1. Who this policy covers
STAIPH is operated by Kapriel Talatinian, your contact for the personal-data processing described in this policy. Contact the operator.
This policy covers visitors, people running a security scan, account holders and people contacting STAIPH. It also covers the account information used for retained expert and accompanied client services.
STAIPH handles the information needed to operate the service and manage its customer relationships. Where an organisation submits personal data in its own prompts, responses or traces, its responsibilities and the processing instructions must be defined with STAIPH before submission. Contact us about data protection.
2. What information is processed
- Security scans. Your email, selected provider, model and endpoint, execution settings, test prompts, model responses, findings and the generated report. A scan can be started without an account.
- Accounts and subscriptions. Email, profile and organisation information you provide, authentication records, subscription status, order references and billing information. Card details are handled by the payment provider, rather than entered into a STAIPH form.
- Monitoring, after integration. The prompts, responses, metadata and system identifiers that your application sends through the STAIPH API, together with evaluation results and alerts.
- Contact and support. The name, email, subject, message and optional organisation information you submit, together with the correspondence needed to respond.
- Technical records. Request timestamps, error and delivery status, and technical connection information used for security, abuse prevention and troubleshooting.
- Retained expert services. Where you use these services: identity and professional details, assessment results, annotations, quality records and the information necessary to manage agreed payments.
Do not submit production secrets, unnecessary personal data or sensitive information in a test or contact message. Use a dedicated provider key with appropriate permissions and limits.
3. Provider keys and private report links
A provider API key is encrypted for the duration of a scan. It is removed when execution completes, fails or expires. It is not reused for a new scan without being entered again. The full one-off analysis therefore asks for your key again after payment.
Provider keys are distinct from the STAIPH API keys used to submit monitoring data. Keep the latter on a trusted backend and revoke them if they may have been exposed.
A guest report link contains an access credential. Anyone who obtains a valid link may be able to read the report. Keep it confidential, including in screenshots, analytics tools, shared tickets and public repositories.
4. Why this information is used
- To run the scan, generate and deliver its report, authenticate you and provide the features you request: performance of the service or steps taken at your request before a contract.
- To respond to enquiries and manage the relationship: pre-contractual steps or a legitimate interest in responding and supporting users, depending on the request.
- To detect abuse, secure access and investigate failures: legitimate interests in protecting the service and its users.
- To meet accounting, tax and other applicable record-keeping duties: legal obligations. Optional marketing communications require the applicable permission and can be stopped independently of service emails.
Account confirmations, password recovery, requested reports and essential billing notices are service messages. They do not constitute a newsletter subscription.
5. Who receives data
Contact messages are forwarded to the operator’s Gmail inbox so they can be read and answered. Some pages also load fonts from Google Fonts; the browser sends the technical request information needed to load those resources.
Access is limited to the people and technical providers needed for the relevant operation. The infrastructure uses Lovable Cloud and Supabase for application services, Lovable’s email service for delivery, and Polar for security-product checkout and subscriptions. The model provider or custom endpoint you select receives the scan requests required to run the test.
Your provider’s terms and data-processing policies also apply to its processing. International providers may process data outside the European Economic Area. Do not assume that every provider, email delivery or payment operation remains exclusively within the EU. Contact STAIPH before submitting data with residency requirements, to establish the applicable providers, locations and transfer safeguards.
STAIPH does not sell the personal data you submit. Access required by law or by a competent authority is limited to the applicable legal request.
6. Access periods and retention
| Information | Applicable period or criterion |
|---|---|
| Provider scan key | Execution only, until completion, failure or expiry. |
| Free guest report access | 24 hours after its first opening, within 30 days of the scan. |
| Purchased one-off report access | 12 months under the purchased report’s access period. |
| Account and support | As needed to manage the active account or request, then restricted records only where required for a legal obligation or a dispute. |
| Accounting documents | The applicable statutory period, generally 10 years for accounting records. |
An access deadline is distinct from immediate deletion of every technical record or backup. Monitoring and accompanied projects can have different contractual retention requirements. Ask us to confirm these before sending production data or to request erasure where applicable.
7. Browser storage and tracking
The service uses browser storage for authentication, language preferences and essential interface state. Private links and credentials must not be copied into marketing tools. The security journey excludes the legacy marketing-script loader from its landing, authentication and report screens.
Some retained historical pages have separate audience and advertising integrations, including Google and Meta, with their own consent interface. These should not be confused with the security test. You can manage site storage and permissions in your browser; deleting authentication storage signs you out.
8. Your rights and how to contact us
Subject to the conditions of applicable law, you can request access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw that consent without affecting prior lawful processing.
Use our contact form and select a data-protection request. Explain what you need without including passwords, provider keys or a private report token. We may need proportionate information to verify the identity of the requester.
We respond within one month. Where a request’s complexity or volume requires an extension permitted by law, we inform you within that first month. You can also lodge a complaint with the French supervisory authority, the CNIL, or another competent supervisory authority. Contact the CNIL.
9. Security and updates
The service uses encrypted transport, temporary encrypted provider keys, authenticated owner access and private report-access controls. These measures reduce exposure; they do not remove every risk. Limit what you submit and report suspected unauthorised access through the contact form.
This policy can be updated to reflect changes to the service or legal requirements. The version and publication date appear above. Material changes affecting current users are communicated through the service or by email as appropriate.