Privacy Policy

1. Introduction

This Privacy Policy explains which personal data InfraFence (infrafence.com, its dashboard, API and agent) processes, why, and your rights under the General Data Protection Regulation (EU) 2016/679 ("GDPR").

2. Controller

The controller is ComCart S.r.l., Via Giacomo Matteotti 43, 47043 Gatteo (FC), Italy, VAT IT04412340400. Contact: info@infrafence.com.

3. Data we process

• Account: name, email, company (optional), password (stored only as a hash), two-factor authentication settings, the organizations you belong to and your role, and a log of the changes you make.
• Servers: hostname, IP address, operating system, resource metrics (CPU, memory, disk, network) and the security events the agent reports: addresses of attackers, attack type and time, for a web attack the single log line that triggered it, for malware the file path and the matched text, accounts and addresses of SSH sessions. Full logs and files never leave your server.
• Billing: handled by Stripe. We don't receive your full card number; we receive the billing name, address and VAT number needed for invoices, and the subscription status.
• Technical: our servers keep request logs (address, time, page) for security and troubleshooting. We don't use analytics or tracking tools.

Addresses of attackers are processed for the security of networks and services, which is a legitimate interest recognized by Recital 49 GDPR.

4. Why we use it

• to provide the Service: detection, protection, the dashboard and its settings
• to send the alerts and summaries you configure, and service notices
• to analyse an incident with AI, only when you ask for it
• to bill subscriptions and meet tax obligations
• to keep the platform secure, prevent abuse and improve the Service

5. Legal bases

• Contract (Art. 6(1)(b)): providing the Service you signed up for.
• Legitimate interest (Art. 6(1)(f)): network and information security, preventing abuse, improving the Service.
• Legal obligation (Art. 6(1)(c)): invoicing and tax records.
• Consent (Art. 6(1)(a)): only where we ask for it, for example optional communications; you can withdraw it at any time.

6. Who receives data

• Stripe, for payments and invoices.
• Our hosting provider, Contabo GmbH, which runs the servers of the dashboard and its database in Germany.
• Our email delivery provider, for alerts, summaries and account emails.
• An AI provider, only when you request an AI incident analysis: it receives that incident's details and your notes.
• The destinations you configure for alerts (Slack, Discord, Telegram, your webhooks).
• The InfraFence network, only if you turn it on: the addresses that attacked your servers are pooled with other customers', and an address is shown to others only after several organizations saw it. Nothing about your servers, users or files is shared.

Aggregated network statistics: we compute anonymous statistics of the attacks seen across all servers (countries, attack types, ports, trends) and show them to every customer. They never include customer names, hostnames or server addresses, and a figure is shown only when at least 3 organizations contribute to it.

We never sell or rent personal data.

7. Retention

• Account data: while the account is active. When the account is deleted, its data is erased within 30 days, or right away if you ask.
• When an account stops paying, its paid features stop 72 hours after the failed payment; its data is kept until the account is deleted.
• Security events: 30 days on Starter, 90 days on Pro.
• Server metrics: 14 days.
• AI analyses: 1 year.
• The activity and audit log: 1 year, also after the account is deleted.
• Expired bans: 1 year (repeat offenders are banned for longer).
• Invoices: 10 years, as Italian law requires. After the account is deleted they keep only the organization's name and VAT number.
• The agent installed on your servers is not removed when the account is deleted: it keeps running until you uninstall it.

8. Your rights

You can ask to access, correct or delete your data, to receive it in a portable format, to restrict its processing or to object to it, and withdraw consent where we rely on it. Write to info@infrafence.com; we answer within 30 days. You can also complain to the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or to the authority of your country.

9. Cookies and browser storage

The dashboard keeps your sign-in session and your language choice in your browser's storage; both are strictly necessary for the Service. We use no tracking, advertising or analytics cookies, and fonts are served from our own domain.

If we turn on Google Analytics or Google Ads on the public site, they run only with the consent you give or refuse in the cookie banner: the Cookie Policy at infrafence.com/cookies lists every cookie and how to change your choice.

10. International transfers

Our servers are in the European Union (Germany). Stripe and the AI provider may process data outside the EU; such transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.

11. Security

Connections are encrypted (TLS), passwords and agent tokens are stored only as hashes, payment and email credentials are encrypted in the database, two-factor authentication is available to every user and enforced by the database once enabled, and agent releases are signed. No system is perfectly secure, but we apply technical and organizational measures appropriate to the risk.

12. Children

The Service is not meant for people under 18 and we don't knowingly collect their data. If you think we did, write to info@infrafence.com and we will delete it.

13. Changes

We may update this policy. We will email account owners about material changes and update the date at the top of this page.

14. Contact

ComCart S.r.l., Via Giacomo Matteotti 43, 47043 Gatteo (FC), Italy, VAT IT04412340400 — info@infrafence.com