Privacy Policy
Last updated 14 October 2026
This is a small, single-operator service. Where this policy names "we" or "us", it means one person — see Who we are below — not a department. If anything here is unclear, the fastest way to get an answer is to write to the address at the bottom of this page.
Who we are
Glarion is operated by Aurelio Avila, trading as an individual at this stage rather than through a registered company. For the purposes of data protection law, Aurelio Avila is the data controller for the personal data described below.
What we collect, and why
| Data | Why |
|---|---|
| Name, email address, date of birth, password (stored as a hash, never in plain text) | To create and secure your account, and to confirm you are old enough to hold a paid contract. |
| Business name and logo, if you add them | To put your identity, not ours, on the reports you send to your clients. |
| The domains you add, and any client name you attach to them | To run the scans and reports you ask for. This is data about your clients' sites, which you control — see Acting on your behalf. |
| IP address and browser identifier at the moment you authorize a scan | Recorded permanently as evidence of who authorized a scan against a domain and when. This is the record that protects both of us if a scan is ever disputed — see Retention for why it outlives the rest of your account. |
| If you start a free trial: a one-way hash of your email address, and Stripe's fingerprint of the card you add | To allow one free trial per person. The hash cannot be turned back into your address, and the fingerprint is a reference Stripe gives us to recognise the same card on another account — never the card number. |
| Payment details | Never collected by us. Checkout and billing are handled entirely by Stripe — see Who else touches your data. |
The legal basis for each
- Account, scanning, and billing data — necessary to perform the contract you enter by creating an account (Article 6(1)(b) GDPR).
- Date of birth — a legal obligation, since a contract cannot be entered into with a minor (Article 6(1)(c)).
- The free-trial record (email hash, card fingerprint, trial dates) — our legitimate interest in offering a free trial without it being started again and again by the same person (Article 6(1)(f)).
- The scan-authorization record (IP address, browser identifier, timestamp) — our legitimate interest in being able to prove who authorized a scan, which is also the legal basis the law allows us to keep it on after you delete your account (Article 6(1)(f) and Article 17(3)(e)).
Acting on your behalf
The domains you add and the findings a scan produces are, legally, your data or your client's — we process it because you asked us to, not because we have a use for it of our own. We do not scan a domain you have not proven you control, and we do not sell, share, or use scan results for anything beyond running the product you asked for.
Who else touches your data
| Service | What it handles |
|---|---|
| Supabase (Postgres, EU region) | Stores the account and scan data described above. |
| Fly.io | Runs the application. |
| Stripe | Processes payment and stores payment details — we never see a card number. |
| Cloudflare | Provides DNS for glarion.app and cookieless Web Analytics (aggregate page views and load performance). |
| Resend | Delivers transactional email (confirmation links, scan notifications). |
| ProjectDiscovery Nuclei (open-source, run on our own servers) | Performs the scan itself; nothing is sent to a third party by the scanner. |
We do not use advertising cookies or send channel labels to advertising providers. See Cookies and measurement for the aggregate counters we use.
Retention
Your account data is kept for as long as the account exists. If you delete your account, your name, email, date of birth, and password are permanently overwritten within the same request — see Deleting your account.
The scan-authorization record described above is the one exception. It is kept after deletion, stripped of everything except the fact that an account authorized this scan on this date from this address — the law explicitly allows keeping exactly this much, for exactly this reason (Article 17(3)(e)).
The free-trial record is kept after deletion too, on the same legitimate interest: otherwise deleting an account would be a way to start the same trial again. It holds no address and no card number.
Deleting your account
From Settings, "Delete my account" removes your name, email, date of birth, business identity, and password immediately and irreversibly. A subscription has to be cancelled first, from Manage billing — we do not cancel it for you as a side effect of deletion, for the same reason cancelling always goes through Stripe's own portal rather than a button here.
Your rights
Under GDPR you can ask us to:
- Send you a copy of the personal data we hold about you.
- Correct anything that is wrong — most of this you can already edit yourself in Settings.
- Delete your account, as above.
- Object to how we use your data, where our legal basis is legitimate interest.
Write to the address below for any of these. If you are not satisfied with the answer, you can complain to the Garante per la protezione dei dati personali, the Italian data protection authority.
Cookies and measurement
A first-party, HttpOnly session cookie keeps you signed in. Browser storage also supports sign-in state, carrying your entered domain into setup and remembering a selected plan for up to seven days. We do not set advertising cookies.
We count page views, public-check outcomes, new registrations and successful domain verifications by day and channel. These counters contain no IP address, email, domain, account ID, full referring URL or unique visitor identifier. They count operations, not individual people. Security logs are separate.
A channel label (such as YouTube or DEV) is kept in session storage for the current browser tab. Measurement is skipped when Do Not Track or Global Privacy Control is enabled, or browser storage is unavailable. To disable it for this tab, open Glarion with measurement off. No channel label is sent to an advertising provider.
We also use Cloudflare Web Analytics, which sets no cookies and does not fingerprint visitors, to see aggregate page views, referrers and page-load performance. Its script is not loaded when Do Not Track or Global Privacy Control is enabled.
Changes to this policy
If this changes in a way that matters — a new sub-processor, a change to what we collect — we will say so here and update the date at the top.