Privacy notice (GDPR Art. 13)

1. Data controller

The controller is [RAGIONE SOCIALE], a private individual, [INDIRIZZO] (“VINDICIS”, “we”). Privacy contact: nudgeprivacyteam@gmail.com.

2. What we process and why

We keep processing to the minimum needed to run a self-assessment tool.

• Free scan on the home page: the email address you type is sent to our API and, to run the lookup, to the breach sources listed in section 5. It is not written to our database or logs. The result is kept in memory for up to 4 hours under a keyed hash.
• Account: email address (stored encrypted, searchable only through a keyed hash), password (stored as an Argon2id hash), verification state, plan and timestamps.
• Monitored identity and scan results: the address you verify and the scan results, stored encrypted with AES-256-GCM, plus a history of up to the last 100 scans.
• One-time codes: stored as keyed hashes and deleted after they expire.
• Security logs: random request identifiers, route templates, status codes and error kinds. Logs never contain email addresses, passwords, codes or tokens.
• Orders: Lemon Squeezy order and subscription identifiers, plan and status. We do not receive or store card details.
• Transactional email: verification and reset codes, and for subscribers the monthly PDF audit, breach alerts and the reminder about overdue GDPR requests.
• GDPR kit (monthly plan), requester profile: the full name, extra email addresses, phone numbers, postal address, country and letter language that you enter, stored encrypted with AES-256-GCM and used only to write your requests. You can edit or delete it at any time.
• GDPR kit, sending mandate: when you accept the mandate we store your account, the mandate version, the date and time and a SHA-256 fingerprint of the text you accepted, as proof of your instruction. We do not store your IP address. Revoking the mandate stops requests that are still queued.
• GDPR kit, requests sent for you: when you ask VINDICIS to send requests we email the privacy contact of each company you selected, from our sending address, in your name, with you in copy (Cc) and your account email as reply-to. The text is generated from your profile at the moment of sending; we keep the company, the type of request, the status, the delivery status, the message identifier and the sent and due dates to show the tracker and send one reminder when a deadline passes. Requests you send yourself from your own mail app or a company form are never seen by us unless you log them.
• Public profile check (monthly plan): for subscribers’ verified identities we ask Gravatar whether a public profile exists for the address, using only a SHA-256 hash of the address. The result is stored encrypted with the scan results.
• Domain email check (monthly plan): the domain you enter is sent to our API, which reads its public DNS records and, for MTA-STS, one public policy file of that domain. The result is shown to you and is not stored.
• Connection check (paid plans, in the dashboard): runs entirely in your browser. It sends nothing to us or to anyone else and stores nothing.

3. Legal bases

• Performance of a contract, Art. 6(1)(b) GDPR: creating your account, verifying your inbox, running scans and delivering the paid audit, monthly reports and alerts, and, for the monthly plan, sending the GDPR requests you instruct us to send.
• Legitimate interest, Art. 6(1)(f) GDPR: security logs, rate limiting and abuse prevention, which are needed to protect the service and its users.
• Legal obligation, Art. 6(1)(c) GDPR: retaining accounting records of orders as required by law.
• Keeping the record of your mandate as proof of your instruction relies on legitimate interest, Art. 6(1)(f) GDPR.

4. Ownership verification

Full reports are shown only for an address whose owner confirmed a one-time code sent to that address. This protects the people described by breach data.

5. Recipients and processors

• OVHcloud (hosting). Our server is located in Canada. The European Commission has recognised Canada as providing an adequate level of protection for transfers to commercial organisations subject to PIPEDA, so no additional safeguards are required for this hosting.
• Brevo (email delivery: transactional email and the GDPR requests you ask us to send).
• Lemon Squeezy (merchant of record). It sells the plans, collects payment, handles VAT and acts as an independent controller for payment data; see its own privacy policy.
• Breach data sources: to run a scan, the email address is transmitted to Hudson Rock, LeakCheck and XposedOrNot, which answer with the records they hold. For the password check only a 5-character hash prefix is sent to Have I Been Pwned, through our API.
• Automattic Inc. (Gravatar): subscribers only, for verified identities only, we send a SHA-256 hash of the email address (never the address itself) to check for a public Gravatar profile. Automattic acts as an independent controller of the profiles it hosts.
• Public DNS resolvers: the domain email check queries the public DNS through Quad9 (Quad9 Foundation, Switzerland), over an encrypted DNS-over-TLS connection, which therefore receive the domain names you check.
• The companies you choose as recipients of a GDPR request (data brokers, telecom operators, energy suppliers and others) receive the request with the name and contact details you put in your profile. They act as independent controllers of their own records.

We do not sell personal data and do not use it for advertising or profiling. We have no analytics or advertising trackers.

6. Retention

• Security logs: 90 days.
• Account, identities and scan results: until you delete your account. Scan history keeps the last 100 scans per identity.
• Sessions: 30 days or until you sign out. One-time codes: a few minutes.
• Order records: for the period required by tax and accounting law.
• GDPR request log: until you delete the entry or your account. Requester profile and mandate record: until you delete the profile or your account.

7. Your rights

You can request access, rectification, erasure, restriction, portability and object to processing based on legitimate interest (Art. 15 to 21 GDPR). You can export everything we hold about you and delete your account directly from your dashboard, or write to nudgeprivacyteam@gmail.com.

You may lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the authority of your country of residence.

8. Security

Personal data in the database is encrypted with AES-256-GCM, access to the server is restricted, sessions use HttpOnly, Secure, SameSite=Strict cookies and traffic is encrypted with TLS.

9. Automated decisions

We do not take decisions based solely on automated processing that produce legal effects on you. The threat score is informational.

10. Changes

We will update this notice when processing changes and show the date at the top.