Privacy Policy

Controller: ClawNet (trading as Sentrytex), established in Germany
Contact: [email protected]
Lead Supervisory Authority: Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI / Federal Commissioner for Data Protection and Freedom of Information), Husarenstraße 30, 53117 Bonn, Germany — bfdi.bund.de

1. Overview

This Privacy Policy explains how ClawNet, trading as Sentrytex (“we”, “us”, “our”), collects, uses, stores, and shares personal data when you use the Sentrytex vulnerability alerting service (“Service”). It also explains your rights under applicable privacy laws — principally the EU General Data Protection Regulation (Regulation 2016/679, “GDPR”) as implemented in Germany by the Bundesdatenschutzgesetz (BDSG), and equivalent laws including CCPA/CPRA, PIPEDA, the Australian Privacy Act, and Brazil's LGPD.

Sentrytex is a B2B service used by businesses and professional teams. We process a limited set of personal data necessary to operate subscriber accounts and deliver alerts.

If you have questions about this policy or wish to exercise your privacy rights, contact us at [email protected].

2. What Data We Collect

2.1 Account Data

When you register for Sentrytex, we collect:

• Email address — used as your account identifier, for login, and for alert delivery.
• Password — stored as a salted cryptographic hash. We never store your password in plain text. Password hashing is managed by Supabase (our database and authentication provider).

2.2 Billing Data

When you subscribe to a paid plan:

• Billing email address — used for payment receipts and subscription communications.
• Payment method reference — we store only the last four digits of your card number and the card type (e.g., Visa ending 4242), as provided by Stripe. Full card details are collected and held exclusively by Stripe under their own PCI DSS compliance programme. We do not receive, process, or store full card numbers.

2.3 Product Data

To personalise your alert feed, we collect:

• Selected technology stack— the tools, frameworks, and software packages you nominate for monitoring (e.g., “Next.js”, “PostgreSQL”, “Python”).
• Alert preferences — severity thresholds, notification frequency, and channel preferences you configure.

This data is used solely to filter and deliver relevant vulnerability alerts to you.

2.4 Usage and Authentication Data

We collect the following operational data to maintain service security and integrity:

• Authentication events — records of login, logout, and failed login attempts, including timestamp, IP address, and user agent string.
• IP address — logged at authentication events and service interactions.
• User agent string — browser or client type, recorded alongside authentication events.
• Error diagnostics — when something goes wrong in the Service, an error report is sent to our error-monitoring provider, Sentry (Functional Software, Inc., United States). The report contains the exception message and stack trace, the page or endpoint involved, your browser and user agent, your IP address and, if you are signed in, your Sentrytex user id — an opaque identifier — so we can tell which account was affected. We do not send your email address or name to Sentry.
• Session replay (only if you opt in) — Sentry also offers a session replay feature that records a playback of your interactions with the page so we can reproduce bugs. Because this is not strictly necessary to run the Service, it is off by default and runs only on your consent(Art. 6(1)(a) GDPR), given through the “Session replay” choice in our cookie banner; the replay code is not loaded until you accept. All text and form inputs are masked and all media is blocked. You can withdraw at any time, which stops the recording immediately.
• Rate-limiting and traffic counters — we use Upstash (Upstash, Inc., United States) for two things, and neither receives your raw IP address. Your IP is hashed in memory under a salt that changes every day (HMAC-SHA256) and only the hash leaves our server. (a) Rate limiting— to stop credential stuffing and signup abuse, we count requests against that hashed identifier. The counter exists only for the length of the limit window (15 minutes for authentication endpoints, 1 hour for the waitlist) and then expires. The rate limiter's optional usage analytics, which would log the raw identifier and coarse location for 90 days, is switched off. (b) Traffic counting — our cookieless visitor counter keeps a per-day pageview total and a HyperLogLog of the same salted per-day hashes, so we can estimate unique visitors. Because the salt rotates daily, hashes cannot be linked across days, and a HyperLogLog cannot be reversed to recover an IP address.

Retention: Authentication and usage logs are retained for 90 days, after which they are deleted or anonymised. Sentry error events and any opt-in session replays are retained by Sentry for up to 90 days(30 days on Sentry's free Developer plan), a period Sentry sets and we cannot extend. Upstash rate-limit counters expire with their window (15 minutes or 1 hour); the Upstash traffic counters expire after 35 days.

2.5 Cookies and Local Storage

Authentication cookie: We use a session cookie (prefixed sb-) set by Supabase to maintain your logged-in session. This cookie is essential for the Service to function. It is a session cookie that expires on browser close or session timeout, depending on your settings.

Local storage:We store your theme preference (dark or light mode) in your browser's localStorage. This data is stored locally on your device and is never transmitted to our servers. It is not a cookie.

Analytics cookies (opt-in only):If you accept the “Analytics” category in our cookie banner, we set cookies for PostHog (product analytics, hosted in the EU) and Google Analytics 4 (Google LLC — _ga, _ga_<container>, _gid). Google Analytics is configured with IP anonymisation and no advertising features; the data it collects is processed in the United States under EU Standard Contractual Clauses. Neither loads until you opt in, and you can withdraw consent at any time.

We do not use advertising cookies, third-party tracking cookies, or behavioural advertising. For full details, see our Cookies Policy.

2.6 Data We Do Not Collect

• We do not collect your name unless you choose to provide it. (If you enter a name or billing address at checkout, it is collected and held by our merchant of record, Lemon Squeezy — it is not stored in Sentrytex.)
• We do not collect the contents of your systems or infrastructure.
• We do not perform active scanning of your environment.
• We do not collect sensitive personal data (health, biometric, financial, or similar categories).
• We do not knowingly collect data from users under 16 years of age.

3. Why We Process Your Data and Our Lawful Bases

3.1 EU GDPR Lawful Bases (BDSG)

We have assessed that our legitimate interest in maintaining service security and integrity is not overridden by your interests or fundamental rights, given: (a) the limited nature of the data (IP address, user agent); (b) the security purpose; and (c) the 90-day retention limit.

The same assessment applies to error monitoring, rate limiting and internal signup notifications: error reports are generated only when something actually breaks and are limited to what is needed to fix it (with replay text and media masked), rate-limit counters are short-lived and exist to protect your account from others, the visitor counter never stores a raw IP address, and the signup notification is engineered so that nothing identifying leaves our systems. You can object to any of this processing at any time under GDPR Art. 21 — see Section 9.

3.2 Brazil LGPD Lawful Bases

For users in Brazil, our lawful bases under the Lei Geral de Proteção de Dados (LGPD — Lei nº 13.709/2018) are:

• Execution of a contract (LGPD Art. 7(V)) — for account creation, alert delivery, and billing.
• Legitimate interest (LGPD Art. 7(IX)) — for authentication logging and service security.
• Consent (LGPD Art. 7(I)) — for any marketing communications, where required.

4. How We Use Your Data

We use personal data only for the following purposes:

1. Providing the Service — delivering vulnerability alerts tailored to your selected technology stack.
2. Account management — authenticating you, managing your subscription, and processing payments.
3. Service communications — sending invoices, security notices, and material policy updates.
4. Security and integrity — detecting and preventing unauthorised access, abuse, and fraud.
5. Legal compliance — complying with our legal obligations (including financial record-keeping).

We do not use your personal data for advertising, profiling for marketing purposes, or behavioural analytics. We do not sell your personal data.

5. How We Share Your Data

We do not sell or share your personal data with third parties for their own marketing purposes.

California disclosure (CCPA/CPRA).Sentrytex does not sell or share personal information as defined under California Civil Code §1798.140(ad)/(ah), and therefore does not provide a “Do Not Sell or Share My Personal Information” link. California consumers retain all other rights under the CCPA/CPRA, including the rights to know, access, delete, correct, and limit; exercise them via the contact addresses in Section 11.

We share your data with the following categories of third parties only as necessary to provide the Service:

5.1 Sub-Processors (Service Providers)

We use the following sub-processors to operate the Service. Each is contractually required to process personal data only on our instructions and to maintain appropriate security measures.

Note on our cookie banner. The consent banner is rendered by Klaro, an open-source JavaScript library we self-host. It runs entirely in your browser and is not a sub-processor: no consent record, identifier, or other data is transmitted to Klaro's authors or any third party.

For full details, including transfer mechanisms, see our Sub-processors page and Section 6 of this policy.

Stripe's independent controller role:Stripe processes certain data (fraud detection, PCI compliance) as an independent data controller under Stripe's own privacy policy and terms. We do not control how Stripe uses data for these purposes.

Lemon Squeezy is our merchant of record. For subscriptions sold through Lemon Squeezy, Lemon Squeezy (legal entity: Sold through Link, LLC, formerly Lemon Squeezy LLC) is the seller of record: it takes the payment, issues the invoice, and handles sales tax and refunds. It acts as our processor for the billing data we send it, and as an independent data controller for its own tax, fraud-prevention and regulatory obligations, under its own privacy notice and terms. We never receive or store your full card number.

Slack (customer-configured alert delivery). If your organisation configures a Slack webhook for alert delivery, alert data (CVE identifier, vendor list, advisory description, source URLs, severity) is transmitted to your own Slack workspace via the incoming-webhook URL you supply. Slack Technologies, Inc. is your processor for that destination, not ours: Sentrytex acts solely as a dispatcher to an endpoint you provide, and is not a controller of the data once delivered. Your organisation is responsible for the lawful basis, retention and access controls that apply inside its Slack workspace. This is set out in section 2.4 of our DPA.

5.2 Legal and Regulatory Disclosure

We may disclose personal data if required to do so by law, regulation, court order, or lawful request from public authorities. Where permitted, we will notify you of such a request before complying.

5.3 Business Transfer

In the event of a merger, acquisition, or sale of all or substantially all of our assets, personal data may be transferred as part of that transaction. We will provide notice before your personal data becomes subject to a different privacy policy.

6. International Transfers

Sentrytex is operated by a German-established entity within the European Economic Area (EEA). Our sub-processors are based primarily in the United States. This means your personal data may be transferred outside the EEA.

We ensure that all such transfers comply with applicable data protection law through the following safeguards:

6.1 Transfer Mechanisms

When we transfer personal data outside the EEA, we rely on:

1. EU-US Data Privacy Framework (DPF) — primary basis for transfers to those US sub-processors that are themselves DPF-certified: Stripe, Cloudflare, Railway, Resend, Google, Sentry (Functional Software, Inc.), Upstash and Discord. The DPF is an adequacy mechanism adopted by the European Commission in July 2023 (Implementing Decision (EU) 2023/1795).
2. EU Standard Contractual Clauses (EU SCCs) — Commission Implementing Decision 2021/914, Module 2 (Controller to Processor), maintained as a fallback in our agreements with each US-based sub-processor in the event the DPF adequacy decision is invalidated, and as the sole transfer mechanism for US sub-processors that are not DPF-certified.

SCCs and DPF certification serve as complementary transfer mechanisms. We maintain SCC fallback arrangements with all US sub-processors in the event the DPF is invalidated.

Sub-processors that are not DPF-certified. Two of our sub-processors do not publish a DPF certification, so transfers to them rely on the EU SCCs (plus the UK Addendum) alone: Supabase Pte. Ltd and Lemon Squeezy (Sold through Link, LLC). We verify each sub-processor's transfer basis individually rather than assuming DPF coverage, and we re-check it when the list changes.

6.2 Per-Processor Transfer Details

Copies of applicable SCCs and sub-processor DPAs are available on request at [email protected].

7. Data Retention

Billing records are retained for 10 years after the relevant transaction. Our own statutory retention as a German-established controller is 10 years under Handelsgesetzbuch (HGB) §257 and Abgabenordnung (AO) §147; this is also the longest applicable obligation across the jurisdictions of our customer base — France (Code de commerce L123-22), Italy (Codice Civile art. 2220), UK HMRC (6 years + current), US IRS (7 years), Canada CRA (6 years), and Australia ATO (5 years). The records retained are the minimum necessary to defend a tax audit on either side: invoice ID, customer ID, amount, currency, country, and date — held in our billing_records table without a direct link to the deleted user identity (only a one-way hash). This retention obligation applies even after account deletion, per GDPR Article 17(3)(b).

8. Account Deletion and Data Erasure

You can delete your Sentrytex account at any time from the Settings page in your account dashboard.

On account deletion:

1. Supabase: Your email address, password hash, stack preferences, and alert preferences are hard-deleted from our primary database within 30 days.
2. Resend: Your email address is removed from our Resend mailing lists within 30 days.
3. Stripe: Your Stripe customer record (billing email, payment method token) is deleted within 30 days. Note: Stripe retains transaction records for its own legal compliance purposes under Stripe's privacy policy.
4. Lemon Squeezy: Where your subscription was sold through Lemon Squeezy, your Lemon Squeezy customer record is deleted within 30 days. Note: as merchant of record, Lemon Squeezy retains transaction records for its own tax and legal compliance purposes under its own policy.
5. Sentry: We remove your user id from Sentry's user context on deletion (we never send your email address there). Any error events already captured age out of Sentry within its retention window (up to 90 days) and are not re-created; we can ask Sentry to purge events referencing your account sooner on request.
6. Upstash: No action is needed — the rate-limit and traffic counters contain no account identifier and no raw IP address, only salted per-day hashes. Rate-limit counters expire with their window; traffic counters expire within 35 days.
7. Discord: No action is needed — the internal signup notification contains only a one-way hash, plan, signup method and timestamp, with no data that identifies you.
8. Authentication logs: Your authentication records are anonymised (IP address and user agent are removed; timestamps and event types are retained in anonymised aggregate form for security analytics).
9. Billing records: Retained for 10 years as described in Section 7 (legal obligation under tax/accounting law in at least one jurisdiction of our customer base).
10. Backups: Database backups containing deleted personal data are purged within 30 days, in line with our backup rotation schedule.

We will confirm completion of deletion within 30 days of your request. If deletion of specific records is technically constrained by legal retention obligations, we will explain what is retained and why.

9. Your Rights

9.1 EU GDPR Rights (BDSG)

If you are located in the EEA, you have the following rights:

• Right of access (Art. 15) — request a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17) — request deletion of your personal data (“right to be forgotten”), subject to legal retention obligations.
• Right to restriction (Art. 18) — request that we limit processing of your data in certain circumstances.
• Right to data portability (Art. 20) — receive your personal data in a structured, commonly-used, machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interests.
• Right to withdraw consent — where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Right to lodge a complaint — you may complain to your local supervisory authority. Our lead supervisory authority is the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI), Husarenstraße 30, 53117 Bonn, Germany (bfdi.bund.de); EU users in other member states may also complain to their national DPA.

To exercise any of these rights, email [email protected]. We will respond within 30 days. There is no fee for exercising your rights.

9.2 California — CCPA/CPRA Rights

California residents have the following rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

• Right to know — request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to delete — request deletion of your personal information, subject to legal exceptions.
• Right to correct — request correction of inaccurate personal information.
• Right to opt out of sale or sharing — we do not sell or share personal information as defined under CCPA (including for cross-context behavioural advertising). No opt-out mechanism is required, but you may contact us to confirm.

Response timeline: We will respond to CCPA rights requests within 45 days, extendable by an additional 45 days (90 days total) where we notify you of the extension and the reason.

To exercise your rights, contact: [email protected]

Note: Sentrytex is a B2B service. CCPA rights are held by individual California consumers. At our current scale, we may not meet the revenue or volume thresholds that trigger mandatory CCPA compliance, but we honour these rights regardless.

9.3 Australian Users — Privacy Act 1988 (APPs 12 and 13)

Under the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles:

• APP 12 — Access: You may request access to personal information we hold about you. We will respond within 30 days. We may charge a reasonable fee for access requests that involve significant retrieval costs.
• APP 13 — Correction: You may request correction of personal information that is inaccurate, out-of-date, incomplete, irrelevant, or misleading. We will correct the information within a reasonable period or, if we refuse, provide written reasons.

To exercise these rights: [email protected]

If you are not satisfied with our response to a complaint or request, you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

9.4 Brazilian Users — LGPD Rights (Art. 18)

Under the Lei Geral de Proteção de Dados (LGPD), Brazilian data subjects have the right to:

• Confirm whether we process your personal data.
• Access your personal data.
• Correct incomplete, inaccurate, or out-of-date data.
• Anonymise, block, or delete unnecessary or excessive data.
• Request portability of your data.
• Obtain information about entities with which we share your data.
• Revoke your consent at any time (where processing is consent-based).
• Lodge a complaint with the ANPD (Autoridade Nacional de Proteção de Dados).

To exercise any LGPD right: [email protected]

9.5 Canadian Users — PIPEDA and Quebec Law 25

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to access your personal information and to challenge its accuracy.

Quebec residents:Sentrytex complies with Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25). Quebec residents have additional rights, including data portability (as of September 2024). We have conducted Privacy Impact Assessments (PIAs) for the transfer of personal information outside Quebec (to our EU and US-based sub-processors). You may request a summary of our PIA by contacting [email protected].

In the event of a privacy breach posing a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada (OPC) and affected individuals as required.

9.6 Japanese Users — APPI

Under Japan's Act on Protection of Personal Information (APPI), as amended in 2022:

Before transferring your personal information to overseas recipients, we will ensure that appropriate safeguards are in place. Our overseas sub-processors maintain data protection standards consistent with APPI requirements. To exercise your rights under APPI, or to request information about our overseas transfer safeguards, contact: [email protected].

10. International Transfers — Additional Information for Specific Jurisdictions

10.1 Australian Users — APP 1.4(f)

We may disclose personal information to overseas recipients in the following countries:

• Germany (European Union) — where Sentrytex (ClawNet) is established.
• United States — where our sub-processors Supabase, Resend, Stripe, Lemon Squeezy (Sold through Link, LLC), Railway, Sentry (Functional Software, Inc.), Upstash, Discord, and Google (Google Analytics, opt-in only) are headquartered and process data.
• Global edge locations — Cloudflare operates a global edge network; data may be cached at edge nodes worldwide.

Before disclosing personal information to overseas recipients, we take reasonable contractual steps to require them to handle that information consistently with the Australian Privacy Principles. Under APP 8, if an overseas recipient handles personal information in breach of the APPs, we may be held accountable. We accept that accountability.

10.2 Security and Vulnerability Data Disclaimer

Sentrytex aggregates publicly available vulnerability intelligence from sources including CISA's Known Exploited Vulnerabilities catalogue, GitHub Security Advisories, and vendor security RSS feeds. This information constitutes security intelligence, not personal data.

Sentrytex does not confirm or imply that any user's systems have been breached based on alert delivery. Alert receipt does not trigger GDPR Article 33 or equivalent breach notification obligations — those obligations arise only upon confirmed compromise of personal data. A Sentrytex alert notifies you of a disclosed vulnerability; it does not mean your systems have been exploited.

11. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or destruction. These include:

• Encrypted communications (TLS for all data in transit).
• Encrypted database storage at rest (Supabase on AWS with AES-256 encryption).
• Authentication logging and anomaly detection.
• Access controls and role-based permissions.
• Regular review of sub-processor security standards.

No system is completely secure. If you believe your account has been compromised, contact [email protected] immediately.

12. Data Breach Notification

In the event of a personal data breach, we will:

• EU GDPR (BDSG): Notify the relevant supervisory authority (BfDI for Germany; relevant national DPA for other EU member states) within 72 hours of becoming aware of a breach likely to result in risk to individuals' rights and freedoms (GDPR Art. 33). We will notify affected individuals where the breach is likely to result in high risk (GDPR Art. 34).
• Australia (NDB scheme): Complete an assessment within 30 days of becoming aware of grounds to suspect a notifiable data breach. If the breach is assessed as likely to cause serious harm, we will notify the OAIC and affected individuals as soon as practicable.
• Brazil (LGPD): Notify the ANPD and affected individuals promptly (within 72 hours where serious risk is present).
• Canada (PIPEDA): Notify the OPC and affected individuals “as soon as feasible” in the event of a breach posing a real risk of significant harm.
• Japan (APPI): Notify the PPC and affected individuals without delay in the event of a qualifying breach.

We maintain an internal breach register in compliance with GDPR Art. 33(5).

13. Children

The Service is designed for professional and business use. We do not knowingly collect personal data from:

• Children under 16 years of age (EU/UK GDPR threshold).
• Minors under 18 years of age (applicable in some jurisdictions).

If we become aware that we have inadvertently collected personal data from a child below the applicable age threshold, we will delete it promptly. If you believe a child has registered an account, contact [email protected].

14. EU and UK Representatives

Sentrytex is established in Germany (European Union). Under GDPR Article 27, an EU Representative is not requiredfor controllers established within the Union — the controller itself is directly accountable to all EU supervisory authorities through the “one-stop-shop” mechanism, with the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) serving as our lead supervisory authority.

For UK users (post-Brexit, UK GDPR), we are in the process of appointing a UK Representative as required by UK GDPR Article 27 for EEA controllers who target UK data subjects. Once appointed, their contact details will be published in an update to this policy.

In the interim, contact [email protected] for all data protection queries. We respond to all queries regardless of jurisdiction.

Once representatives are appointed, their details will be published in an update to this policy. EU users may also contact their national supervisory authority directly at any time.

15. Data Protection Officer (DPO)

For LGPD purposes (Brazil): LGPD requires all covered organisations to appoint a Data Protection Officer (Encarregado). We are in the process of designating a DPO. In the interim, all data protection and privacy queries should be directed to [email protected].

For GDPR purposes, Sentrytex at its current scale does not meet the threshold for mandatory DPO appointment under GDPR Art. 37. We have designated a privacy contact for all data protection queries.

16. Data Subject Access Requests (DSARs)

To submit a data subject access request or exercise any other privacy right:

1. Email [email protected] with the subject line “Privacy Request”.
2. Describe the right you wish to exercise and provide sufficient information to verify your identity.
3. We will respond within 30 days (EU/UK GDPR standard). Responses are free of charge.

We may ask for additional information to verify your identity before processing a request.

17. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email and by posting a notice on our website. We will update the “Last updated” date at the top of this page. Continued use of the Service after the effective date of a material change constitutes acceptance of the updated policy.

18. Contact

For all privacy-related queries, rights requests, and complaints:

Email: [email protected]
Controller: ClawNet (trading as Sentrytex), Germany
Lead Supervisory Authority: Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI), Husarenstraße 30, 53117 Bonn, Germany — bfdi.bund.de