Eleion (Italy-based, pre-incorporation). The current legal entity acting as Data Controller (name, VAT ID, legal seat) is disclosed on request to privacy@eleion.io. Once the Italian corporate entity is registered, this Policy will be updated within 14 days.
A Data Protection Officer is not mandatory for current processing scale (GDPR Art. 37). An external DPO will be designated before we reach the enterprise tier; registration with the Italian Garante will be updated accordingly.
| Category | Examples | Legal basis (Art. 6) | Retention |
|---|---|---|---|
| Account | email, organization slug, Stripe customer ID | Contract (6.1.b) | Account lifetime + 90 days |
| Scan metadata | target URL, ownership proof hash, timestamps, scan profile, findings | Contract (6.1.b) | 12 months |
| Audit / security logs | IP address, User-Agent, request/response size, Turnstile result | Legitimate interest (6.1.f) — abuse prevention | 12 months |
| Payment data | Customer ID (card details held by Stripe, PCI-DSS) | Contract + legal (6.1.b, 6.1.c) | 10 years (IT fiscal law) |
| Waitlist | email, optional domain, source IP at signup | Pre-contract (6.1.b) + consent (6.1.a) | Until unsubscribe |
We disclose the minimum necessary to deliver the Service. Full list with countries and scope is published at /sub-processors and updated before adding any new processor.
We do not share scan findings with any party other than the tenant who created the scan, except under a valid legal order or documented abuse report from the verified asset owner.
Customer data is kept in AWS eu-central-1. Metadata that may transit control-plane infrastructure operated outside the EEA (e.g. AWS IAM, Route53) is covered by Standard Contractual Clauses (Decision 2021/914, Module 2) and supplementary measures: encryption at rest via customer-managed KMS, encryption in transit (TLS 1.2+), minimization of personal data in logs. Our Transfer Impact Assessment is available to enterprise customers under NDA.
Exercise any right by emailing privacy@eleion.io. We respond within 30 days. You may also lodge a complaint with the Garante per la protezione dei dati personali or your local EU supervisory authority.
If a personal-data breach occurs with risk to your rights and freedoms, we notify the Italian Garante within 72 hours (GDPR Art. 33) and you without undue delay where the risk is high (Art. 34).
We use only strictly necessary cookies. Details at /cookies. No analytics, no advertising, no third-party tracking scripts.
The Service is a B2B security tool. It is not directed at or intended for persons under 18. We do not knowingly collect data of minors.
We notify material changes by email to registered accounts at least 30 days before effectiveness. Version history maintained at /privacy.