Legal information
Privacy policy
How Patcharo processes the personal data of site visitors, application users and customers: purposes, legal bases, recipients, retention and rights.
Version of 24 Oct 2026
On this page
1. Controller
The controller is Ahmed BECHIR EI (individual entrepreneur), trading as DELQUOR, 36 Rue Antonio Meucci, 38090 Villefontaine, France (the "Publisher" or "we"). For any question about your data or to exercise your rights: contact@patcharo.com.
The Publisher has not appointed a data protection officer, as this is not mandatory for its activity; requests are handled at the address above.
2. Two distinct roles
This policy describes the processing the Publisher is responsible for: visits to the site, management of accounts and their security, service e-mails, billing, support and administration of the Service.
Information entered in a Workspace (inventory, watches, alerts, actions, members and the Workspace audit log) is processed on behalf of the customer using it, who is the controller of that processing; the Publisher then acts as a processor under the data processing agreement. For that data, contact the organisation concerned first; the Publisher forwards it the requests it receives.
3. Data, purposes and legal bases
| Processing | Data | Purpose | Legal basis |
|---|---|---|---|
| Visits to the site and the application | IP address and technical request data, processed by the hosting provider to deliver pages; a technical log without IP address (method, page without parameters, status, duration); cookies described on the Cookies page | Deliver pages, protect them against attacks and abusive automated access, fix errors | Legitimate interest: offering an accessible and secure service |
| Account | E-mail address, password (kept in a non-reversible form by the authentication provider), optional display name, language, time zone, notification preferences, acceptance of the terms (version, date, language) | Create and manage the account, authenticate the user, prove acceptance of the terms | Performance of the contract (terms of use) |
| Account and session security | Session dates and activity; browser, system and device family and sign-in country, derived from the IP address by the hosting provider without the address being kept; two-factor factors (managed by the authentication provider); remembered devices (a token's fingerprint); security history (sign-ins, password or factor changes, session ends); attempt counters | Secure access, detect abuse, let the user see and end their sessions | Legitimate interest: the security of the account and of the Service, which article 32 of the GDPR also requires |
| Service e-mails and alerts | Recipient's e-mail address and language; alert content (Workspace and device names, watch labels or watched IP addresses, public vulnerability information); a pseudonymised delivery log (fingerprint of the address, status, time) | Send the e-mails the account needs and the alerts chosen, avoid duplicates and sending to failing addresses | Performance of the contract |
| Billing, once online payment opens | Customer's identity and billing address, VAT number, e-mail of the Workspace owner, plan, payments and invoices (at Stripe); Stripe customer and subscription identifiers (at the Publisher). Card data is processed by Stripe and never received by the Publisher | Manage the subscription, invoice, collect and recover payments | Performance of the contract; legal obligation for keeping accounting records |
| Support, contact and complaints | E-mail address, content of messages and attachments exchanged with the @patcharo.com addresses | Answer requests, handle complaints and notices | Legitimate interest: answering people who write to us; performance of the contract for customers |
| Exercise of rights | Request, exchanges and answer | Answer requests and be able to evidence it | Legal obligation |
| Administration of the Service and abuse prevention | Administration log (actions of the Publisher's staff, identity and sign-in IP address of the administrator, account concerned, reason); suspensions and their reasons; refused access attempts to the administration console, with the IP address | Trace administration operations, prevent and handle abuse, defend legal claims | Legitimate interest: the security of the Service and evidence of operations |
| Public indicators of compromise | IP addresses published by CERT-FR as indicators (free distribution) | Compare them with the addresses customers watch | Legitimate interest: the security of customers' systems |
The Publisher uses your data neither for advertising, nor for audience measurement, nor for commercial profiling; it does not sell it and sends no marketing. The machine translation service receives public texts from the vulnerability sources only.
4. Mandatory and optional data
The e-mail address and password are needed to create an account; billing data is needed to take out a subscription. Without them, the corresponding service cannot be provided. The display name and preferences are optional.
5. Recipients
- Authorised persons of the Publisher, within the limits of their duties and through an administration console that logs their actions.
- The other members of your Workspaces, who see your display name, e-mail address and role, and, for a managed customer, the operators of the MSSP concerned.
- The providers that host and run the Service (Cloudflare, Supabase, Resend, Zoho and, for billing, Stripe), described on the Sub-processors page.
- Cloudflare, as a separate controller, for one purpose of its own: it states that it uses the signals its bot-verification platform collects to improve its detection tools (Cloudflare's notice; see the Cookies page).
- Authorities, where the law requires it.
6. Transfers outside the European Union
- The database and authentication are hosted in Paris (AWS region eu-west-3). Their provider, Supabase Pte. Ltd. (Singapore), and its affiliates in the United States may access them for support and operations, under the European Commission's standard contractual clauses.
- The application runs on the global network of Cloudflare, Inc. (United States): a request may be processed outside the Union. Cloudflare participates in the EU–US Data Privacy Framework, covered by an adequacy decision of the European Commission, and its data processing addendum provides for the standard contractual clauses.
- E-mails are sent and logged in the United States by Plus Five Five, Inc. (Resend), which participates in the same framework and commits to standard contractual clauses.
- The @patcharo.com mailboxes are hosted by Zoho in the European Union. Payments, once opened, will be processed by Stripe Payments Europe (Ireland), with transfers to Stripe, LLC (United States), which participates in the same framework.
A copy of the applicable safeguards can be obtained at contact@patcharo.com.
7. Retention periods
| Data | Retention period or criterion |
|---|---|
| Account, preferences, acceptance of the terms | As long as the account exists; erased immediately when it is deleted. |
| Account security history (sign-ins, factors, devices) | 12 rolling months, then erased automatically; immediately when the account is deleted. |
| Session contexts | Deleted at the sign-in that follows the end of the session, or with the account. |
| Remembered devices | Valid for 30 days at most, then deleted 30 days after their expiry or revocation, at the next sign-in, or with the account. |
| E-mail delivery log | 180 days, then erased automatically; immediately when the account is deleted. The e-mail provider keeps contents and its logs for 30 days. |
| List of failing addresses or addresses that reported abuse | Kept as a non-reversible fingerprint, as long as needed to stop writing to those addresses. |
| Workspace data | On the customer's behalf, while the Service is used; the Workspace remains readable in read-only mode after the trial or subscription. Erased with its owner's account when the owner is its only member, or at the customer's request. |
| Invitations to join a Workspace (invited address) | 90 days after they were accepted, revoked or expired, then erased automatically. |
| Accounting records and invoices | 10 years from the end of the financial year, the period set by article L. 123-22 of the French Commercial Code (the tax retention period is six years, article L. 102 B of the French Tax Procedure Code). |
| Support and contact messages | 3 years after the last exchange. |
| Requests to exercise rights | Until the end of the third year after the answer. |
| Administration log and suspensions | 3 years after the operation or the end of the suspension. |
| Refused access attempts to the administration console | 90 days. |
| Public indicators of compromise | While CERT-FR publishes them, then kept with a note of their withdrawal. |
| Database backup copies made by the Publisher (encrypted) | 90 days at most after they are made. The database provider also applies its own backup policy. |
Deleting your account, from Settings › Account, is immediate: it erases the account, the security history, the e-mail delivery log and the Workspaces of which you were the only member, with their data. The audit logs of other Workspaces keep past actions, without your name.
8. Your rights
You have the rights of access, rectification, erasure, restriction of processing and portability of your data, and the right to object, on grounds relating to your particular situation, to processing based on legitimate interest. You may also set instructions about what happens to your data after your death.
- From the application: edit your profile and preferences (Settings › Profile and Notifications), see and end your sessions (Settings › Security), download a copy of your data as JSON (Settings › Account, and Settings › Workspace for an owner or an administrator), export the analysis as CSV (Reports), delete your account (Settings › Account). These downloads remain available while a new version of the terms awaits your acceptance (Settings › Legal information).
- By e-mail to contact@patcharo.com, preferably from your account's address, for any other request, in particular a copy of your data.
We answer within one month, which may be extended by two months for a complex request or many requests, in which case we tell you. Proof of identity is requested only in case of reasonable doubt. Requests about a Workspace's data are forwarded to the customer concerned, who decides on them.
9. Complaint to the CNIL
If you consider that your rights are not respected, you can lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, 75007 Paris, France, or online at cnil.fr, or with the supervisory authority of the EU country where you live or work.
10. Automated decisions
Patcharo takes no decision producing legal effects concerning you based solely on automated processing and carries out no profiling. The automatic matching between devices and vulnerabilities concerns devices, not people, and its results remain subject to the customer's judgement.
11. Security
The measures implemented to protect data (customer isolation, authentication, encrypted communications, minimisation, logging of administration access, backups) and their limits are described in the annex to the data processing agreement.
12. Changes
Each version of this policy is dated and remains available. Significant changes are announced to users by e-mail or in the application.