Privacy Policy

This Privacy Policy explains how Talivio Technology OÜ (registry code 16991406, Ahtri tn 12, Kesklinna linnaosa, Tallinn, Harju maakond, 15551, Estonia — "Talivio", "we") processes personal data in connection with the TCSR (Talivio Cyber Security Report) service. We are the data controller for the data described below, except where this policy says we act as a processor (section 4). For privacy questions, contact [email protected].

1. Data we collect

• Account data: name, email address, hashed password.
• Asset data: domains you add and the ownership-verification records you publish.
• Scan data: for domains you have verified, information gathered by our scan modules (DNS, certificates, headers, exposed paths, technology fingerprints, etc.) and the findings derived from it. For domains you have not verified, we collect only passively observable, publicly available information (see section 4 on third-party data).
• Test-account credentials (optional): if you enable authenticated scanning, the dedicated test-account credentials you provide. They are stored encrypted at rest, are never displayed again after you save them, and are used solely to sign in to your own site during scans.
• Collector and forensics data (optional): if you run our collector or forensic agents on your own systems, the findings they submit — including file paths, hashes, configuration details and aggregated log statistics. Log-derived data may include IP addresses of visitors to your site (see section 4). Raw forensic evidence is stored encrypted at rest.
• Billing data: subscription status, one-off purchase records and payment identifiers. Card details are handled by Stripe; we never store card numbers.
• Technical data: IP address, browser information and server logs needed to secure and operate the service.

2. How we use it

• To provide the service: verify ownership, run scans, generate, store and verify reports.
• To run continuous monitoring and send you alert emails, where you have enabled it.
• To process subscriptions and one-off purchases (via Stripe).
• To secure, maintain and improve the service.
• To send service-related communications.

3. Legal bases (GDPR)

We process personal data on the following legal bases under Article 6(1) GDPR: to perform our contract with you — providing your account, scans, reports and billing (Article 6(1)(b)); to comply with legal obligations, including accounting and tax law (Article 6(1)(c)); and for our legitimate interests in keeping the service secure, preventing abuse of the scanner, and improving the service (Article 6(1)(f)).

4. Third-party data in scans — our role

Scan results, collector submissions and forensic evidence describe your systems and may incidentally contain personal data of people other than you — most notably IP addresses of visitors or attackers appearing in your server logs. You decide to collect and submit this data; for it, you are the data controller and we act as your processor, handling it only to produce your reports. We will, on request, enter into a GDPR Article 28 data processing agreement with business customers covering this processing; our standard DPA is available from [email protected]. Passive scans of domains you have not verified use only publicly available information about the domain itself.

5. AI processing

To author report narratives we may send structured scan findings, page excerpts and aggregated log statistics to our AI provider, Google (Gemini API). We do not send your account credentials, test-account credentials or payment data for this purpose. We use the paid Gemini API tier; under Google's terms and the Google Cloud Data Processing Addendum, prompts and outputs are not used to train or improve Google's models. Google acts as our processor for this purpose.

6. Sharing & recipients

We do not sell personal data. We share it only with the recipients needed to deliver the service.

Processors (act on our behalf, under our instructions):

• Our hosting and email infrastructure — operating the service and sending transactional email; located within the EU.
• Google (Gemini API) — generating report narratives, under the Google Cloud Data Processing Addendum, on the paid tier as described in section 5.

Independent controllers (act on their own account):

• Stripe — our payment provider, which processes the payment data it needs as an independent (separate) controller. We do not sign a controller-processor DPA with Stripe for the payment flow; Stripe's own privacy terms govern that processing.
• Meta — only if you accept the cookie banner; joint controller for the Meta Pixel, see section 12.

7. International transfers

We host within the EU and we do not transfer your personal data outside the European Economic Area. Some of our sub-processors may process data in the United States: transfers to Google rely on Google's certification under the EU-US Data Privacy Framework, backed by the European Commission's Standard Contractual Clauses in the Google Cloud Data Processing Addendum as an additional safeguard. Where Stripe processes data outside the EEA as an independent controller, it relies on its own transfer safeguards. If you accept the Meta Pixel, Meta may transfer that data to the United States (section 12).

8. Retention

• Account, asset and report data: kept while your account is active and deleted or anonymised within 90 days after your account is closed, unless a longer period is legally required (for example invoicing records under accounting law).
• Raw forensic evidence: purged 30 days after the forensic report is delivered; the signed PDF report and its verification fingerprint remain.
• Test-account credentials: kept encrypted until you remove them or close your account; you can delete them at any time.
• Server logs: kept for a short rolling period for security purposes.

9. Your rights

Under the GDPR you may request access to your data, rectification, erasure, portability, restriction of processing, and object to processing. You may lodge a complaint with a supervisory authority — for us that is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), but you may also contact the authority in your own country. To exercise a right, email [email protected]. Where we process data as your processor (section 4), we will refer requests from third parties to you as the controller.

10. Security

We apply technical and organizational measures appropriate to the risk: passwords are hashed, test-account credentials and raw forensic evidence are encrypted at rest, traffic is served over TLS, access is restricted, and active or intrusive scan modules run only against domains whose ownership you have verified. No system is perfectly secure, but we take reasonable measures to protect your data.

11. Cookies

We use essential first-party cookies: a session cookie that keeps you signed in, a CSRF cookie that protects forms against abuse and — if you choose "remember me" — a persistent sign-in cookie. Talivio Analytics, our own first-party traffic measurement, is cookieless: it sets no cookies and does not depend on your choice. The only advertising cookie is the Meta Pixel cookie, set only if you accept it in the cookie banner (see section 12).

12. Meta Pixel (only with your consent)

If you click "Accept" in the cookie banner, we load the Meta Pixel. It tells us whether a visit from one of our Instagram or Facebook ads leads to a free scan, a sign-up or a purchase, and it lets us show our ads to people who have visited this site. If you click "Reject" or make no choice, the pixel is not loaded and no request is sent to Meta.

• Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. For collecting and transmitting this data we and Meta are joint controllers (Art. 26 GDPR) under Meta's Controller Addendum; Meta is solely responsible for what it does with the data afterwards. Data may be transferred to Meta Platforms, Inc. in the United States; these transfers rely on Meta's certification under the EU–US Data Privacy Framework and on the EU standard contractual clauses.
• What is sent: the pages you view on security.talivio.com, the events "Lead" (free scan), "CompleteRegistration" (sign-up), "Purchase" (with the plan price and currency) and "Contact", your browser's technical data and IP address, and the Meta cookies below. We do not use advanced matching: your email address, name, account ID and the domains you scan are never sent to Meta. Automatic event collection is switched off.
• Purpose: measuring our ads and showing them to past visitors (retargeting).
• Legal basis: your consent (Art. 6(1)(a) GDPR; for visitors in Germany also § 25(1) TDDDG; and the ePrivacy rules on storing information on your device).
• Cookies: _fbp (browser identifier, 90 days) and, when you arrive from a Meta ad, _fbc (the ad click ID, 90 days). Meta sets them on the talivio.com domain. Our own talivio_consent cookie stores your choice (180 days; strictly necessary).
• Withdrawing consent: use the "Cookie settings" link in the footer at any time. When you withdraw, we tell the pixel that consent is revoked, delete the Meta cookies and stop loading the pixel from the next page on. Withdrawal does not affect processing carried out before it. You can also control ads based on your activity in your Meta account settings.

13. Changes

We may update this policy; the date at the top shows when it last changed, and material changes will be communicated where appropriate.