Privacy notice

• Account data: name, work email, job title, organisation, role, and the times you sign in.
• Billing data: organisation billing contact, purchase order or invoice reference, and the payment records Stripe returns to us. We never see or store your card number.
• Scan data: database server configuration and rule outcomes. This may include login and role names where a rule is about privileged access — those can be personal data. It never includes the contents of your databases.
• Support and feedback: what you write to us, and the page you were on.
• Technical logs: request time, IP address and browser type, kept for security and troubleshooting.

To provide and secure the service you bought, to bill you, to support you, and to meet legal and tax obligations. Our lawful bases are performance of a contract, legitimate interests in securing and improving the service, and legal obligation. We do not sell personal data, we do not use it for advertising, and we do not use your data to train models.

Supabase (database, authentication), Microsoft Azure (application hosting), Cloudflare (delivery and TLS), Stripe (payments) and Microsoft Azure Trusted Signing (code signing). All are in the United States; data is stored in a United States region.

Account and scan data for the life of your engagement plus 12 months. Billing records for as long as United States tax law requires. Technical logs for 90 days.

You can ask for a copy of your personal data, correction, deletion, or restriction of processing, and you can object to processing based on legitimate interests. Write to rhoylle@rhoylle.com; we reply within 30 days. California residents have the rights described in the CCPA/CPRA, including the right not to be discriminated against for exercising them; we do not sell or share personal information as those terms are defined there.

We set only the cookies needed to keep you signed in and to keep the site secure. We do not run advertising or third-party analytics trackers on the public site.

The service is for organisations. It is not directed at anyone under 18.