Security and data
How Privara handles your data
Postgres on Render, one database for Privara, every row scoped to its workspace; requester details encrypted with AES-256-GCM.
What Privara holds
- Websites' public pages as a browser sees them (requests, cookie names and lifetimes, storage key names)
- Team members' names and email addresses
- Privacy requesters' names, email addresses and messages (encrypted at rest)
- Data inventory and records of processing the team enters
How long it’s kept, and how to export or delete it
Kept until the workspace deletes it; unconfirmed requests close after 30 days; no-account /try scans are deleted within 24 hours.
The full detail is in Privara’s data export and deletion policy.
Who processes it
Service providers (subprocessors), each on our instructions and only for the purpose shown:
- Render: hosting, databases and backups, in the United States.
- Stripe: subscription and license payments (card details go to Stripe, never to us).
- Resend: sending confirmation links and your approved replies to requesters.
- Anthropic: drafting data inventory descriptions from vendor names, and tidying reply wording when asked.
Questions and security reports
Privara is run by New Odyssey. To ask what we hold about you, to have it exported or deleted, or to report a security problem, email clio@new-odyssey.com. The privacy policy covers the rest.