The data controller responsible for your personal data is Aegis. For any privacy-related questions, requests or complaints, contact us at info@aegisob.com.

• Account data — your email address and a salted, hashed password (we never store plaintext passwords).
• Usage data — encryption activity logged to your account (file name, size, protection mode, timestamp and token cost).
• Payment data — handled by our payment providers (e.g. Stripe). We do not store full card details.
• Technical data — IP address, browser type and device information, collected in server logs for security and availability.

We do not store or inspect the content of the source code you encrypt. Files are processed transiently and are not retained.

We process personal data for the following purposes and on the following legal bases:

• Providing the Service — performance of a contract (Article 6(1)(b) GDPR): creating accounts, processing encryptions, deducting tokens, logging activity.
• Payments — performance of a contract and compliance with legal obligations (tax and accounting).
• Security — legitimate interest (Article 6(1)(f) GDPR) in protecting our systems against fraud and abuse.
• Legal obligations — compliance with applicable law (Article 6(1)(c) GDPR).

We retain personal data only for as long as necessary for the purposes described above. Account data is retained while your account is active. Encryption logs are retained for operational and security purposes and are limited to the most recent records. Where a statutory retention period applies (e.g. tax records), we retain data for that period and then delete it.

We share personal data only with service providers that process it on our behalf under a data-processing agreement, such as our database host, hosting provider (e.g. Vercel) and payment processor (e.g. Stripe). We do not sell your personal data. Where data is transferred outside the European Economic Area, we rely on appropriate safeguards such as Standard Contractual Clauses.

We use strictly necessary cookies to keep you signed in (a signed session cookie). We do not use advertising or third-party tracking cookies. Where non-essential technologies are introduced, we will ask for your consent first.

Under the GDPR you have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erase your data ("right to be forgotten");
• restrict or object to processing;
• receive your data in a portable format (data portability);
• withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, contact us at info@aegisob.com. We respond to requests without undue delay and within one month.

We use appropriate technical and organisational measures to protect personal data, including password hashing with a salted key-derivation function, encrypted transport (TLS) and restricted access to production systems.

Some processors may store data outside the European Economic Area. In such cases we ensure appropriate safeguards are in place, in particular the European Commission's Standard Contractual Clauses or an adequacy decision.

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

We may update this Privacy Policy from time to time. We will post the revised version on this page with an updated effective date and, for material changes, provide additional notice where appropriate.

For privacy questions, contact us at info@aegisob.com. You also have the right to lodge a complaint with your local data-protection supervisory authority if you believe we have not handled your personal data lawfully.