Legal information

1. Data controller

The controller of personal data collected through detektd.com is Paul-Olivier Chazalette, sole trader (micro-enterprise), 81 Boulevard Malesherbes, 75008 Paris, France, company number (SIRET) 130 681 026 00014, contact: contact@detektd.com.

2. Data collected and purposes

• Account: email address and authentication identifier, managed by Clerk, to create and secure the account.
• Billing: name, billing address and payment history, processed by Stripe. detektd never stores card data.
• Scan data: the URL of the tested application and the scan results. These results may reveal data the customer's own scanned site already exposes publicly or by mistake (e.g. a misconfigured key); they are only used to produce that customer's report.
• Test account (Scan Pro, optional): if the customer chooses to have their application's signed-in flows tested, the login and password of a dedicated test account on their own site. They are stored encrypted, used only for that application's active scans, and the customer can erase them at any time from their dashboard.
• Orders: a timestamped record of the request for immediate performance and the waiver of the withdrawal right, collected before each payment.
• Communications: transactional emails (scan report, security alerts) are sent via Resend and include an unsubscribe link.
• Technical data: IP address and connection/usage logs, for security and fraud-prevention purposes.
• Language preference: kept via the dtk-lang cookie and the browser's local storage.

3. Legal bases

• Performance of the contract: account creation, running scans, billing.
• Legitimate interest: service security, fraud and abuse prevention, product improvement.
• Legal obligation: retaining invoices for accounting and tax purposes.

4. Processors and recipients

Data is shared with the following processors, each acting on the publisher's behalf under article 28 GDPR:

• Clerk (authentication): United States
• Stripe (payment): Ireland / United States
• Resend (transactional email delivery): United States
• Vercel Inc. (website hosting): United States
• OVH SAS (application infrastructure and database hosting): France, European Union

Data transfers outside the European Union (Clerk, Stripe, Resend, Vercel) are governed by the European Commission's standard contractual clauses. No data is sold to third parties or used for advertising.

5. Retention periods

• Account data: for the account's lifetime, then 3 years after deletion or last activity.
• Billing data: 10 years, under accounting and tax obligations.
• Scan results: kept while the application remains registered on the account, deleted with the application or the account.
• Test account login: until the customer erases it, or deletes the application or the account.
• Withdrawal waiver record: with billing data, 10 years.
• Technical logs (IP, connection logs): 12 months maximum.

6. Your rights

Under the GDPR, you have a right of access, rectification, erasure, restriction, objection and portability over your data, as well as the right to set directives on what happens to it after your death. To exercise these rights, write to contact@detektd.com. You may also lodge a complaint with the CNIL (cnil.fr, the French data protection authority) if you believe your rights are not respected.

7. Cookies

detektd only uses cookies strictly necessary for the service to work, for which no prior consent is required:

• dtk-lang : remembers the chosen language (French/English).
• Clerk session cookies: necessary for authentication and staying signed in.

detektd uses no advertising, third-party analytics or profiling cookies.

To stop receiving security alerts by email: /unsubscribe.