Privacy Policy

1. Data controller

Mekhanteur Amin, an individual (see legal notice), is the controller for the data processing described below. Contact: assyamekhanteur@gmail.com.

2. Data collected

• The URL of the site you submit for analysis
• Your IP address, solely to limit the number of scans launched in a short interval (anti-abuse)
• The scan results (score, detected vulnerabilities)
• During a payment: the information sent to Stripe (email, payment method). Vetora never sees or stores your card number.
• Anonymized traffic statistics, cookie-free, via Vercel Web Analytics
• Your email address, only if you voluntarily sign up for the newsletter via a dedicated checkbox (never pre-checked, never tied to using the scan itself)
• If you subscribe to Continuous Monitoring: your email address and the monitored URL (to run automatic rescans and send you alerts), as well as your Stripe customer and subscription identifiers (to manage billing)

3. Purposes and legal basis

• Providing the scan and security report service — contract performance (GDPR Article 6.1.b)
• Processing payment for the full report or the subscription, running automatic rescans, and sending score-drop alerts — contract performance
• Preventing abuse and overload of the service (per-IP scan limit) — legitimate interest (GDPR Article 6.1.f)
• Measuring site traffic to improve it — legitimate interest
• Sending the newsletter (newly detected vulnerabilities, fix guides) — explicit consent (GDPR Article 6.1.a), revocable at any time

4. Data recipients

Your data is shared with the following providers, strictly for the service's operation:

• Supabase Inc. — database hosting
• Vercel Inc. — site hosting and traffic measurement
• Stripe Payments Europe, Ltd. — payment and subscription processing
• Resend (Resend, Inc.) — sending alert and subscription-management emails, if you are a subscriber

These providers may be established, or may process data, outside the European Union (notably in the United States). We have not yet formally verified the specific safeguards (standard contractual clauses, etc.) put in place by each — feel free to contact us for more details.

5. Data retention

Scans and their results are currently kept for an indefinite period — no automatic deletion is in place yet. You can request the deletion of a scan at any time by contacting us. Your email (newsletter) is kept until you unsubscribe, which you can request at any time by email. Data tied to a Continuous Monitoring subscription (email, monitored URL, Stripe identifiers) is kept for the duration of the subscription, then deleted or anonymized within a reasonable time after cancellation, unless a longer legal retention obligation applies (billing).

6. Cookies

Vetora uses no tracking cookies. Traffic measurement (Vercel Web Analytics) works without cookies and without a persistent identifier.

7. Your rights

Under the GDPR, you have the right to access, rectify, erase, object to, and port your data. To exercise these rights, contact us at assyamekhanteur@gmail.com. You may also file a complaint with the French data protection authority, the CNIL.

8. Security

Data is stored on Supabase with Row Level Security enabled, and transmitted over HTTPS. Payments are processed by Stripe, PCI-DSS certified.