GDPR Consent

Version: September 2026. This page explains the legal basis on which Dypilon processes your data, exactly what you consent to when you start a scan, how long we keep data, and how to withdraw your consent. For the full description of our processing activities, see our Privacy Policy; for cookies and session storage, see our Cookie Policy.

1. What you are consenting to

When you enter an email address, phone number, domain, or photo and start a scan, you explicitly consent to us querying public sources and known data breaches with that information and reporting the result back to you. We never ask for your passwords and we gain no access to your inbox or accounts. Consent is given per scan: a new scan requires a new action from you.

2. Legal basis for each activity

We process your scans on the basis of your consent (Article 6(1)(a) GDPR). A biometric check is processed solely on the basis of your explicit consent for a special category of personal data (Article 9(2)(a)). A paid report, subscription, or continuous monitoring is processed to perform our contract with you (Article 6(1)(b)). Security and fraud prevention rest on our legitimate interest (Article 6(1)(f)); the accounting of your payments rests on a legal obligation (Article 6(1)(c)).

3. Biometric data requires separate consent

A facial check is optional and independent from the rest of your protection. You give a separate consent for it at the moment you upload a photo. The facial signatures are used only to compare against public indexes and are deleted after that comparison; they are never shared or sold. If you decline this consent, all your other checks and your subscription continue to work unchanged.

4. How long we keep data

Free scan data is processed transiently and removed from active storage at the end of your session. If you have activated continuous monitoring, we keep your scan profile and reports for as long as your subscription runs and delete them after it ends. Biometric signatures are not retained after the comparison. Payment and invoicing records are kept for as long as the applicable accounting legislation requires.

5. Withdrawing your consent

You can withdraw your consent at any time and without giving a reason, from your dashboard or by writing to support@dypilon.com. We then stop the processing concerned immediately and delete the data we processed on the basis of that consent alone. Withdrawal operates going forward: it does not undo processing that was lawful before you withdrew. An active subscription can additionally be cancelled separately.

6. Your rights and your right to complain

You have the right of access, rectification, erasure, restriction of processing, data portability, and objection to processing. Submit your request via support@dypilon.com; we reply within one month. If you are not satisfied with our response, you may always lodge a complaint with the data protection supervisory authority of your country.

7. Processors and transfers

Dypilon processes your data within Europe. We engage only carefully selected processors, each under a data processing agreement, including Stripe for the secure handling of payments. Where a transfer outside the European Economic Area is necessary, it takes place exclusively with the appropriate safeguards of Chapter V of the GDPR, such as the European Commission's standard contractual clauses.