Privacy Policy

1. Controller

Aegvale, Anna-von-Fürstenberg-Weg 30, 59494 Soest, Germany. Privacy contact: support@aegvale.com. Data Protection Officer: No Data Protection Officer appointed (Not applicable).

2. What we process

• Account data: name, email, company/organization, hashed password, 2FA status.
• Agent configuration: the endpoints, models and API keys you connect for testing — API keys and request headers are encrypted at rest (AES-256-GCM).
• Scan data: the prompts we send to your agents and the responses they return, plus generated reports and findings.
• Usage & security data: audit logs, sign-in metadata (IP, user-agent), and session records.
• Billing data: processed by our payment provider (Stripe (including Apple Pay, Google Pay and SEPA where supported).); we store subscription/plan status, not full card details.

3. Purposes and legal bases (Art. 6 GDPR)

• Providing the service, running scans, authentication — performance of contract, Art. 6(1)(b).
• Security, audit logging, abuse prevention — legitimate interests, Art. 6(1)(f).
• Billing and tax/records obligations — Art. 6(1)(b) and legal obligation Art. 6(1)(c).
• Email verification and transactional email — Art. 6(1)(b)/(f).
• Optional analytics / marketing — only with your consent, Art. 6(1)(a).

4. Sub-processors and recipients

We share data only with processors needed to run the service, under Art. 28 data-processing agreements:

• Hosting/infrastructure: Vercel (frontend hosting), Render (application hosting), and PostgreSQL (managed database on Render).
• Payments: Stripe (including Apple Pay, Google Pay and SEPA where supported).
• Email delivery: Resend
• AI/LLM providers used for optional model-graded evaluation: Model providers configured by the customer for their own agents: OpenAI, Anthropic, Google (Gemini), Azure OpenAI, Mistral, Ollama, or custom OpenAI-compatible endpoints. When the optional AI judge is enabled, agent outputs are evaluated by an OpenAI-compatible provider (OpenAI by default).
• Analytics: None
• Other: Vercel (frontend hosting), Render (backend hosting and managed PostgreSQL database), Stripe (payments), Resend (transactional email), Sentry (error monitoring, when enabled), and the AI/LLM provider used for optional model-graded evaluation (OpenAI by default).

We do not sell personal data. Where a recipient is outside the EU/EEA, transfers are safeguarded by adequacy decisions or EU Standard Contractual Clauses.

5. International transfers

Depending on the providers above, data may be processed outside the EU/EEA. In such cases we rely on Art. 46 GDPR safeguards (Standard Contractual Clauses) or an adequacy decision.

6. Retention

Scan data is retained for your organization’s configured retention period and then purged automatically. Otherwise: Scan data, reports, findings, projects and agents are retained until you delete them (individually, in bulk, or by deleting the parent project or agent), which removes them and their associated results. Account and organisation data are retained for the life of your account and are deleted upon account closure or on request, subject to any mandatory legal retention obligations. Aegvale does not apply a fixed automatic deletion period.. Account data is kept for the life of the account; billing records are kept as required by tax law.

7. Your rights

You have the right to access, rectification, erasure, restriction, data portability, and objection (Art. 15–21 GDPR), and to withdraw consent at any time. To exercise these, contact support@aegvale.com. You may also lodge a complaint with a supervisory authority (The competent supervisory authority under applicable German law.).

8. Cookies & local storage

We use strictly necessary local/session storage for authentication. Non-essential cookies (analytics/marketing) are only set with your consent — see our Cookie Policy and the consent banner.

9. Changes

We may update this policy; the effective date above reflects the latest version.