Privacy Policy

1. Your account

At sign-up we keep the username (usually an email address), the password (as a hash, never in plain text), and, if you choose to sign in with Google, the stable identifier of your Google account - never your Google password or other Google data. The profile (display name, time zone) is optional and filled in by you.

The IP address of each sign-in and administrative action is kept in an audit trail, used exclusively for security - for example so you can see where someone signed into your account from.

2. Data from the infrastructure you monitor

The agent you install on your own servers sends health metrics (CPU, memory, disk, processes, open ports), system state (pending updates, failed services, processes killed for lack of memory, SSH sign-in settings, the operating system version) and security events (sign-ins, firewall rules, changed files). It fingerprints the files in your webroot and searches them for backdoor patterns, but it never sends the full contents of files or data from your applications; on a serious finding it attaches only the relevant snippet, as evidence.

If you add a cPanel reseller, we keep the WHM user and API token you save, on the server, and never show them again; we use them only to query your WHM.

How long this data is kept depends on the account plan (see the pricing page) and can be requested for deletion at any time, through the contact form.

3. Security scans

A vulnerability assessment starts ONLY after proof that you own the target and, for intrusive assessments, after the owner signs the rules of engagement. The attestation is recorded, with the date and IP address, alongside the scan report.

4. Cookies and analytics

The public site counts visits with first-party analytics on our own server: anonymously, without cookies and without keeping your IP address, even if you decline the banner.

Public pages also load Ahrefs Web Analytics, a third-party service that counts visits without cookies and without building a visitor profile, whatever you choose in the banner. It is not loaded in the authenticated dashboard.

Only if you accept the banner do we set measurement cookies and additionally load Google Analytics, a third-party service that sets its own cookies and sends data to Google. You can withdraw consent at any time from the page footer.

The authenticated dashboard uses a technical cookie required for Google sign-in (it ties the return from Google to the browser that started it) - not tracking, just how the flow works.

5. Payment

Billing goes through Stripe. Card data never touches our servers - the payment form is a Stripe page. We only keep the Stripe customer identifier and the subscription state.

6. Who we share data with

We do not sell or rent your data. It reaches third parties only where the service actually needs them to function: Stripe for payments; Google for optional Google sign-in and, only with your consent, for Google Analytics; Ahrefs for counting visits to the public site, without cookies; our email provider for notifications and password resets; the language model provider, only when you ask for an AI analysis or ask the assistant something, with the data needed to answer; your browser’s push service, if you enable push notifications; and the Slack or Discord addresses you configure for alerts.

7. Your rights

You can ask us to access, correct or delete your data at any time by writing to us through the contact page. You can change your password yourself at any time, from Settings → My account.

8. Who we are

Valinor is operated by HAPPY LITTLE STEPS S.R.L., registered office at Strada Cobadin 3, ground floor, block P19, entrance 3, apt. 75, Sector 5, Bucharest, Romania, Trade Register no. J40/2156/2018, company registration code (CUI) 38866471, EUID ROONRC.J40/2156/2018. The company is the controller of the data described on this page. You can write to us at any time through the contact page.