Privacy policy
Effective
In short
- For a free scan we collect the site address, the email for the result and campaign tags. Your IP address and browser user agent are kept only if you accept advertising cookies.
- We keep it 30 days, or 12 months if you accept follow-up emails, or 30 days after you unsubscribe, whichever comes first.
- No cookies of our own. Analytics and advertising load only if you accept them.
Who we are
Sentinela is responsible for the personal data described here (the "controller"). We work online only; contact us at hello@sentinela.systems for any privacy question or request.
When customers ask us to scan, audit or fix their websites, we process the content of those sites on the customer's behalf. For that data the customer is the controller and we are their processor, under our Data processing agreement.
What we collect
Through the free scan
- The address of the site you ask us to scan, and the email address for the result.
- Whether you agreed to receive follow-up emails, and when.
- Campaign tags from the link you arrived on (UTM tags) and the first page you visited on this site.
- Only if you accept analytics and advertising cookies: ad click identifiers, your IP address and browser user agent, and the browser identifiers set by Google Analytics and the Meta pixel.
Through your account and our services
- Accounts: name, email, language, a hashed password, optional two-factor settings, your role in an organization, and a log of account activity including IP addresses, kept for security.
- Billing: plan, invoices and payment status. PayPal processes card and account details; we do not receive them.
- Emails: which emails we sent and whether they were delivered. If you unsubscribe, we keep a hashed form of your address so we do not email you again.
- Bookings: if you book a call, Cal.com processes the booking; we receive a notice that a call was booked.
- Security and operations: request logs without personal content, and short-lived counters to prevent abuse.
Why we use it, and on what basis
| Purpose | Legal basis |
|---|---|
| Run the free scan and send the result | Your request (steps before a contract) |
| Provide your account and paid services | Contract |
| Follow-up emails after a free scan | Your consent, which you can withdraw at any time |
| Analytics and advertising measurement | Your consent through the cookie banner |
| Answer what you ask in the website chat | Our legitimate interest in answering you |
| Security, abuse prevention, backups | Our legitimate interest in a safe service |
| Invoices and tax records | Legal obligation |
Website chat
"Chat with Sentinela" on this website answers questions about our services. An AI assistant answers first; the Sentinela team can read the conversation and reply, and their replies show as "Sentinela team".
- What we keep: the messages you write and our replies, with their times. You do not need to give your name or email. Anything you type, such as a store address, is kept as part of the conversation.
- In your browser: a random code in the tab's session storage lets you read the chat again until you close the tab. The chat sets no cookies.
- Who processes it: to write each answer, the conversation is sent to Cursor (Anysphere, Inc.), which runs the AI model, and through Cursor to xAI, which provides the model. The assistant runs on our own server and deletes its working copy of the conversation after each answer, or within about 4 hours if a step fails. Our system logs do not contain chat messages.
- How long: 180 days after the last message. To have a chat deleted sooner, email hello@sentinela.systems.
- Please do not share passwords, payment details or other sensitive information in the chat.
How long we keep it
- Account data: while your account exists; deleted 30 days after you delete your organization, except billing records we must keep by law.
- Scan results: 90, 180 or 365 days depending on your plan.
- Audit and remediation records: 3 years.
- Encrypted backups: up to 14 daily and 8 weekly copies.
- Free scan requests without consent to follow-up emails: 30 days.
- With consent: 12 months, or 30 days after you unsubscribe, whichever comes first.
- Records of emails we sent: 90 days.
- Website chat conversations: 180 days after the last message.
- Conversion events for advertising: 90 days, with a hashed email address instead of the address itself.
- To limit abuse, our server counts requests per IP address using a daily-changing code derived from it, and deletes the count within about a day.
- If an address bounces, complains or unsubscribes, we keep a one-way hash of it so we never email it again.
Cookies and similar storage
This site sets no cookies of its own. It stores your cookie choice in your browser, and keeps the campaign tags of your visit in the browser tab until you close it, to send them with a free scan request. Google Analytics and the Meta pixel load only after you accept them; you can change your choice at any time with "Cookie settings" at the bottom of every page.
Service providers
For this website and our own marketing, Google (Google Analytics 4) and Meta (the Meta pixel) measure visits and advertising only after you accept them, and Cal.com handles call bookings. Cursor and xAI process website chat messages, as described under "Website chat".The providers that process data on our customers' behalf when we scan, audit or fix their websites are listed in the Data processing agreement.
International transfers
Our providers are in several countries, including the United States. Where the law requires it, transfers rely on the providers' standard contractual clauses or an equivalent safeguard.
Your rights and contact
Depending on where you live, you can ask to access, correct, delete or export your data, object to or restrict its use, and withdraw consent. Account owners can export and delete their data in the dashboard. For anything else, email hello@sentinela.systems; we will verify the request and answer within 30 days. You can also complain to your data protection authority.
Security
Data in transit is encrypted, stored secrets and site login details are encrypted, customer data is separated per organization, and staff use two-factor authentication.
Children and changes
Sentinela is a business service and is not meant for children.
We will post updates here with their date.