Privacy Policy

01Scope and Data Controller

This Privacy Policy explains how Ekos Cyber Labs, LLC, a limited liability company organized under the laws of the State of Delaware, United States, as operator and data controller of the Veylum platform (the "Service"), collects, uses, shares, and protects personal data in connection with the Service — including data about visitors to this website, people who join the waitlist, individuals who submit a registration request, registered users of the dashboard, and, incidentally, individuals whose information appears in the public OSINT data the Service processes about domains suspected of impersonating a customer's brand.

It applies to this public website and its waitlist, the registration site, the authenticated dashboard, the REST API and the MCP integration surface. Where Ekos Cyber Labs processes personal data on behalf of a customer under a separately executed data processing agreement, that agreement prevails over this Policy to the extent of any conflict.

02Categories of Personal Data We Collect

• (a) Waitlist data: the work email address you leave on this website, the language you were browsing in, which button you used, the country derived from your network address, and the date and time.
• (b) Account and registration data: full name, work email address, company name, job-relevant contact details, the brand and domain you request monitoring for, the confirmations you give at registration (acceptance of these documents, brand authorization, and any explanation of a domain mismatch), the network address and time of the request, and any message you voluntarily provide.
• (c) Authenticated-user data: your login credentials (stored as a salted bcrypt hash, never in plain text), your role and brand scope within your organization's account, your timezone preference, and your session activity.
• (d) Billing data: when a paid plan is active, the billing contact, invoices and payment status. Card or bank details are collected and stored by our payment processor, not by us.
• (e) Usage and security data: activity logs, the source IP address of requests, timestamps, and technical metadata used to detect abuse (for example, rate limiting on the public forms and on login attempts).
• (f) Takedown records: the text of each notice a user of your account confirms, the recipient, the evidence attached, the identity of the confirming user (user account and email address), the time and network address of the confirmation, the acceptance text the user confirmed, and the replies received. The same record is kept when a user of your account submits a takedown request through a third party's web form.
• (g) OSINT data about monitored domains and third parties: publicly available DNS records, RDAP/WHOIS responses, TLS certificate data, public search results, and screenshots and captured content of web pages suspected of impersonating a monitored brand. We deliberately minimize this category — we do not store more registrant or third-party personal data than is strictly necessary for brand-protection analysis, and we do not knowingly collect sensitive personal data (such as health, biometric, or precise-location data) about any individual. Where a captured page incidentally contains such data, we do not index, search or use it, and it is deleted with the capture under Section 10.
• (h) Communications: any message you send us through a support channel, including its content and metadata.

03Sources of Data

We collect data directly from you (waitlist, registration and account use), automatically through your use of the Service (activity and security logs), and from public third-party sources as part of the Service's core brand-protection function (domain registries and registrars, Certificate Transparency logs, newly-registered-domain feeds, public search engines, and the publicly reachable content of suspected sites).

04How We Use Personal Data

We use personal data to:

• (a) provide, operate, secure, and improve the Service, including generating findings, producing AI-assisted verdicts, and sending the alerts and reports you configure;
• (b) create and administer your account, including authentication, role-based access control and billing;
• (c) evaluate and follow up on waitlist entries and registration requests, including telling you when access opens;
• (d) communicate with you about your account, findings, or requests;
• (e) transmit the takedown notices you confirm and keep the record of them (Section 10);
• (f) detect, investigate, and prevent fraud, abuse, or unauthorized access to the Service; and
• (g) comply with legal obligations, including responding to lawful requests from authorities.

We do not use personal data for advertising, we do not build cross-customer benchmarks or profiles, and we do not send marketing communications beyond the waitlist notice described in (c) unless you separately opt in.

05Legal Bases for Processing

Where the law applicable to you requires a legal basis, we rely on: performance of a contract for operating the account and plan you signed up for; our legitimate interest in operating a secure brand-protection service, preventing fraud and abuse, and establishing or defending legal claims arising from notices sent through the Service, provided that interest is not overridden by your fundamental rights; compliance with a legal obligation; and your consent for website analytics and for any marketing communication beyond the waitlist notice, which you may withdraw at any time.

06AI-Assisted Processing

The Service uses a large-language-model provider to help classify certain findings (medium/high-severity domains) and to profile a brand's own public presence. This automated processing evaluates characteristics of a domain or page — not personal characteristics of an individual user — to produce a threat classification and narrative.

Where page content or a screenshot of a suspected impersonating site is submitted for AI analysis, that content may incidentally contain personal data of unrelated third parties appearing on that public page (for example, names on a phishing site copying a bank's public staff directory); we process such incidental content only to assess brand-impersonation risk and do not use it for any other purpose.

07Cookies, Do Not Track and Global Privacy Control

In the authenticated Service, we use only strictly necessary cookies: a session-authentication cookie and a CSRF-protection cookie required for the dashboard and public forms to function securely. We do not use tracking, advertising, or analytics cookies there, and we do not use cookies to build cross-site profiles of users.

On this public website, no advertising technology loads, and Google Analytics loads only if you explicitly accept it in the consent banner. If you accept, we load Google Analytics to measure aggregate site traffic, configured without advertising features; if you decline, or until you choose, it is not loaded and no Google Analytics identifier is created. Your language preference and your answer to the consent banner are stored in your browser's local storage on your own device — they are never transmitted to us, and clearing your browser data removes them.

Cloudflare services that run on every visit. Because this website is delivered and protected by Cloudflare, two Cloudflare services run on every page regardless of the consent banner, as part of operating and securing the site: (a) Cloudflare Web Analytics, which counts page views and measures page-load performance in aggregate, without cookies, local storage, or any identifier that recognizes you across visits or sites; and (b) a bot-detection check (Cloudflare JavaScript Detections), which runs a short script in your browser to distinguish people from automated traffic and stores its result in a security cookie (cf_clearance). Neither is used for advertising or to build a profile of you.

Do Not Track and Global Privacy Control. If your browser sends a Do Not Track (DNT) or Global Privacy Control (GPC) signal, this website treats it as a refusal: the consent banner is not shown and Google Analytics is not loaded, regardless of any earlier choice. The Cloudflare services described above still run, because they are part of operating and securing the site and are not used to track your activity. We do not permit third parties to collect personal information about your online activities over time and across different websites through this site.

We do not sell or share personal information for cross-context behavioral advertising, and we do not use cookies or similar technologies for that purpose on any surface of the Service.

08How We Share Data

We share personal data only with service providers who process it on our behalf to operate the Service, each under contractual confidentiality and use-limitation obligations, and only the data each one needs:

• Cloud hosting and managed database for the Service (all account data at rest, in the United States), and edge network and security services (Cloudflare: request metadata and source IP addresses for this website, the Service and the waitlist store).
• Transactional email (Postmark): registration verification and approval, account activation, password resets, report-ready and account notifications, and the internal alert that a new waitlist entry was received. Postmark receives the recipient address and the message content and retains delivery logs for a limited period.
• Case mailbox provider: takedown notices you confirm are transmitted through, and replies to them are received in, a dedicated business mailbox operated by a third-party email provider; it receives the recipient address, the notice content and the evidence attached.
• Large-language-model inference provider (nan.builders) for Ekos AI verdicts and brand profiling: finding evidence, captured page content and screenshots of suspected sites.
• Web-content capture and screenshot provider (Firecrawl), used as a fallback to render suspected sites: the target URL only.
• Search provider (Brave Search API) for query-based discovery of impersonating content: the search term, brand name or domain only.
• Payment processor (Stripe), when a paid plan is active: billing contact and payment details, which it collects directly.
• Business email provider for our support, privacy and legal mailboxes: the content of correspondence you send us.
• Google Analytics, on this public website only and only with your consent: aggregate website usage data.

The Service also queries public data sources — domain registries and registrars (RDAP/WHOIS), Certificate Transparency logs and indexes, newly-registered-domain feeds, DNS and routing lookups, and web archives — to investigate suspected domains. These sources receive only the domain, name or search term queried, never your account data, and they are not our processors.

We do not sell personal data, and we do not share personal data with third parties for their own independent marketing purposes. We may disclose personal data where required by law, to protect the rights, property, or safety of Veylum, our customers, or the public, or in connection with a merger, acquisition, or sale of assets (subject to continued protection under an equivalent policy).

09International Data Transfers

Ekos Cyber Labs is organized in the United States, where the Service's production infrastructure is located; our team operates from Mexico, and some providers and data sources operate in the European Union and other countries. Personal data may therefore be processed in the United States, Mexico, the European Union and other countries in which our providers operate. Where we transfer personal data internationally, we use reasonable contractual and technical safeguards designed to protect it consistently with this Policy and applicable law — including, where required, standard contractual clauses or an equivalent transfer mechanism — regardless of where it is processed.

10Data Retention

We keep personal data only for as long as the purpose it was collected for requires, plus any period needed to comply with legal, tax or contractual obligations or to establish or defend legal claims. The periods below are the ones applied by the Service; a shorter period agreed with a customer in writing prevails.

11Account Deletion

A brand administrator may delete the account from the profile page after re-authenticating. Deletion begins immediately, completes in the background, and is irreversible. It permanently erases the account's brands, findings, verdicts, screenshots, captured page content, reports, scan history and the user accounts and integration keys that belong to the account. You receive an email confirming the deletion and the date on which the retained takedown records will be erased.

Three categories outlive the deletion, for the periods in Section 10: the takedown records, including the identity of the user who confirmed each notice, kept in a blocked state for 36 months solely to establish or defend liabilities arising from the notices sent on your behalf; audit-log entries, including the one recording the deletion itself, de-linked from the account; and the original registration request. Everything else is gone.

12Data Security

We apply technical and organizational measures designed to protect personal data, including: transport encryption (TLS) on every connection; encryption of third-party credentials and integration secrets at rest; password hashing with bcrypt; role-based access control enforced on every dashboard and API route and scoped to the brands a user may see; CSRF protection on state-changing requests; session-based authentication with revocation of all sessions on password change; rate limiting on public forms and login; network-level protections against server-side request forgery when the Service fetches third-party content; static analysis and dependency and container scanning in the build pipeline; and audit logging of security-relevant actions.

No system is completely secure. If we become aware of a security incident affecting your personal data, we will notify you and, where legally required, the competent authority, without undue delay and in accordance with applicable law.

13Your Privacy Rights — United States

To the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), applies to Ekos Cyber Labs, California residents have the right to know what personal information we have collected about them, to request its deletion, to request correction of inaccurate personal information, and to opt out of the "sale" or "sharing" of personal information. Veylum does not sell personal information and does not share it for cross-context behavioral advertising, so there is no sale or sharing to opt out of; we honor Global Privacy Control signals as described in Section 7. We do not discriminate against you for exercising any privacy right. The categories of personal information we collect, their sources, the purposes of collection and the categories of recipients are those described in Sections 2, 3, 4 and 8.

Residents of other U.S. states with comparable consumer-privacy statutes hold the equivalent rights recognized under those statutes, to the extent they apply to us, exercisable through the same contact channel.

14Your Privacy Rights — Mexico and Latin America

Where the Service is used by organizations established in Mexico or elsewhere in Latin America, and to the extent the data-protection law of that country applies to our processing, you hold the rights it recognizes — in Mexico, the rights of access, rectification, cancellation and objection (derechos ARCO) and the right to revoke consent under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares; in Brazil, Colombia, Argentina and other countries, the equivalent rights under their statutes — and the right to lodge a complaint with the competent authority. When you exercise cancellation (including by deleting your account), the takedown records described in Section 10 enter a blocking period during which they are kept only to establish or defend liabilities arising from the notices sent on your behalf, and are then suppressed.

15Your Privacy Rights — Other Jurisdictions

If you reside in a jurisdiction not specifically addressed above, including the European Economic Area or the United Kingdom, you may still hold rights of access, rectification, erasure, restriction, portability, and objection under your local law (for example, the GDPR or UK GDPR where applicable to our processing). We will honor requests we are legally required to honor and will otherwise respond to any privacy request submitted through Section 16 on a reasonable-efforts basis.

16How to Exercise Your Rights

You can exercise any of the rights described above by writing to privacy@veylum.ai, or through the support or account-contact channel provided when your account was set up. Tell us which right you are exercising and, where relevant, which data it concerns. We may need to verify your identity before acting on a request, and may decline a request to the extent permitted by applicable law (for example, where it would reveal another individual's personal data, or where the data is retained to establish or defend a legal claim). We respond within the period required by the law applicable to you and, absent a specific requirement, within 30 days; where a request concerns data we process on behalf of a customer, we will refer it to that customer.

17Children's Privacy

The Service is a business-to-business platform intended for use by adults acting on behalf of an organization. It is not directed at, and we do not knowingly collect personal data from, children (as defined under applicable law, generally individuals under 18, or under 13 for purposes of the U.S. Children's Online Privacy Protection Act). If we learn we have inadvertently collected personal data from a child, we will delete it.

18Changes to this Policy

We may update this Privacy Policy to reflect changes to the Service or applicable law. We will post the updated Policy with a new "Last updated" date and, for material changes, provide reasonable advance notice by email or in-product notice before they take effect.

19Contact Us

For any question about this Privacy Policy or to exercise a privacy right, write to privacy@veylum.ai, or use the support or account-contact channel provided when your account was set up. Privacy correspondence may also be sent by mail to Ekos Cyber Labs, LLC, 2810 N Church St STE 90685, Wilmington, DE 19802, United States.