Privacy

1. Introduction

CHLELA INC. (doing business as "Akadenia," "we," "us," or "our") is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our services, or interact with us in any way.

It also covers Akadenia Security, our external security scanning service at security.akadenia.com (the "Service"). Section 2.4 describes the information the Service holds.

This policy complies with applicable privacy laws including the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), Utah Consumer Privacy Act (UCPA), and other applicable state and federal privacy laws.

2. Information We Collect

2.1 Personal Information You Provide

We may collect the following types of personal information when you interact with our services:

• Contact Information: Name, email address, phone number, mailing address
• Account Information: Username and profile information. Passwords are handled by our sign-in provider, and we never see them
• Payment Information: Billing address and invoicing details. Payment method details are handled by third-party payment providers, and we do not receive them
• Communication Data: Messages, feedback, support requests
• Professional Information: Job title, company, industry (if applicable)
• Preferences: Communication preferences, service preferences

2.2 Information We Collect Automatically

When you use our services, we may automatically collect:

• Usage Data: Pages visited, time spent, click patterns, features used
• Device Information: IP address, browser type, operating system, device identifiers
• Location Data: General geographic location (city, state, country)
• Technical Data: Log files, error reports, performance data
• Cookies and Similar Technologies: As described in our Cookie Policy

2.3 Sensitive Personal Information

We may collect sensitive personal information only when necessary and with your explicit consent, including:

• Biometric data (if applicable to our services)
• Health information (if relevant to our services)
• Precise geolocation data (with your consent)
• Information revealing racial or ethnic origin, political opinions, religious beliefs, or sexual orientation (only if you choose to provide it)

2.4 Akadenia Security

When you or your organization use Akadenia Security, we also hold:

• Sign-in Information: Your email address, name, profile picture and an account identifier from Auth0, our sign-in provider (with Google sign-in, these come from your Google account). We show your name and picture to you and to other members of your organization. We never see your password
• Account Settings: A display name you choose, whether your account was approved (sign-ups are approved automatically once the email address is verified) and whether multi-factor authentication is required for your account. When you sign up, your email address is sent to Akadenia staff so they know who has joined
• Organization Information: Your organization's name, its members and their roles, and pending invitations, including the email addresses of the people invited and who invited them
• Targets and Results: The hosts and URLs you register, who authorized testing them, scan schedules, who started each scan, scan output, findings and penetration test reports
• Login Details for Scans: If you have the Service scan a Target while signed in, the login details of the test account you provide, stored encrypted and used only to run your scans
• Email Security Reports: DMARC and SMTP TLS reports that mail providers send about your domains, which include the addresses of servers that sent or received mail for them
• Notifications: The notices the Service shows you, such as a scan finishing or a member joining
• Penetration Test Details: For an engagement, the names of the testers and report authors, and the email addresses and roles of any test accounts you provide
• Alert Settings: Alert email addresses, Slack and webhook URLs, and whether email to an address bounced or was reported as spam
• Billing Information: If you pay by card, your billing name, email and address, any tax ID you give, and your Stripe customer and subscription identifiers. Stripe handles your card; we do not receive your full card number. If you subscribe through AWS Marketplace, your AWS customer and subscription identifiers. AWS handles payment; we do not receive your payment details

3. How We Use Your Information

We use your personal information for the following purposes:

3.1 Service Provision

• Provide, operate, and maintain our services
• Process transactions and manage your account
• Deliver customer support and respond to inquiries
• Customize and personalize your experience

3.2 Communication

• Send service-related communications
• Provide updates about our services
• Send marketing communications (with your consent)
• Respond to your requests and inquiries

3.3 Business Operations

• Analyze usage patterns and improve our services
• Conduct research and analytics
• Develop new products and features
• Ensure security and prevent fraud
• Comply with legal obligations

3.4 Marketing and Advertising

• Send promotional materials (with your consent)
• Conduct targeted advertising
• Measure advertising effectiveness
• Conduct surveys and market research

4. Legal Basis for Processing

We process your personal information based on the following legal grounds:

• Consent: When you have given clear consent for us to process your personal information for specific purposes
• Contract Performance: When processing is necessary for the performance of a contract with you
• Legitimate Interests: When we have a legitimate business interest that is not overridden by your privacy rights
• Legal Obligation: When we are required to process your information to comply with legal obligations
• Vital Interests: When processing is necessary to protect someone's life or physical safety

5. Information Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties. We may share your information in the following circumstances:

5.1 Service Providers

We may share your information with trusted third-party service providers who assist us in operating our business, including:

• Amazon Web Services: Hosting and storage, email delivery, and billing where you buy through AWS Marketplace
• Auth0 (Okta): Sign-in and account authentication for Akadenia Security
• PostHog: Website analytics
• Stripe: Card payments, invoices and tax calculation for Akadenia Security
• Cloudflare: Serving the MTA-STS policies Akadenia Security hosts for your domains
• Sentry: Error reports from Akadenia Security, with user details, headers, cookies and query strings removed before they are sent
• Payment processors
• Email service providers
• Analytics and marketing platforms
• Customer support tools

Akadenia Security also sends alerts to the email addresses, Slack workspaces and webhooks your organization chooses.

5.2 Business Transfers

We may share your information in connection with a merger, acquisition, or sale of assets, provided that the receiving party agrees to protect your information in accordance with this Privacy Policy.

5.3 Legal Requirements

We may disclose your information when required by law or to:

• Comply with legal processes or government requests
• Protect our rights, property, or safety
• Protect the rights, property, or safety of our users or others
• Investigate or prevent fraud or security issues

5.4 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

6. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication mechanisms
• Employee training on data protection
• Incident response procedures
• Regular backups and disaster recovery planning

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

7. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Our retention periods are based on:

• The nature of the information
• The purpose for which it was collected
• Legal and regulatory requirements
• Business needs

When we no longer need your personal information, we will securely delete or anonymize it.

For Akadenia Security specifically:

• Data is stored on Amazon Web Services in the United States (us-west-2), and each organization's data is logically separated from every other organization's. Scans run from infrastructure we operate, which processes raw scan output temporarily and deletes it once the results are uploaded
• Raw scan output and draft reports are deleted about 180 days after they are created, and backup copies are removed within a further 30 days
• Targets, schedules, findings, approved reports, and account and organization information are kept while your organization's account is active. An organization owner can delete a Target or the whole organization in the Service, which deletes its data, or you can ask us to
• Records of individual scans, and DMARC and SMTP TLS reports, are deleted about 400 days after they are created. The emails those reports arrive in are deleted after 30 days, and notifications after 30 days
• Each request to the Service's API is logged with its time, what was requested and the result, your IP address, your browser's user agent, and your account identifier, to secure the Service and investigate incidents. These logs are kept for one year and then deleted
• After deletion, copies may remain in backups for up to 35 days and in system logs we keep to operate and secure the Service

8. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

8.1 Access and Portability

• Request access to your personal information
• Receive a copy of your personal information in a portable format
• Request information about how we process your data

8.2 Correction and Updates

• Request correction of inaccurate personal information
• Update your personal information through your account settings

8.3 Deletion

• Request deletion of your personal information
• Right to be forgotten (subject to certain exceptions)

8.4 Restriction and Objection

• Request restriction of processing in certain circumstances
• Object to processing based on legitimate interests
• Object to direct marketing

8.5 Consent Withdrawal

• Withdraw consent at any time (where processing is based on consent)
• Opt-out of marketing communications

8.6 Non-Discrimination

We will not discriminate against you for exercising your privacy rights.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our website. For detailed information about our use of cookies, please refer to our Cookie Policy.

9.1 Types of Cookies We Use

• Essential Cookies: Necessary for the website to function properly
• Analytics Cookies: Help us understand how visitors use our website
• Marketing Cookies: Used to deliver relevant advertisements
• Preference Cookies: Remember your settings and preferences

9.2 Managing Cookies

You can control cookies through your browser settings. However, disabling certain cookies may affect the functionality of our website.

10. Children's Privacy

Our services are not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete such information promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

11. International Data Transfers

Your personal information may be transferred to and processed in countries other than your country of residence. When we transfer your information internationally, we ensure appropriate safeguards are in place, including:

• Adequacy decisions by relevant authorities
• Standard contractual clauses
• Binding corporate rules
• Certification schemes

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Post the updated policy on our website
• Update the "Last Updated" date
• Notify you through email or other appropriate means
• Obtain your consent where required by law

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

13. Contact Us