Patcharo — Privacy policy Version of 23 Oct 2026 How Patcharo processes the personal data of site visitors, application users and customers: purposes, legal bases, recipients, retention and rights. 1. Controller The controller is Ahmed BECHIR EI (individual entrepreneur), trading as DELQUOR, 36 Rue Antonio Meucci, 38090 Villefontaine, France (the "Publisher" or "we"). For any question about your data or to exercise your rights: contact@patcharo.com. The Publisher has not appointed a data protection officer, as this is not mandatory for its activity; requests are handled at the address above. 2. Two distinct roles This policy describes the processing the Publisher is responsible for: visits to the site, management of accounts and their security, service e-mails, billing, support and administration of the Service. Information entered in a Workspace (inventory, watches, alerts, actions, members and the Workspace audit log) is processed on behalf of the customer using it, who is the controller of that processing; the Publisher then acts as a processor under the data processing agreement (https://patcharo.com/legal/dpa). For that data, contact the organisation concerned first; the Publisher forwards it the requests it receives. 3. Data, purposes and legal bases - Processing: Visits to the site and the application Data: IP address and technical request data, processed by the hosting provider to deliver pages; a technical log without IP address (method, page without parameters, status, duration); cookies described on the Cookies (https://patcharo.com/legal/cookies) page Purpose: Deliver pages, protect them against attacks and abusive automated access, fix errors Legal basis: Legitimate interest: offering an accessible and secure service - Processing: Account Data: E-mail address, password (kept in a non-reversible form by the authentication provider), optional display name, language, time zone, notification preferences, acceptance of the terms (version, date, language) Purpose: Create and manage the account, authenticate the user, prove acceptance of the terms Legal basis: Performance of the contract (terms of use) - Processing: Account and session security Data: Session dates and activity; browser, system and device family and sign-in country, derived from the IP address by the hosting provider without the address being kept; two-factor factors (managed by the authentication provider); remembered devices (a token's fingerprint); security history (sign-ins, password or factor changes, session ends); attempt counters Purpose: Secure access, detect abuse, let the user see and end their sessions Legal basis: Legitimate interest: the security of the account and of the Service, which article 32 of the GDPR also requires - Processing: Service e-mails and alerts Data: Recipient's e-mail address and language; alert content (Workspace and device names, watch labels or watched IP addresses, public vulnerability information); a pseudonymised delivery log (fingerprint of the address, status, time) Purpose: Send the e-mails the account needs and the alerts chosen, avoid duplicates and sending to failing addresses Legal basis: Performance of the contract - Processing: Billing, once online payment opens Data: Customer's identity and billing address, VAT number, e-mail of the Workspace owner, plan, payments and invoices (at Stripe); Stripe customer and subscription identifiers (at the Publisher). Card data is processed by Stripe and never received by the Publisher Purpose: Manage the subscription, invoice, collect and recover payments Legal basis: Performance of the contract; legal obligation for keeping accounting records - Processing: Support, contact and complaints Data: E-mail address, content of messages and attachments exchanged with the @patcharo.com addresses Purpose: Answer requests, handle complaints and notices Legal basis: Legitimate interest: answering people who write to us; performance of the contract for customers - Processing: Exercise of rights Data: Request, exchanges and answer Purpose: Answer requests and be able to evidence it Legal basis: Legal obligation - Processing: Administration of the Service and abuse prevention Data: Administration log (actions of the Publisher's staff, identity and sign-in IP address of the administrator, account concerned, reason); suspensions and their reasons; refused access attempts to the administration console, with the IP address Purpose: Trace administration operations, prevent and handle abuse, defend legal claims Legal basis: Legitimate interest: the security of the Service and evidence of operations - Processing: Public indicators of compromise Data: IP addresses published by CERT-FR as indicators (free distribution) Purpose: Compare them with the addresses customers watch Legal basis: Legitimate interest: the security of customers' systems The Publisher uses your data neither for advertising, nor for audience measurement, nor for commercial profiling; it does not sell it and sends no marketing. The machine translation service receives public texts from the vulnerability sources only. 4. Mandatory and optional data The e-mail address and password are needed to create an account; billing data is needed to take out a subscription. Without them, the corresponding service cannot be provided. The display name and preferences are optional. 5. Recipients - Authorised persons of the Publisher, within the limits of their duties and through an administration console that logs their actions. - The other members of your Workspaces, who see your display name, e-mail address and role, and, for a managed customer, the operators of the MSSP concerned. - The providers that host and run the Service (Cloudflare, Supabase, Resend, Zoho and, for billing, Stripe), described on the Sub-processors (https://patcharo.com/legal/subprocessors) page. - Authorities, where the law requires it. 6. Transfers outside the European Union - The database and authentication are hosted in Paris (AWS region eu-west-3). Their provider, Supabase Pte. Ltd. (Singapore), and its affiliates in the United States may access them for support and operations, under the European Commission's standard contractual clauses. - The application runs on the global network of Cloudflare, Inc. (United States): a request may be processed outside the Union. Cloudflare participates in the EU–US Data Privacy Framework, covered by an adequacy decision of the European Commission, and its data processing addendum provides for the standard contractual clauses. - E-mails are sent and logged in the United States by Plus Five Five, Inc. (Resend), which participates in the same framework and commits to standard contractual clauses. - The @patcharo.com mailboxes are hosted by Zoho in the European Union. Payments, once opened, will be processed by Stripe Payments Europe (Ireland), with transfers to Stripe, LLC (United States), which participates in the same framework. A copy of the applicable safeguards can be obtained at contact@patcharo.com. 7. Retention periods - Data: Account, preferences, acceptance of the terms Retention period or criterion: As long as the account exists; erased immediately when it is deleted. - Data: Account security history (sign-ins, factors, devices) Retention period or criterion: 12 rolling months, then erased automatically; immediately when the account is deleted. - Data: Session contexts Retention period or criterion: Deleted at the sign-in that follows the end of the session, or with the account. - Data: Remembered devices Retention period or criterion: Valid for 30 days at most, then deleted 30 days after their expiry or revocation, at the next sign-in, or with the account. - Data: E-mail delivery log Retention period or criterion: 180 days, then erased automatically; immediately when the account is deleted. The e-mail provider keeps contents and its logs for 30 days. - Data: List of failing addresses or addresses that reported abuse Retention period or criterion: Kept as a non-reversible fingerprint, as long as needed to stop writing to those addresses. - Data: Workspace data Retention period or criterion: On the customer's behalf, while the Service is used; the Workspace remains readable in read-only mode after the trial or subscription. Erased with its owner's account when the owner is its only member, or at the customer's request. - Data: Invitations to join a Workspace (invited address) Retention period or criterion: 90 days after they were accepted, revoked or expired, then erased automatically. - Data: Accounting records and invoices Retention period or criterion: 10 years from the end of the financial year, as required by article L. 123-22 of the French Commercial Code. - Data: Support and contact messages Retention period or criterion: 3 years after the last exchange. - Data: Requests to exercise rights Retention period or criterion: Until the end of the third year after the answer. - Data: Administration log and suspensions Retention period or criterion: 3 years after the operation or the end of the suspension. - Data: Refused access attempts to the administration console Retention period or criterion: 90 days. - Data: Public indicators of compromise Retention period or criterion: While CERT-FR publishes them, then kept with a note of their withdrawal. - Data: Database backup copies made by the Publisher (encrypted) Retention period or criterion: 90 days at most after they are made. The database provider also applies its own backup policy. Deleting your account, from Settings › Account, is immediate: it erases the account, the security history, the e-mail delivery log and the Workspaces of which you were the only member, with their data. The audit logs of other Workspaces keep past actions, without your name. 8. Your rights You have the rights of access, rectification, erasure, restriction of processing and portability of your data, and the right to object, on grounds relating to your particular situation, to processing based on legitimate interest. You may also set instructions about what happens to your data after your death. - From the application: edit your profile and preferences (Settings › Profile and Notifications), see and end your sessions (Settings › Security), download a copy of your data as JSON (Settings › Account, and Settings › Workspace for an owner or an administrator), export the analysis as CSV (Reports), delete your account (Settings › Account). These downloads remain available while a new version of the terms awaits your acceptance (Settings › Legal information). - By e-mail to contact@patcharo.com, preferably from your account's address, for any other request, in particular a copy of your data. We answer within one month, which may be extended by two months for a complex request or many requests, in which case we tell you. Proof of identity is requested only in case of reasonable doubt. Requests about a Workspace's data are forwarded to the customer concerned, who decides on them. 9. Complaint to the CNIL If you consider that your rights are not respected, you can lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, 75007 Paris, France, or online at cnil.fr (https://www.cnil.fr/fr/plaintes), or with the supervisory authority of the EU country where you live or work. 10. Automated decisions Patcharo takes no decision producing legal effects concerning you based solely on automated processing and carries out no profiling. The automatic matching between devices and vulnerabilities concerns devices, not people, and its results remain subject to the customer's judgement. 11. Security The measures implemented to protect data (customer isolation, authentication, encrypted communications, minimisation, logging of administration access, backups) and their limits are described in the annex to the data processing agreement (https://patcharo.com/legal/dpa#annex-security). 12. Changes Each version of this policy is dated and remains available. Significant changes are announced to users by e-mail or in the application.