Privacy Policy
Last updated: 2026-09-13
1. What we collect
- Account information: name, email, organization name, license number (optional)
- Search queries and results: stored for the duration of your subscription
- Evidence you collect: stored encrypted in R2 with SHA-256 hashing
- Audit logs: every search, view, and export — immutable, retained 7 years
- Usage data: searches per month, seats used, plan tier
2. What we do NOT collect
- We do not sell your data to third parties
- We do not use your search data to train AI models
- We do not track you across other websites
- We do not access your email or contacts
3. How we use your data
We use your data solely to provide the TracePoint service: running searches, storing evidence, generating reports, and maintaining audit trails. We process payments through Gumroad, which acts as the merchant of record.
4. Data storage
Search results and metadata are stored in a Neon Postgres database. Evidence files are stored in Cloudflare R2 object storage with SHA-256 hashing. All data is encrypted in transit (TLS 1.3) and at rest.
5. Your rights
- Export all your data at any time (JSON, CSV, PDF)
- Delete your account and all associated data
- Request a copy of your audit log
- GDPR/CCPA data subject requests: privacy@secdh.com
6. Data retention
Active subscription: all data retained. Post-cancellation: 90 days, then permanent deletion. Audit logs: 7 years for legal compliance. Subpoena holds may extend retention.
7. Third-party services
- Gumroad — payment processing (merchant of record)
- Neon — Postgres database hosting
- Cloudflare — R2 storage and Workers AI
- Have I Been Pwned — breach data (queried in real-time, not stored)
8. Contact
Privacy questions: privacy@secdh.com. Data Protection Officer: dpo@secdh.com