Privacy
What personal data Vaethra processes, why, where, for how long, and the rights individuals have over it.
The design holds very little personal data
The Terminal and Atropos require no sign-in. There is no account, no profile, no record of what any visitor viewed, and no cookies of any kind — not analytics cookies, not advertising cookies, not session cookies. That is why there is no consent banner. Watchlists and layouts are held in your own browser's storage and never reach a server.
Web fonts are served from our own origin, so viewing the site discloses your IP address to nobody but us and our CDN. There are no third-party trackers, no advertising network, no analytics broker and no social widgets on any Vaethra property.
This is an architectural property rather than a policy one, and it is the main reason a compromise of Vaethra would expose very little about any individual.
This page is the detailed explanation for enterprise review. The formal notice is the Privacy Policy, and the processor terms are the DPA.
Every category, with its basis and retention
| Category | Whose | Purpose | Lawful basis | Retention |
|---|---|---|---|---|
| Business contact details — name, work email, organisation | Customers and enquirers | To respond, to operate the contract, to send required notices | Contract, or legitimate interests for an enquiry | Duration of the relationship, then deleted on request |
| API key records — key digest, owner, scope, usage | API customers | Authentication, rate limiting, billing, abuse handling | Contract | Contract duration; logs 12 months |
| Request logs — path, status, timing, row count, key | API customers | Billing, abuse handling, incident reconstruction | Contract and legitimate interests | 12 months |
| Alert rule destinations — the webhook URL you register | Anyone who creates one | To deliver the alert while your browser is closed | Legitimate interests, at your request | Until deleted, or 120 days after the last delivery attempt or save |
| Edge request metadata — IP, user-agent, timestamp | Every visitor | Security, rate limiting, abuse prevention | Legitimate interests | Per Cloudflare's retention policy |
| Aggregate page counts | Site visitors | Understanding which pages are used. Cookieless, measures no individual, and disclosed here. | Legitimate interests | Aggregate only |
Not processed at all: special-category data, children's data, biometric data, location data about individuals, browsing history, and any data obtained from a data broker. There is no advertising and no profiling.
Where the dataset itself names an individual
Vaethra's record is drawn from public sources about physical disruption, and a small proportion of it names people — a sanctioned individual on a published government list, a named official in a public advisory, an author credited in a public dataset. This is public-interest processing of information already published by an authority or a publisher, and every record carries the source and licence it came from.
- We do not enrich, cross-reference or build profiles of individuals.
- We do not add anything the source did not publish.
- Where a source corrects or withdraws a record, our copy carries the correction with its revision history intact.
- An individual who believes a record about them should not be held should write to privacy@vaethra.com. We assess it against the public-interest and freedom-of-expression grounds and respond with a reason either way within one month.
Controller or processor, and where
- For business contact details and API key records, Vaethra is the controller. The Privacy Policy is the notice.
- For anything you supply for us to process on your behalf — today, alert rule destinations; in the enterprise workspace, your own facilities and routes — Vaethra is the processor and the DPA governs it.
- Processing locations: the database and its backups are in AWS
us-east-2, with an EU region available on enterprise agreements. Edge processing is global, at the location nearest the reader. - Transfers outside the EEA rely on the 2021 Standard Contractual Clauses, incorporated in the DPA with supplementary measures.
What can be requested, and the response time
| Right | What we do |
|---|---|
| Access | Provide a copy of everything held about you, in a machine-readable format |
| Rectification | Correct anything inaccurate. For a public-source record we correct our copy and retain the revision history. |
| Erasure | Delete it, subject to statutory retention on billing records and to the public-interest grounds above |
| Restriction | Stop processing while a dispute is resolved |
| Portability | Machine-readable export of anything you supplied |
| Objection | Stop legitimate-interests processing unless we can demonstrate overriding grounds, which we will state |
| Complaint | To us, and to the supervisory authority where you live or work regardless. Vaethra is established in the United States and has no lead authority of its own. |
We respond within one month, extendable by two months for a complex request, in which case we tell you within the first month and give the reason. There is no charge. Write to privacy@vaethra.com.
There is no automated decision-making with legal or similarly significant effects on any individual. Vaethra assesses ports, routes and infrastructure, not people.
Ownership and records
- The founder is accountable for privacy. Vaethra is not required to appoint a data protection officer under Article 37: its core activities do not involve large-scale systematic monitoring of individuals or special-category data.
- A record of processing activities is maintained under Article 30 and is available under NDA.
- Privacy by design is structural. There are no accounts, no cookies and no profiles because the system was built that way; there is no setting that turns tracking on.
- Data protection impact assessments are carried out where processing is likely to be high risk. The enterprise workspace will be assessed before it ships.
- Every subprocessor is assessed for privacy before engagement and reviewed annually.