Privacy Policy
Effective 29 October 2026
CVEfocus is built to need as little personal data as possible. This policy explains exactly what we process, why, for how long, and your rights. It applies to the website cvefocus.com, the dashboard and the API at api.cvefocus.com (together, the "Service").
1. Who we are
The Service is operated by [Company legal name], [Registered address], [Country of registration] ("we", "us"). We are the controller of the personal data described here. Contact: info@cvegroup.com.
2. What we collect and why
| Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Your email address | Creating your account, sending sign-in links and essential service notices | Contract (Art. 6(1)(b)) | Until you delete your account |
| Your plan | Applying your daily limit | Contract | Until you delete your account |
| A one-way fingerprint (SHA-256) of each API key, its name, creation date and the last day it was used | Recognising your key and showing it in your dashboard. The key itself is shown to you once and never stored | Contract | Until you revoke the key or delete your account |
| Daily counts: number of API calls and of distinct products checked | Your dashboard and enforcing plan limits | Contract | Until you delete your account |
| Sign-in link tokens (stored only as fingerprints) | Signing you in | Contract | Usable once, expire after 15 minutes, deleted within a day |
| Session cookie (stored on our side only as a fingerprint) | Keeping you signed in to the dashboard | Contract; strictly necessary | 30 days, or until you sign out |
| Hashed product identifiers, in memory only | Counting distinct products for today's limit | Contract | Erased automatically within 48 hours |
| A hash of your email address, in memory only | Limiting how many sign-in emails can be requested, to prevent abuse | Legitimate interests (Art. 6(1)(f)): security | Erased automatically within one hour |
3. What we do not collect
- Your inventories. Package lists you send to the API or paste into the dashboard are processed in memory to produce the answer, then discarded. They are never written to disk, a database or a log.
- Your results. We do not keep the answers we return.
- IP addresses. Our web server needs your IP address to send the response, but does not write it to any log or database, and does not pass it to our application. We have not enabled network logging at our hosting provider. No CDN or proxy service sits in front of the Service.
- Request logs, analytics, advertising identifiers or tracking pixels. We do not sell or share personal data.
Inventories are package names and versions. Please do not include personal data, hostnames, IP addresses or secrets in what you send.
4. Who processes data for us
| Processor | What for | Data involved |
|---|---|---|
| Amazon Web Services, Inc. | Hosting our servers and backups, in [AWS region, e.g. us-east-1 (N. Virginia, USA)] | All data listed in section 2 |
| Zoho Corporation (ZeptoMail) | Delivering sign-in emails | Your email address and the email content. Open and click tracking are turned off |
Each processor acts on our instructions under a data processing agreement. If a processor handles data outside the European Economic Area or the UK, the transfer is protected by the European Commission's Standard Contractual Clauses or an equivalent safeguard. Ask us for a copy.
5. Security
- All traffic is encrypted (HTTPS). The database and memory store are not reachable from the internet.
- API keys, session tokens and sign-in tokens are stored only as one-way fingerprints, so a copy of our database would not reveal them.
- The parts of the Service that download public vulnerability data run separately and cannot read account data.
- Backups are encrypted and kept for up to 7 days.
6. Your rights
Under the GDPR (and the UK GDPR) you have the right to access your data, have it corrected, have it deleted, restrict or object to its processing, and receive it in a portable format. You can delete your account and all associated data yourself at any time: Dashboard → Account → Delete account. Deletion is immediate; backups containing it expire within 7 days. For any other request, email info@cvegroup.com; we answer within one month.
You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work, or to the UK Information Commissioner's Office.
7. Cookies
We use one cookie, and only after you sign in:
| Name | Purpose | Duration | Type |
|---|---|---|---|
cvf_session | Keeps you signed in to the dashboard | 30 days, or until you sign out | Strictly necessary, first-party, HttpOnly, Secure |
Strictly necessary cookies do not require consent under the ePrivacy Directive. We use no analytics, advertising or third-party cookies, and the website loads no third-party scripts or fonts. Your browser also stores, on your device only, whether you dismissed our cookie notice (localStorage, not a cookie). If we ever add optional cookies, we will ask for your consent first.
8. Children
The Service is for IT professionals and is not directed at children under 16. We do not knowingly collect their data.
9. Changes
If we change this policy, we will update the date above and, for material changes, email account holders before the change takes effect.
10. Contact
[Company legal name], [Registered address], [Country of registration]. Email: info@cvegroup.com.