Privacy policy

1. Data controller

The controller of the personal data collected on datalogia.io is the publisher of the service, whose full identity is given in the legal notice.

Contact for any question about personal data: rgpd@datalogia.io.

2. Data collected

• Account: email address, username, password (stored hashed by Supabase Auth), language and account settings, second authentication factor if you turn it on. If you sign up with Google or GitHub, the name, email address and profile picture that service sends us.
• Profile picture: optional. If you add one, it is stored with Supabase and reachable by anyone who knows its address.
• Identifiers submitted for analysis: depending on what you enter: email address and phone number (two of each at most), full name, username, domain name, IP address, crypto wallet address. Nothing else is asked.
• Attestation and mandate: before each search, your attestation, with the date and your IP address. If you sign a removal mandate, your legal name, the date and your IP address.
• Results: leak sources found, categories of exposed data, severity, tracking of removal requests, investigation plans and the images you attach to them, dark web reports and the data you submitted for them.
• Payment: Stripe customer identifier, plan, subscription status and dates, credit purchases, invoices for cryptocurrency payments. Before each payment, proof of your consent: version of the terms accepted, request for immediate performance, date, amount and IP address. Card numbers are handled by Stripe: Datalogia does not see them.
• Referrals: your code, the commissions and credits earned. For a payout, the account holder's name, the IBAN and the BIC: we keep them with the request, and they are sent by email to our support team, who make the transfer.
• Forms: contact and FAQ questions: email address, name for the FAQ, message. Training booking: first name, email address, age range, gender (optional), field, who it is for, number of people, language, platform, message. Requests to exercise your rights: identity, type of request, correspondence.
• Forum: the alerts you post and their images, signed with your username and visible to everyone.
• Browsing and security: IP address, technical logs, audit events, anti-abuse counters that hold your IP address for a few minutes.

The service is for people aged 16 and over. If you learn that an account belongs to someone younger, write to us at rgpd@datalogia.io: we delete it.

3. Purposes of the processing

• run the searches, monitoring and dark web reports you ask for;
• send and follow up removal requests in your name, under your mandate;
• manage your account, your payments, your credits and referrals, payouts included;
• answer your contact, training and rights requests;
• send you notifications about the service;
• protect the service and prevent abuse, including searching for other people's data without a right to;
• keep proof of your consents and mandates, and meet our accounting obligations.

Your data is neither sold nor used for advertising or commercial profiling.

4. Legal bases

• Performance of the contract (art. 6.1.b): account, searches on your own identifiers, monitoring, dark web reports, removal requests, payments, referrals, training.
• Legitimate interest (art. 6.1.f): security, abuse prevention, error tracking, proof of mandates and consents; searching for identifiers you attest you hold or for which you have a mandate (section 5); temporary retention of data from leaks.
• Consent (art. 6.1.a): recording of your navigation to understand a failure (section 10). You can withdraw it whenever you want.
• Legal obligation (art. 6.1.c): accounting records, answers to requests to exercise rights.

5. People who have no account

The service must only be used to search for identifiers you hold, or for which the person concerned has given you a written mandate. Before each search, you attest to this.

Two groups of people without an account are concerned: those whose identifiers a user searches for while attesting they have the right to, and those whose data appears in the leaks we consult (section 7 for how long). They have the rights in section 8.

Anyone can object to their identifiers being searched for, without having an account, by writing to rgpd@datalogia.io or through our form. The identifiers concerned are then added to an exclusion list, where they are kept as a fingerprint (hashed), not in clear text.

6. Processors, recipients and transfers

Your data is never sold. These providers process it on our behalf, under contract (article 28 GDPR):

Other recipients receive data without being our processors:

To run a search, the identifier you enter is sent to the types of sources below, depending on its type and the depth chosen. They receive only that identifier, nothing about your account.

We give the countries we have established. Treat the other sources as established outside the European Union. If you exercise your right of access, we give you the name of each source and each recipient that received your data.

Transfers outside the European Union. For a provider established outside the Union, the table gives the safeguard: the European Commission's standard contractual clauses, or certification under the EU-US Data Privacy Framework (DPF). For a source established in a country the Commission recognises as adequate, the transfer relies on that decision. For the other sources, we have neither a contract nor any other safeguard: what is sent is limited to the identifier searched for and only happens because a search is requested. If you do not want your identifiers sent to them, do not run the search. Brokers established outside the Union receive your removal request only because you asked us to send it.

For any question about these transfers, or to obtain a copy of the safeguards: rgpd@datalogia.io.

7. Retention periods

• Account: for as long as it exists. Deleting it, from your profile, is immediate: the account, its files and the data that depends on it are erased, except as stated below for mandates and accounting records.
• Scans and results: 12 months after they are created, or 6 months if you chose that in your settings, then deleted automatically, together with the removal requests attached to them.
• Technical cache of searches: 30 days.
• Data from leaks: addresses, names, phone numbers, usernames, and passwords or their hashes, as they appear in the leaks, including for people who have no account with us. 12 months after collection, then deleted automatically.
• Audit and security logs, notifications: 12 months. Anti-abuse counters disappear after a few minutes.
• Contact, training and withdrawal requests, dark web reports: 24 months. For a contact form, the period runs from the last activity, and your address and message are erased as soon as your account is deleted.
• Removal requests to brokers: 3 years after they are created, so we can prove what was requested in your name.
• Mandates: 5 years after they are revoked, as proof of the authorisation given. A mandate survives the deletion of the account: it is then treated as revoked on that date.
• Requests to exercise rights: 5 years.
• Accounting records: 7 years, under Belgian accounting obligations: purchases, cryptocurrency payments, proof of consent to payment, referral commissions and payouts (account holder's name and IBAN included). These records are kept after the account is deleted, with no link to it.
• Monitoring: until you remove the item, or with the account.
• Backups: an encrypted copy of the database is made every day and kept for 14 days. Erased data disappears from backups no later than 14 days afterwards.

8. Your rights

Under the GDPR (EU 2016/679) and the Belgian law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, you have the following rights:

• right of access, rectification and erasure;
• right to the portability of your data;
• right to object and to restrict processing;
• right to withdraw a consent at any time, without affecting what was done before.

To exercise these rights, use our dedicated form or write to rgpd@datalogia.io. We reply within one month (art. 12 GDPR).

You may lodge a complaint with the Data Protection Authority (APD, the Belgian supervisory authority).

9. Security

• encryption in transit (TLS) and at rest;
• secure authentication and row-by-row access rules in the database (Row Level Security);
• strict security headers (HSTS, CSP) and logging of sensitive access;
• masking of email addresses, IBANs, IP addresses and secrets before anything is sent to the error-tracking tool.

10. Cookies and trackers

The following cookies are always set, because the service does not work without them:

Your browser also keeps, without a cookie, your answer to the banner, a referral code for as long as the tab is open, and a few display preferences. These values stay on your device; the referral code is only sent to us at payment.

Without your consent, on the basis of our legitimate interest in keeping the service secure: technical error tracking (Sentry), with the masking described in section 9, and Cloudflare's anti-bot widget on the login, sign-up and forgotten-password pages. No advertising or audience-measurement cookie is set.

One thing alone depends on your consent: the recording of your navigation, offered by the banner. It only starts if you clicked "Accept", it masks text, form fields and media, and it serves only to understand a failure. You can change your mind at any time with the "Cookies" button in the footer of the public pages.

11. Changes

We may amend this policy. In the event of a significant change, you are told by email. The update date appears at the top of the page.

This policy is written in French. The English and German versions are translations; if they differ, the French text prevails.

12. Contact

Data protection: rgpd@datalogia.io