Privacy Policy

1. Data we process

• Account and team data, including names, email addresses, roles, and authentication records.
• Agent configuration, scan requests, model responses, findings, reports, and audit events.
• Provider credentials supplied for scanning, encrypted before database storage.
• Contact-form submissions and support correspondence.
• Billing identifiers and subscription status when Stripe billing is enabled; Secuvon does not store full card details.
• Operational data such as IP-derived security records, request identifiers, timestamps, and error logs.

2. Why we process it

We process data to provide the service, secure accounts, run requested assessments, generate evidence and reports, administer subscriptions, answer enquiries, prevent abuse, and meet applicable legal obligations. The applicable legal basis depends on the activity and may include contract, legitimate interests, consent, or legal obligation.

After you activate your account, we send up to three short emails to help you get started, including a note from our founder. They are part of providing the service you signed up for and contain no advertising. The optional ones include a link to stop them.

3. Deployment location and providers

The current hosted deployment uses Railway region sfo in the United States for the application, database and Redis. Cloudflare handles traffic at its global edge. The provider inventory on our trust page also identifies Zoho Mail in the EU and Resend as configured for product email, with live delivery still unverified. That inventory is awaiting reconciliation with the internal vendor register; a customer's signed agreement governs any contractual processor schedule.

When you run an assessment, prompts and responses are sent to the AI provider you select under your own provider account and terms. A self-hosted deployment may use different infrastructure and providers. We do not sell personal data.

4. Retention

These are configured retention windows, not a promise that every category is automatically deleted. The hosted service currently blocks the global scan, report, evidence and audit purge pending tenant-scoped controls. Platform-record cleanup runs only when its operator switch is enabled. Contracts, legal holds and backup retention may also affect when data is removed.

When Secuvon enables retention cleanup, a daily job deletes contact-form messages, in-app feedback and unused sign-ups after these periods. A sign-up is deleted only if it was never activated and has no later account or tenant activity. Security audit entries are kept separately. We remove their direct account link, but they may still contain account identifiers, IP addresses and event details under our separate audit retention policy.

Completed account deletion or confirmed erasure clears the IP address and browser details from audit rows linked to that account and detaches those rows from the user record. Other event details or identifiers can remain, so the rows should not be treated as fully anonymous. Other records may be kept for security, dispute, tax or legal reasons.

5. Security

Secuvon provides encrypted credential storage, scoped access controls, audit logging, secure-cookie support, SSRF protections, and deployment checks that require HTTPS and database TLS in staging and production. Operators remain responsible for their infrastructure, secrets, access policies, monitoring, and offsite backups. No online service can promise absolute security.

6. Your choices and rights

Depending on applicable law, you may have rights to access, correct, erase, restrict, object to, or receive a portable copy of personal data, and to complain to the competent supervisory authority. The hosted MVP offers password-confirmed account deletion under Settings and Security, subject to billing safety checks. Its data-export tab is not available. Use the contact route below to request a copy of your data.

Submit privacy requests by email to privacy@secuvon.ai or through the contact form. We may need to verify identity before acting on a request. Secuvon does not claim that a statutory Data Protection Officer has been appointed.

7. Changes

We may update this policy when the product, deployment, providers, or legal requirements change. Material changes will be shown here with a new effective date. This policy is product information, not legal advice to customers about their own processing activities.