# Privacy notice

DefenceLevel

What personal data we process, why, with whom, for how long, and what your rights are. We collect only what is strictly necessary to run the service: no advertising, no profiling, no behavioural analytics.

Last updated: 1 November 2026

## 1. Data controller

**SCARAFILE Consulting S.R.L.**, Piața Victoriei 4, ap. 9C, 300006 Timișoara, Romania · VAT RO42858116 · Trade register J35/2040/2020.

For any question or request about your data: **privacy@defencelevel.com**.

## 2. What data we process

| Data | Where it comes from | What it is used for |
| --- | --- | --- |
| Email address | You enter it to start the trial | Creating the account, sending you the sign-in link, the briefing, alerts and messages about the service and the subscription |
| Preferred language | The language of the website when you sign up, or the one you choose in the dashboard | Writing to you in your language |
| Products and vendors you list in My Defence (your infrastructure), the notes you write on the zones and your choices about the briefing and alerts by email | You enter them, if you wish, on the My Defence page of the dashboard | Showing you which briefing items concern your products and sending you only the emails you chose |
| Subscription status | Generated by the service and by Stripe | Knowing whether you are on a trial, subscribed or your subscription has ended; trial end and renewal dates |
| Stripe customer and subscription codes | Stripe | Linking your account to payments. We do not see or store card details |
| Billing details (name, address and, if you buy for a company, company name and VAT number) | You enter them on Stripe's payment page | Issuing invoices and applying the correct VAT |
| Log of emails sent | Generated by the service and by Resend | Knowing which emails were sent to you and whether they were delivered, to avoid duplicates and retry those not delivered; for the briefing and alerts, also your My Defence choice at that moment, to check that emails go out as you chose |
| Date and time of your last activity on the website with your account, with the country (derived from the IP address, which is not stored) and the type of device (computer, phone or tablet) | Recorded by the service when you use the website while signed in (dashboard, pages, exports), at most once every 10 minutes; only the latest are kept | Knowing whether the service is also used on the website, besides the emails, to improve it |
| Sign-ins to your account: date and time, browser, operating system, type of device (computer, phone or tablet) and country (derived from the IP address, which is not stored) | Recorded by the service every time you sign in with a sign-in or confirmation link | Showing you the recent sign-ins on the Account page, so you can spot a sign-in that is not yours and sign out the other devices |
| Second address for alerts: the email address of a person you name (for example a colleague or your team mailbox), with the status of their confirmation | You enter it, if you wish, on the Account page; the person confirms with the link we send them | Sending them a copy of the DEFCON 1 and 2 alerts you receive, only after their confirmation |
| Email address fingerprint (a code computed from the address, from which the address cannot be reconstructed) | Generated by the service when you delete your account after using the free trial | Not granting a second free trial to the same address |
| Technical connection data (IP address, browser type, time) | Recorded automatically by the servers hosting the website | Security and technical operation of the website |
| Messages you send us | You, by email | Replying to you |
| Visit statistics: page viewed, date and time, country (derived from the IP address, which is not stored), referring website or campaign, language and device type, with an anonymous code that changes every day | Generated by the website when you look at a page for a few seconds or use it, without cookies | Knowing how many people visit the website and where they come from, to improve it and understand which channels work |
| Sign-up origin (for example LinkedIn or a search engine, the campaign, the country and the page you signed up from) | Generated by the service when you sign up, from the visit in which you sign up | Understanding which channels bring subscribers |
| Sign-up attempts: date and time, outcome, country (derived from the IP address, which is not stored), the domain of the email address (the part after the @, never the address) and the result of the anti-bot check | Generated by the service each time the sign-up form is sent, or the sign-in form with an address that is not registered | Protecting the service from automated sign-ups and from emails sent to other people's addresses |
| Anti-bot check (Vercel BotID): an automatic test that your browser computes from its technical characteristics when you send the sign-up or sign-in form, without cookies and without storing anything in the browser | Your browser, on the pages with those forms; the check is made by Vercel, the provider that hosts the website | Recognising requests from automated programs; for now only the result is recorded, nothing is blocked |

You enter **card details** (number, expiry date, security code) directly on Stripe's pages, and they are processed only by Stripe: we do not see them. From Stripe we receive the outcome of payments and the billing details listed above.

We do not process special categories of data (health, opinions, origin, etc.). The only data about your systems are what you choose to enter in My Defence (vendors, products and notes on the zones): it is optional, and without them the service works just the same, with all the emails.

## 3. Purposes and legal bases

| Purpose | Legal basis |
| --- | --- |
| Providing the service: account, sign-in, briefing, alerts, dashboard | Performance of the contract (Art. 6(1)(b) GDPR) |
| Managing the trial, the subscription, payments and related messages | Performance of the contract (Art. 6(1)(b)) |
| Tailoring the dashboard and the emails to the products you list in My Defence | Performance of the contract (Art. 6(1)(b)), at your request |
| Recognising the names you add in My Defence that our catalogue does not know: we look them up, without any data about you, in the public vulnerability records and in NIST's National Vulnerability Database (NVD); if they exist, they enter the catalogue under their official name | Performance of the contract (Art. 6(1)(b)), at your request |
| Issuing invoices and keeping accounting and tax records | Legal obligation (Art. 6(1)(c)) |
| Protecting the website and the service from abuse and attacks; checking that emails are delivered | Legitimate interest in a secure and working service (Art. 6(1)(f)) |
| Preventing the free trial from being used more than once with the same address | Legitimate interest in offering the trial only once per person (Art. 6(1)(f)) |
| Replying to your messages and to requests about your rights | Performance of the contract or pre-contractual steps; legal obligation for GDPR requests |
| Measuring visits to the website and the origin of sign-ups, anonymously or with minimal data | Legitimate interest in knowing and improving our own website (Art. 6(1)(f)) |
| Understanding whether the service is also used on the website, besides the emails (date and time of the last activity) | Legitimate interest in improving the service (Art. 6(1)(f)) |
| Showing you the recent sign-ins to your account and letting you sign out the other devices | Legitimate interest in the security of your account and of the service (Art. 6(1)(f)) |
| Sending copies of the alerts to the second address you name | Performance of the contract with you (Art. 6(1)(b)) and consent of the person named, given with the confirmation link (Art. 6(1)(a)), which they can withdraw at any time with the link at the bottom of every copy |

Providing your email address is necessary to conclude and perform the contract: without it we cannot provide the service. Billing details are needed to issue invoices, as required by tax law.

We do not use your data for advertising, we do not sell it and we do not pass it on to third parties for their own purposes. We do not take automated decisions about you: the DEFCON level is calculated from public vulnerabilities, not from people.

## 4. Who we entrust the data to

We use providers that process data on our behalf, as processors, under agreements compliant with Art. 28 GDPR:

| Provider | What it does | Where |
| --- | --- | --- |
| Vercel Inc. | Hosts the website and the service functions | United States; service functions in the European Union (Ireland), pages from the global network |
| Supabase Pte. Ltd. (Singapore) | Service database | European Union (Ireland) |
| Resend (Plus Five Five, Inc.) | Sending the service's emails | United States; sending through infrastructure in the European Union (Ireland) |
| OVHcloud (OVH Hosting Limited, Ireland) | Mailbox that receives messages sent to @defencelevel.com addresses | European Union (France) |

**Stripe** (Stripe Payments Europe, Limited, Ireland) handles payments as an independent controller of payment data, under its own privacy notice.

The service also uses tools that **receive no personal data**: operational monitoring (Healthchecks.io), NIST's National Vulnerability Database, to which we send only product names, and the Anthropic API, through which artificial intelligence writes and checks the service's texts starting only from public vulnerability data: it never receives subscribers' data, nor My Defence data.

For providers based in the United States, the transfer takes place under the EU-US Data Privacy Framework, where the provider participates in it, or under the standard contractual clauses approved by the European Commission. Supabase is based in Singapore, which has no adequacy decision: the transfer takes place under the standard contractual clauses of its data processing agreement, and the database stays in the European Union (Ireland).

## 5. How long we keep the data

| Data | Period |
| --- | --- |
| Sign-up never confirmed (an email address to which we sent the confirmation link, without the link being used) | Deleted automatically after 3 days, together with the emails sent; only the count of the attempt remains, without the address |
| Account without an active subscription (trial expired, subscription ended, complimentary access over) | Kept until you delete it from the dashboard or ask us to erase it: we never delete it automatically, so you can resume the service whenever you like |
| Account you delete from the dashboard | Deleted immediately, together with the related data |
| Log of emails sent | Deleted together with the account |
| My Defence products, notes and choices | Until you remove them from the My Defence page; deleted immediately if you delete your account. In the database backups they remain, encrypted, until the backups expire (at most 7 days) |
| Date, time, country and device of the last activity | Replaced at each new activity; deleted together with the account |
| Sign-ins to the account | 90 days; deleted immediately if you delete your account |
| Second address for alerts | Until you remove it from the Account page or delete your account; if the person stops receiving the copies, it is kept only to show you, until you remove it |
| Email address fingerprint of people who delete their account after using the trial | Deleted automatically after 24 months |
| Accounting and tax records | For the period required by Romanian law |
| Technical connection data | For the limited period set by the hosting provider, for security and operational purposes only |
| Email messages | For as long as needed to handle the request and any follow-up |
| Detailed visit statistics | 90 days; after that only anonymous daily totals remain (by page, origin, country and device) |
| Anonymous visitor code | The secret value that generates it changes every day and the previous day's value is deleted: the code cannot be linked to you, nor across different days |
| Sign-up origin | Together with the account |
| Sign-up attempts | 12 months |

## 6. Cookies and browser storage

The website uses **three technical cookies**: `is_session`, which keeps you signed in to the dashboard after you have used the link received by email (it lasts at most 30 days, is deleted when you sign out and stops working on all other devices when you sign them out from the Account page); `dl-auth`, which contains no data and only indicates that you are signed in, so the public pages show the link to the dashboard (it lasts at most 30 days and is deleted when you sign out); and `dl-lang`, which remembers the language you chose in the selector, so the main page opens in that language (it lasts 12 months). The language choice is also saved in the browser's local storage, together with the choice of light or dark theme and, if you close it, the invitation to set up My Defence. If you have not chosen a language, the main page uses the one set in your browser.

If you choose the light or dark theme with the button at the top, your choice is stored only in your browser (local storage, item `dl-theme`): it is never sent to us and you can delete it at any time from your browser settings.

We do not use profiling, advertising or statistics cookies, nor third-party tools that track you. The visit statistics described above use no cookies and store nothing in your browser: that is why the website shows no cookie banner (technical cookies do not require consent). If your browser sends the Global Privacy Control or Do Not Track signal, your visit is not recorded.

## 7. Your rights

At any time you can ask to:

- **access** your data and receive a copy;
- **correct** it if it is inaccurate;
- **delete** it (the account and the related data, except what the law requires us to keep);
- **restrict** processing or **object** to processing based on legitimate interest;
- **receive** it in a structured, machine-readable format (portability).

You can also **download a copy of your data** (in a JSON file) and **delete your account** yourself at any time from the Account page of the dashboard, with the “Download a copy” and “Delete account” buttons.

Write to **privacy@defencelevel.com** from your account's email address: we reply within one month. You can choose in My Defence which emails to receive, pause them all from the Account page or from the link at the bottom of every email, or cancel the subscription in the dashboard.

You also have the right to lodge a complaint with a supervisory authority: in Romania the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP, `www.dataprotection.ro`), or the authority of the country where you live or work.

## 8. Security

Sign-in to the service works without passwords, through signed, single-use, short-lived links. On the Account page you can see the latest sign-ins to your account and sign out all other devices with one click. The database is in a data centre in the European Union, with restricted access and encrypted connections. If you find a security issue in our systems, follow the [Security reports](https://defencelevel.com/security) page.

The list of products you enter in My Defence describes your infrastructure and we treat it as confidential: we use it only to show you and send you what concerns you, we do not share it with anyone and we do not use it for any other purpose. A name our catalogue does not know is looked up on its own, without any data about you or your company: if it exists, it enters the catalogue under its official name, the same for everyone; if it does not, other subscribers do not see it.

In the database, My Defence vendors, products and notes are **encrypted** (AES-256-GCM) with a key that the database does not contain: anyone accessing only the database, one of its backups or an export of it would see only encrypted text. The service decrypts them only in memory, to show them to you and to choose the briefing and alerts. The service's administration area does not show your products or your notes, only how many products and zones an account has; the artificial intelligence checks that review the briefing and alerts can read only public vulnerability data. The details are on the page [How we protect My Defence data](https://defencelevel.com/data-protection).

## 9. Minors

The service is not intended for people under 18 and we do not knowingly collect data about them.

## 10. Changes to this notice

If we change the way we process data, we update this page and the date at the top; if the change is significant, we notify the affected users by email before it takes effect.

---

Web page: https://defencelevel.com/privacy