Privacy Notice & Data Protection Policy
This notice transparently describes how Danesh Habibi processes, secures, and retains your personal information when you visit this website, communicate through our channels, or purchase licenses for R3CON and Crypto Scouter. We adhere strictly to European privacy-by-design standards.
1. Data Controller & Contact Information
The Data Controller responsible for the processing of your personal data under Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR) is:
Danesh Habibi
Software Engineer & Platform Operator
Location: Italy, European Union
Direct Privacy Inquiries: [email protected]
We operate under a strict privacy-by-design architecture: we never sell, broker, or monetize your personal data, nor do we employ automated profiling or behavioral ad targeting.
2. Personal Data We Collect & Legal Bases
We only process personal data that is strictly necessary to fulfill contractual obligations, comply with European statutory requirements, or protect system integrity.
- Collected: Display name, email address, avatar URL, encrypted OAuth provider tokens (GitHub/Google), scrypt password hash.
- Purpose: Session validation, authentication, user dashboard, licensing entitlement.
- Legal Basis: GDPR Art. 6(1)(b) (Performance of contract).
- Collected: Billing country, EU VAT number (if B2B), tax calculation metadata, Stripe Customer ID, withdrawal waiver consent timestamp.
- Purpose: Payment settlement, dynamic VAT calculation, statutory tax invoicing.
- Legal Basis: GDPR Art. 6(1)(b) & Art. 6(1)(c) (Legal compliance).
- Collected: Full name, email address, message body, submission IP address, and timestamp.
- Purpose: Responding to client inquiries, providing technical support, anti-spam verification.
- Legal Basis: GDPR Art. 6(1)(b) & Art. 6(1)(f) (Legitimate interest).
- Collected: Active session IP, user-agent headers, rate-limiting counters, privacy-first Umami metrics, crash stack traces (GlitchTip).
- Purpose: Brute-force defense, WAF mitigation, crash resolution.
- Legal Basis: GDPR Art. 6(1)(f) & Art. 6(1)(a) (Consent for cookies).
3. Authorized Sub-processors & Data Transfers
To provide resilient services, we rely on vetted infrastructure sub-processors adhering to GDPR Article 28 data processing agreements and Standard Contractual Clauses (SCCs) where international transfers occur:
| Sub-processor | Purpose | Location | Safeguard |
|---|---|---|---|
| Cloudflare, Inc. | DNS, edge CDN, WAF rules, DDoS mitigation | United States / Global | EU-US Data Privacy Framework / SCCs |
| Hetzner Online GmbH | VPS server hosting & MongoDB database | Germany (European Union) | GDPR Article 28 DPA (Within EEA) |
| Stripe, Inc. / Stripe Europe | Payment processing, card/SEPA, Stripe Tax | Ireland / USA | PCI-DSS Level 1, EU-US DPF / SCCs |
| Brevo (Sendinblue SAS) | Transactional email delivery (auth & receipts) | France (European Union) | GDPR DPA (Within EEA) |
| GlitchTip / Sentry | Diagnostic application error tracing | Self-hosted / Cloud | Data minimization (anonymized stack traces) |
| Umami Analytics | Privacy-first visitor telemetry (cookieless mode) | Self-hosted (EEA) | No cross-site tracking; consent banner gated |
4. Data Retention Periods
We retain personal data only for as long as necessary to provide active platform services or satisfy statutory legal requirements:
Rolling 30-day expiration; cleared on manual sign-out.
Maintained until you initiate account erasure in your user portal.
10 years per statutory European and Italian commercial tax law.
Automatically rotated and purged within 30 days.
5. Your Rights Under GDPR (Articles 15–22)
Executed directly through real in-platform controls, not generic pledges.
Under European data protection law, you possess enforceable rights over your personal data:
You can instantly generate and download a machine-readable JSON archive containing all personal data, linked accounts, and active sessions.
Open Portability ToolYou can trigger immediate, irreversible deletion of your user account, credentials, and associated telemetry directly from the portal.
Account Erasure ToolRight to Rectification (Art. 16): You may correct or update your profile information anytime in the portal or by emailing us.
Right to Restriction & Objection (Art. 18 & 21): You may object to legitimate interest processing or request restriction of data handling.
Right to Lodge a Complaint (Art. 77): If you believe your data has been handled contrary to GDPR, you have the right to lodge a formal complaint with the competent supervisory authority:
6. Cookies, Analytics & Cross-Policy Alignment
Detailed information regarding all active cookies, local storage keys, telemetry flags, and consent withdrawal controls is maintained in our dedicated Cookie Policy & Preferences.
Commercial licence entitlements, liability boundaries, and permitted platform use are governed by our Terms of Service & EULA, and digital withdrawal waiver rules are specified in our Refund Policy.