Privacy policy

Who processes your data

The data controller is Valyzer.com, the operator of the Valyzer service. For any question about your data, write to legal@valyzer.com.

What data we process

Account: the email address you provide when signing in with Google or with a one-time email link. If you sign in with a password instead, that password is handled by the configured authentication provider, never by Valyzer in plain text.

Session: once you sign in, the server writes a cookie (__Host-valyzer_session) marked HttpOnly and Secure — only the server can read it — that expires after one hour or when you sign out.

Sign-in in progress: while you complete Google sign-in or the email-link flow, a second, temporary cookie (__Host-valyzer_oauth), also HttpOnly and Secure, holds that operation's state for at most ten minutes and is cleared as soon as it finishes.

Analytics, only if you allow it: if you accept the cookie notice, we store your decision in our own cookie (valyzer_consent) and record minimal, anonymous usage events — see the cookie policy. Without that explicit acceptance, no event is ever recorded.

Aggregate visit counts, without cookies: we use Cloudflare Web Analytics to count visits and page views in aggregate (page, country, browser, device type and referring site). It sets no cookies and stores nothing in your browser, creates no identifier for you and does not track you across sites, and we only see aggregate figures. That is why it does not depend on the cookie notice.

Billing, if you take out a paid API plan: when you subscribe to the Developer plan, Stripe collects the payment method, billing address and your company's tax ID in its own checkout form, calculates the applicable tax and issues the invoice. Valyzer never sees or stores your card number; our own database only keeps the Stripe customer and subscription identifiers, the plan you hold and its status (active, past due, cancelled).

Public content: what Valyzer publishes (events, indicators, evidence) comes from official sources with a rights decision reviewed before publication. It is not personal data about you.

Who we share it with

The service runs on Cloudflare (web app and API) and a PostgreSQL database managed on Supabase, both acting as data processors. We use no advertising and no third-party analytics beyond Cloudflare: aggregate visit counts come from Cloudflare Web Analytics, through a small Cloudflare script and without cookies, and any usage event you agree to share goes only to a Valyzer endpoint of our own, with no external SDK. We do not sell or hand over your data to third parties.

Cloudflare also provides Turnstile, an anti-abuse check on our forms: it is loaded only when you start filling in a form, not when the page opens. Cloudflare may also set a security cookie (cf_clearance) when it verifies that a request is not automated; it is listed in the cookie policy.

Map: the base map tiles and map fonts are fetched by our servers from OpenFreeMap (OpenStreetMap data) and served from valyzer.com, so your browser does not connect to them.

Google receives your data only if you choose "Continue with Google" to sign in; in that case Google's own privacy policy applies.

If you take out the Developer API plan, Stripe Payments Europe, Ltd. (and its affiliates) processes your payment and billing data as an independent processor, under its own terms and privacy policy, to process the charge, calculate tax and issue the invoice.

Where data is hosted

Data is stored in the European Union. Cloudflare serves requests from the node of its network closest to you, which may be outside the EU; where that involves an international transfer, it is covered by the European Commission's standard contractual clauses and, where applicable, the EU-US Data Privacy Framework.

How long data is kept

Account: for as long as you keep it active. If you ask to close it, it is erased within 30 days at most.

Contact requests: up to 12 months after the last exchange, unless they lead to a business relationship.

Analytics events: 12 months at most.

Billing data, if you become a client: the periods required by applicable tax law. The Stripe customer and subscription identifiers are kept for as long as the account has, or has had, a paid plan, plus the accounting retention period required.

Cookies: the session cookie lasts one hour; the sign-in cookie, ten minutes; the analytics consent cookie, about 180 days or until you withdraw it.

Your rights

You can ask to access, correct or delete your data, or for a portable copy of it, by writing to legal@valyzer.com or from the contact page. We respond within 30 days at most.

If you are in the European Economic Area or the United Kingdom, you also have the right to object to or restrict processing, and to lodge a complaint with your local data protection authority.

If you live in a US state with its own privacy law (for example, California), you have the rights that law grants you. Valyzer does not sell your personal information or share it for cross-context behavioral advertising, and we will not discriminate against you for exercising your rights.

Changes to this policy

When what the system actually does changes, we will update this page. The last-reviewed date appears at the top.