How we collect, process, retain and protect personal data — written to satisfy GDPR Articles 13 and 14, UK GDPR and CCPA notice requirements.
Effective June 1, 2026 · Version 1.0.0
This policy is published by Disclos (Sole proprietorship · transitioning to limited company in 2026), jurisdiction Pakistan / European Union. We operate the website at disclos.vercel.app (interim) and the SDKs distributed under @disclos/* on npm.
For the purposes of GDPR Article 4(7), Disclos is the controller of personal data we collect on our marketing site and SDK telemetry, and a processor for audit events that flow through our ingestion pipeline on behalf of our customers.
If you have any concern about how your personal data is being used, write to us at official00980+privacy@gmail.com.
We use personal data only for clearly identified purposes:
We do not sell personal data, ever. We do not share data with advertisers and we do not run third-party advertising trackers.
| Activity | Lawful basis |
|---|---|
| Operating the service for paying customers | Contract — Art. 6(1)(b) |
| Sending essential service emails (security, billing) | Contract — Art. 6(1)(b) |
| Marketing emails to opted-in subscribers | Consent — Art. 6(1)(a) |
| Error tracking, fraud detection, abuse prevention | Legitimate interests — Art. 6(1)(f) |
| Tax, accounting and statutory record keeping | Legal obligation — Art. 6(1)(c) |
Where personal data leaves the European Economic Area, we rely on the European Commission’s Standard Contractual Clauses (2021) together with a Transfer Impact Assessment. Customers may demand EU-only data residency on Enterprise plans.
| Data | Default retention |
|---|---|
| Account records | Lifetime of account, then 90 days |
| Audit events (ingestion) | 13 months hot · 7 years cold (R2) |
| Operational logs (HTTP, DB) | 30 days |
| Error reports (Sentry) | 90 days |
| Email correspondence | 3 years from last contact |
| Billing records | 10 years (statutory) |
Under GDPR (and equivalent regimes), you have the right to:
To exercise any of these, email official00980+privacy@gmail.com. We respond within 30 days as required by Article 12(3).
We take a defence-in-depth approach. Highlights:
If you discover a vulnerability, please email official00980+security@gmail.com before public disclosure. We respond within 72 hours.
Disclos is a business tool. We do not knowingly process personal data of anyone under 16. If you believe a child has registered, write to us at official00980+privacy@gmail.com and we will delete the account.
Disclos uses AI internally to (1) suggest risk classifications during onboarding, (2) polish customer-written descriptive text in compliance documents, and (3) analyse public web pages submitted to the free scanner. None of these systems makes solely automated decisions that produce legal or similarly significant effects on you within the meaning of GDPR Article 22.
A complete machine-readable inventory of every AI system we operate is published at /ai-disclosures in accordance with EU AI Act Article 50.
We notify registered customers by email at least 30 days before any material change. Non-material changes (typo fixes, clarifications) take effect on publication.