitive or criminal data, as of October 2026.^[1] In our reading, a live app does not meet that. We suggest listing what your app collects, why, and which tools, such as Stripe or PostHog, receive it.

What it costs

In our view, this is one of the cheapest and fastest parts of the GDPR to fix. Gabsor's Essential plan, for under $500k annual revenue, starts from $79/month, billed annually. An app making $2,000 a month is well under that limit.

Sign-up, onboarding and the digital Letter of Appointment take about five minutes. Annual plans are prepaid and non-refundable.