1. Controller
The controller for your personal data is Timofej Bogdanov (natural person; Belgian BV in registration), trading as SynaptoSec, Antwerpen (Antwerp), Belgium. Contact: synaptosec@gmail.com. A Belgian BV (besloten vennootschap) is in the process of registration. Company and VAT numbers will be published here as soon as they are issued. [DRAFT: whether the controller is the natural person or the BV once registered is a question for legal counsel — see docs/legal/LAWYER_QUESTIONS.md.]
No verified postal address exists yet; it will be published here as soon as one exists (docs/legal/OPEN_FACTS.md #4).
2. What data we collect
Account data. Accounts are created with Google sign-in (OpenID Connect) or GitHub sign-in. We collect only what the provider returns at sign-in: your provider subject identifier, email address, and display name. At first sign-in you accept the Terms of Service (v0.2-draft) and this Privacy Policy (v0.2-draft); the acceptance is recorded in your audit trail.
Session metadata. Sign-in and session events record a keyed hash of your IP address and a keyed hash of your user-agent. Raw IP addresses are not stored in the portal.
API key material. API keys are issued manually by our team. The key secret is revealed to you exactly once in the customer cabinet and is never stored in your browser. On our side only a prefix and an HMAC-SHA256 hash (with a root-only pepper) remain; the secret cannot be retrieved again.
Key requests. When you request an API key we record the plan, the status, the free-text reason you type, and a keyed hash of the requesting IP address.
Audit events. Account and security events are recorded in a hash-chained, ed25519-signed audit log: sign-ins, consent acceptance, API key requested, provisioned, revealed, revoked, reported compromised, plan changes, and deletions. The log stores ids, hashes and non-personal detail.
Administrative notifications. When you request a key, report a key as compromised, request account deletion, or create an account, the portal sends an administrative notification to the operator mailbox (hosted on Google/Gmail) containing the request identifier, a tenant identifier, the plan name, the UTC timestamp, and a masked email address (first character and domain only — never your full address). Key-compromise alerts contain only the key prefix. New-account notices are aggregated into a daily digest.
API request data (firewall). Every call to the AI Firewall API is logged with a timestamp, the API key id, the requested model, verdict flags — and, in the current software version, the first 10,000 characters of the request text and of the response text, plus the raw source IP address. This is a security and debugging log. A retention job deletes these rows after 30 days (the job currently runs when the service starts). Daily backups containing these rows are kept for 7 days. [DRAFT: a change that stops storing request text by default is in preparation; this section will be updated when it lands.]
Training-data audits. Datasets submitted for a training-data audit are processed in server memory only; they are not written to disk or a database. An audit event records that an audit ran.
Billing data. Payments are not live during early access. When billing launches, payments will run through Stripe as payment processor; card data would be handled by Stripe and would not touch our systems. We would receive only a customer identifier and invoice records.
3. Purposes and legal bases
To provide the Service (accounts, sessions, API keys, usage metering, key requests) — legal basis: performance of a contract. [DRAFT: legal basis to be confirmed by counsel.]
To keep the Service secure (session metadata, audit trail, request logging, abuse prevention) — legal basis: our legitimate interest in security and abuse prevention. [DRAFT: legal basis to be confirmed by counsel.]
To operate your account (administrative notifications to the operator) — legal basis: performance of a contract / legitimate interest. [DRAFT: to be confirmed by counsel.]
To meet legal obligations (billing and tax records once billing is live) — legal basis: legal obligation. [DRAFT: to be confirmed by counsel.]
Detection rules are refined using aggregated patterns; using your content to train models is not part of the current service design. [DRAFT: confirm with engineering and counsel.]
4. Where data is stored and who receives it abroad
The service infrastructure runs in Amsterdam, Netherlands (UpCloud). Data in transit is protected with TLS. Verified recipients and transfers:
- UpCloud — hosting, Amsterdam (NL)
- NVIDIA (NIM API) — semantic analysis of borderline requests: the request text of borderline traffic is sent to NVIDIA in the United States
- Google — sign-in (OpenID Connect); operator mailbox (Gmail) for administrative notifications (masked data only)
- GitHub — sign-in (OAuth)
- Telegram — operator notification channel (built; not yet active; messages carry request id, plan and timestamp only)
Transfers to the US-based processors above take place today. The transfer instruments we rely on (such as standard contractual clauses) are being finalized with legal counsel; we make no claim about them here until executed. [DRAFT: see docs/legal/OPEN_FACTS.md #6.]
5. How long we keep it
| Data type | Retention (verified) |
|---|---|
| Account data | 14-day cancellation window after a deletion request, then removed |
| Session & usage security metadata (keyed hashes) | Kept for security and abuse prevention; automated deletion enforcement is being implemented [flag] |
| API request logs (incl. first 10,000 chars of request/response text, raw IP) | Deleted by a retention job after 30 days (job runs at service startup) [flag: storage change in preparation] |
| Daily service backups | 7 days |
| Billing records (once billing is live) | 7 years [to confirm with counsel] |
6. We do not sell your data
We do not sell personal data and we do not share it for marketing purposes. The full processor list is at .
7. Your rights and how to exercise them
You have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data. To exercise these rights, contact synaptosec@gmail.com or use the deletion function in the customer cabinet. We respond within one month, as required by GDPR Article 12(3).
You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données).
8. Cookies
The public website sets no cookies. The customer portal uses four strictly necessary cookies (sign-in session, CSRF protection, and two short-lived sign-in helpers). Details and per-cookie properties: .
9. Security measures
- TLS for data in transit; AES-256-GCM encryption for stored audit reports
- API keys stored only as HMAC-SHA256 hashes with a root-only pepper; secrets shown exactly once
- HttpOnly, Secure, SameSite=Lax session cookies; CSRF double-submit protection
- IP addresses stored as keyed hashes (portal); hash-chained, ed25519-signed audit trail
- Sign-in links are single-use, 15-minute, and bound to the requesting browser
10. Automated decisions
The Service scores request content to produce security verdicts (allow/block). It makes no automated decisions with legal or similarly significant effect about you as a person. [DRAFT: confirm scope with counsel.]
11. Children
The Service is aimed at professionals and organizations. It is not directed at children, and we do not knowingly collect data from children. [DRAFT: age-verification approach to be decided.]
12. Changes to this policy
We notify registered users at least 30 days before a material change takes effect. Every change bumps the version at the top of this document and is listed in the .