Privacy Notice
What Evidalux collects, why, how long it stays, and who else sees it.
Last updated: 21 September 2026
Who is responsible
The controller is Fidordia Yazılım Teknolojileri Anonim Şirketi, Kızılırmak Mah. Dumlupınar Blv. No: 3, C-1, İç Kapı No: 160, 06510 Çankaya / Ankara, Türkiye (MERSİS 0387146001500001). For anything in this notice, including requests about your data, write to support@evidalux.com. We have not appointed a Data Protection Officer; that address reaches the people who handle these requests.
What we collect
Your account
- Email address, name, and the language and theme you choose.
- Your password, stored only as an Argon2 hash. We cannot read it.
- Organisation details you enter: organisation name, and optionally a logo, a custom domain and report headings.
- API keys, stored as hashes with a short visible prefix so you can tell them apart.
- Times you last signed in and when you verified your email.
Activity records
We keep an audit log of significant actions in an account — who did what, and when. Those entries include the IP address and browser user-agent of the request, and for some actions the email address of the affected user. We use them to investigate security incidents and account disputes.
What you ask us to scan
- The URLs and scan settings you submit, and the results: findings, scores, evidence snippets and uptime history.
- If you configure a scan behind a login, the credentials for that site. They are encrypted before storage. Session cookies obtained during such a scan are held in our cache for 30 minutes and then expire.
- Screenshots taken during a scan are processed in memory and are not written to disk or stored.
Information about AI usage
We record which model ran, how many tokens it used, how long it took and whether it succeeded. We do not store the prompts or the model's responses.
Personal data found on the websites we scan
This section matters if you are not our customer. Some checks record what they found on a scanned page as evidence — for example the contact or data-protection email address published in a site's imprint or privacy page, an organisation name from structured data, or a short HTML fragment (up to 200 characters) showing why an accessibility rule failed. Those fragments can contain personal data about people who never signed up with us.
- Why: the finding is the product. "This site publishes a DPO contact" is only verifiable if the check can point at what it saw.
- Legal basis: our legitimate interest, and our customer's, in auditing a website they are responsible for.
- How long: the personal parts of that evidence are masked after 90 days. The finding and its score stay; the personal data does not.
- Your rights: if you believe your personal data is held in our scan evidence, write to support@evidalux.com and we will locate and remove it.
We do not build profiles of the people we encounter this way, we do not enrich the data, and we do not sell or share it.
Why we process your data
- To provide the service — performance of our contract with you.
- To keep it secure and abuse-free, including the audit log and sign-up rate limits — our legitimate interest.
- To email you about your account, scans you scheduled and incidents you asked to be alerted about — contract, or legitimate interest.
- To meet legal obligations, such as accounting duties.
Who else processes it
| Who | What they receive | Where |
|---|---|---|
| LeaseWeb Netherlands B.V. | Hosting. All application data sits on servers they operate. | Netherlands (EU) |
| Google (Gmail / Workspace SMTP) | Outgoing email: the recipient address and the message, including verification and password-reset links. | EU / US |
| Sectigo (crt.sh certificate transparency search) | The domain name being scanned, when a scan looks up publicly logged certificates for it. | Public CT logs |
| Let's Encrypt (ISRG) | Our domain and administrative contact, for TLS certificates. | US |
| Paddle.com Market Ltd | Payment data, if and when you buy a paid plan. Paddle is the Merchant of Record and the controller for the payment itself. We never receive card details. | UK / EU |
That is the whole list. There is no analytics provider, no advertising network, no tracking pixel, no session-recording tool and no error-reporting service in Evidalux.
Things we deliberately do not do
- Our AI runs on our own servers. The language and vision models that read page text and screenshots run inside our own infrastructure. That content is not sent to OpenAI, Anthropic, Google or any other AI provider, and it is never used to train a model.
- We do not sell or share personal data, and we do not disclose it for cross-context behavioural advertising.
- We do not handle card data.
How long we keep it
| Data | Kept for |
|---|---|
| Account data | While the account is open |
| Audit log, including IP and user-agent | 12 months |
| Scan findings | 24 months |
| Personal data inside scan evidence | 90 days, then masked |
| Uptime check history | 90 days |
| Incidents and post-mortems | 24 months |
| AI usage records (no content) | 12 months |
| Used or expired email and password-reset tokens | 30 days |
| A closed account | Deleted within 30 days |
We keep no backups of the production database, so there is no separate backup copy that outlives these periods.
Where your data is and who can reach it
Everything is stored in the Netherlands. Our staff work from Türkiye and can access production data to operate and support the service. Türkiye is not covered by an EU adequacy decision, so that access is an international transfer; we rely on the European Commission's Standard Contractual Clauses for it. Ask us at support@evidalux.com if you want the details.
Your rights
If the GDPR or UK GDPR applies to you, you can ask for access to your data, correction, deletion, a portable copy, restriction of processing, or object to processing based on legitimate interest. California residents have comparable rights to know, delete and correct, and to opt out of sale or sharing — which we do not do in any case.
How to exercise them: email support@evidalux.com. There is no self-service button for this in the product yet, and we would rather say so than pretend otherwise: a person handles your request, and we answer within 30 days. We will ask enough to confirm you are who you say you are, and nothing more.
You can also complain to a supervisory authority — in the EU, the authority where you live or work.
Security
Passwords are hashed with Argon2. Credentials you give us for scanning your own site are encrypted at rest. Traffic to the service uses TLS. Internal services — the database, the cache and the AI models — are not reachable from the internet. We do not claim to be certified against any security standard; we have not been audited against one.
Children
Evidalux is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16.
Changes
If we change this notice materially we will email account holders before the change takes effect. The date at the top always reflects the current version.