Privacy Policy

How CVEalert.io collects, uses, and protects your data

Last updated: September 11, 2026

This Privacy Policy explains how CVEalert.io (the “Service”) collects and processes personal data on cvealert.io and app.cvealert.io.

The data controller is:

Proof Required s.r.o.
Nové sady 988/2
602 00 Brno
Czech Republic

Company ID (IČO): 300 03 474
Registered in the Commercial Register maintained by the Regional Court in Brno, Section C, File 153625.
Email: info@cvealert.io

1. Data We Process

Depending on how you use the Service, we may process:

  • Account data: email address, optional name and company name, authentication information, and invited team members’ email addresses
  • Service data: selected software, monitoring rules, notification preferences, webhook URLs, and alert-delivery records
  • Technical and security data: IP address, browser and device information, login events, usage metadata, and security logs
  • Billing data: billing name and address, VAT ID where provided, plan, invoices, and transaction records
  • Communications: support requests, feedback, and other messages you send us

Stripe processes payment-card details. We do not store full card numbers or card security codes on our servers.

We normally receive data directly from you. If another user invites you to a team, we receive your email address from that user. We may also receive billing status and transaction information from Stripe.

2. Why We Process Data

We process personal data to:

  • Create accounts and provide the Service (performance of a contract)
  • Deliver alerts, support teams, and manage billing (performance of a contract)
  • Secure, troubleshoot, and improve the Service and prevent abuse (legitimate interests)
  • Respond to questions and support requests (contract or legitimate interests)
  • Keep accounting and other records required by law (legal obligation)
  • Send optional communications where you have agreed to receive them (consent, where required)

Where we rely on legitimate interests, those interests are operating a reliable and secure service, understanding its performance, and preventing misuse. We do not sell personal data.

3. Service Providers and Data Sharing

We use service providers where needed to run the Service, including:

  • DigitalOcean for infrastructure hosting
  • Cloudflare for content delivery, security, and bot protection
  • Mailgun for transactional email delivery
  • Stripe for payments and billing
  • Datadog for logging and monitoring
  • Plausible for aggregate, cookie-free website analytics
  • IPinfo for IP-based location and network information
  • Slack for internal operational communication

These providers receive only the data reasonably needed for their role and process it under applicable agreements. We may also disclose data when required by law, to protect rights or security, or in connection with a corporate transaction.

4. Data Location and International Transfers

Our primary application data is hosted in data centers located in the European Union. We configure supported service providers, including Mailgun and Datadog, to use EU regions where available.

Some providers may process limited data outside the European Economic Area as part of their global operations. Where required, we rely on safeguards such as an adequacy decision or Standard Contractual Clauses.

5. Retention

We keep personal data only as long as needed for the purposes described above:

  • Account and service data is generally kept while your account is active and deleted or anonymized after account closure, subject to backups and legal obligations
  • Operational and security logs are generally kept for 15–30 days, depending on the system and provider
  • Billing and transaction records are kept for the period required by accounting and tax law
  • Support communications are kept as long as reasonably necessary to resolve and document the request

6. Security

We use technical and organizational safeguards appropriate to the Service, including encrypted transmission, access controls, authentication, restricted production access, logging, monitoring, and backups.

No online service can guarantee absolute security. Please contact security@cvealert.io if you believe you have found a vulnerability.

7. Your Rights

Subject to the conditions in applicable law, you may ask us to:

  • Provide access to your personal data
  • Correct inaccurate or incomplete data
  • Delete your data
  • Restrict or stop certain processing
  • Provide portable data where applicable

You may also object to processing based on legitimate interests and withdraw consent at any time where processing is based on consent. Withdrawal does not affect processing already carried out lawfully.

To exercise your rights, email info@cvealert.io. We may need to verify your identity before completing a request.

You may lodge a complaint with the Czech supervisory authority, the Office for Personal Data Protection (ÚOOÚ), or another competent supervisory authority.

8. Required Data and Automated Decisions

Account and payment information marked as required is necessary to create an account, provide a paid plan, or meet legal obligations. Without it, we may be unable to provide the relevant part of the Service.

We do not use personal data for automated decision-making that produces legal or similarly significant effects.

9. Children

The Service is not intended for people under 18, and we do not knowingly collect their personal data.

10. Changes and Contact

We may update this policy as the Service develops. We will update the date above and, where appropriate, notify users of material changes.

Privacy questions and requests can be sent to:

Proof Required s.r.o.
Email: info@cvealert.io
Website: https://cvealert.io/contact/