Last updated: [DATE]
This is a starting template, not a finished legal document. Confirm it against the data protection law that actually applies to your users, and have it reviewed by a lawyer before launch.
Account info you provide (email, display name); vulnerability tracking data you create (watchlists, collections, research notes) — this is yours, we don't read it for any purpose beyond running the feature; billing metadata (subscription status, plan) — Razorpay processes and stores actual payment details, we never see or store your card/bank information; API usage logs (timestamps, endpoints called, status codes) for rate limiting, billing, and abuse prevention.
We don't sell your data. We don't serve ads or share your data with advertisers. We don't read the contents of your research notes or watchlists for any purpose beyond displaying them back to you.
We use a session cookie (via Supabase Auth) to keep you signed in, and a local preference for light/dark theme stored in your browser. No third-party tracking or advertising cookies.
Supabase (database, authentication, hosting your account data) · Razorpay (payment processing) · NVD, CISA, FIRST.org, and vendor security feeds (the public vulnerability data itself — see each CVE's Sources panel for provenance). Each is bound by its own privacy terms for the data it processes on our behalf.
Account and tracking data (watchlists, collections, research) persists until you delete it or close your account. API usage logs are retained for [N days — see PRODUCTION.md's cleanup cron] for billing and abuse-prevention purposes, then pruned automatically.
You can view and delete your own data from /profile, /watchlists, /collections, and /research at any time. To fully delete your account and associated data, contact [SUPPORT EMAIL] — deletion cascades through watchlists, collections, research projects, and API keys per the database schema (`on delete cascade` throughout).
The Service isn't directed at children under 16, and we don't knowingly collect their data.
We'll post updates here and, for material changes, notify account holders by email.
Questions about this policy or your data: [SUPPORT EMAIL].