Privacy Policy
Version: privacy-2026-10
Effective date: 2026-10-19
Applies to: athelos.pro (marketing site) and ATHELOS Cloud / ATHELOS Dedicated (the application).
1. Who We Are
ZERODIN ("we", "us") operates ATHELOS, a cybersecurity consultancy platform. For the purposes of the GDPR, ZERODIN is:
- Data controller of the personal data described in §3 and §4 that relates to your account, your use of the service, and the marketing site.
- Data processor of any personal data you enter into the application about your own clients (see §6 and the Data Processing Agreement).
Contact: privacy@athelos.pro
Data Protection Officer: Under Article 37 GDPR, ZERODIN is not required to appoint a DPO. Data protection questions can be sent to the address above.
2. What This Policy Covers — and What It Doesn't
This policy explains what personal data we collect, why we collect it, how long we keep it, who we share it with, and what rights you have.
It covers two distinct surfaces:
- The marketing site at
https://athelos.pro— public pages, pricing, documentation. - The application at
https://<tenant>.athelos.pro— the ATHELOS Cloud and Dedicated product.
What we do NOT do — and this is verifiable in our source code:
- No analytics of any kind (no Google Analytics, Plausible, Umami, PostHog, Segment, Mixpanel).
- No telemetry from the application back to us.
- No third-party tracking scripts on the marketing site.
- No advertising cookies, no advertising identifiers, no ad networks.
- No cloud AI processing of your data — AI features use a local Ollama model that runs on the same infrastructure as the application.
These are not aspirational marketing statements. They are facts about how the service is built.
3. Personal Data We Collect — Marketing Site
If you visit https://athelos.pro without creating an account:
| Category | What | Why | Legal basis |
|---|---|---|---|
| Server logs | IP address, user agent, referrer, requested URL, timestamp | Security, abuse prevention, debugging | Art 6(1)(f) — legitimate interest |
Cookies on the marketing site: only strictly necessary cookies required by the framework for the site to function. No marketing, analytics, or preference cookies are set. Because we do not use analytics or trackers, there is no cookie banner requirement for the marketing site under the ePrivacy Directive (only strictly necessary cookies are used).
4. Personal Data We Collect — Application
When you create an account and use ATHELOS, we process:
4.1 Account and authentication data
| Category | What | Why | Legal basis |
|---|---|---|---|
| Identity | Email address, name | Account creation, login, communication | Art 6(1)(b) — contract |
| Credentials | Password hash (Argon2id), TOTP secret (encrypted), WebAuthn public keys | Authentication, MFA | Art 6(1)(b) — contract |
| Recovery | Recovery codes (hashed) | Account recovery | Art 6(1)(b) — contract |
| Session | Session identifier, user ID, expiry time | Keep you logged in | Art 6(1)(b) — contract |
Sessions do not store IP addresses or user agents. The session record is limited to the session ID, the user ID, and the expiry timestamp.
4.2 Audit and security data
| Category | What | Why | Legal basis |
|---|---|---|---|
| Authentication events | Action (login, TOTP enrollment, WebAuthn registration), entity, timestamp | Security monitoring, incident detection, GDPR Article 30 record-keeping | Art 6(1)(f) — legitimate interest; Art 6(1)(c) — legal obligation |
| IP address | Recorded with each audit event | Security investigation, abuse prevention | Art 6(1)(f) — legitimate interest |
We record the IP address at which security-sensitive actions occur. This is standard practice for security incident investigation and is used only for that purpose.
4.3 Business data you enter
You may enter data about your clients and their personnel into ATHELOS:
| Category | What | Why | Legal basis |
|---|---|---|---|
| Client records | Names, emails, job titles, company details | Providing the service you requested | Art 6(1)(b) — contract |
| Engagement data | Scope, findings, evidence, reports | Providing the service you requested | Art 6(1)(b) — contract |
| Delivery tracking | IP address, user agent when a client views a delivery link | Security, abuse prevention, tracking delivery receipt | Art 6(1)(f) — legitimate interest |
| Lab and learning activity | Activity logs, IP address, user agent | Functional record of your own usage | Art 6(1)(b) — contract |
When you enter data about your own clients, you are the data controller of that data and we are the data processor. The Data Processing Agreement (dpa-2026-10) governs our processing of that data on your instructions.
4.4 Billing data
| Category | What | Why | Legal basis |
|---|---|---|---|
| Subscription | Plan, subscription ID, status, current period | Billing, subscription management | Art 6(1)(b) — contract |
| Payment | Payment method (held by Stripe, never by us), invoice records | Payment processing, tax compliance | Art 6(1)(c) — legal obligation |
We never see your payment card data. All card entry and storage are handled by Stripe on Stripe-hosted pages.
5. Why We Process Personal Data — Legal Bases
Every processing activity above rests on one of the following legal bases:
- Contract (Art 6(1)(b)): to provide the service you requested — creating your account, authenticating you, storing the data you enter, delivering reports to your clients, processing your subscription.
- Legal obligation (Art 6(1)(c)): tax and accounting records, GDPR records of processing, breach records.
- Legitimate interest (Art 6(1)(f)): security monitoring, abuse prevention, incident investigation. Our legitimate interest in these cases is preventing harm to you, to other customers, and to the service. We have assessed that this interest is not overridden by your rights because the data involved (IP addresses in audit logs, delivery view logs) is limited, is used only for security, and is retained only as long as needed.
- Consent (Art 6(1)(a)): we do not currently rely on consent for any processing. We do not send marketing emails, we do not use tracking cookies, and we do not sell data.
6. When You Enter Data About Your Own Clients
When you use ATHELOS to record information about your own clients (names, emails, findings about their systems, etc.), you are the controller of that data and ZERODIN acts as your processor. The Data Processing Agreement (dpa-2026-10) governs that processing relationship. The sub-processors we engage are listed in docs/legal/SUB-PROCESSORS.md (subprocessors-2026-10).
You are responsible for having a lawful basis to enter your clients' data into ATHELOS, and for responding to your clients' data subject rights requests. We assist you with those requests as described in the DPA (§9).
7. Who We Share Personal Data With
We share personal data only with sub-processors that are necessary to run the service, and only to the extent needed. Our current sub-processors are:
| Sub-processor | Purpose | Location | Safeguards |
|---|---|---|---|
| Hetzner Online GmbH | Compute — hosts the application and databases | EU (Germany, Finland) | Intra-EU; no SCCs needed |
| Backblaze, Inc. | Offsite encrypted backup storage | USA | EU SCCs (Module Two) |
| Cloudflare, Inc. | DNS for athelos.pro and *.athelos.pro | Global edge | EU SCCs (Module Three); proxied: false so traffic does not pass through Cloudflare |
| Stripe | Payment processing | EU (Ireland) for EU customers; USA for non-EU | Intra-EU or SCCs; Stripe is PCI-DSS Level 1 certified |
| Postmark (ActiveCampaign, LLC) | Transactional email (verification, notifications) | USA | EU SCCs (Module Two); Postmark's DPA is available in the Postmark dashboard |
The full sub-processor list, including the SMTP provider's pending status, is maintained at docs/legal/SUB-PROCESSORS.md and is updated with 30 days' notice when a new sub-processor is added.
We do not sell personal data. We do not share personal data with advertisers, data brokers, or any party not listed above.
We may disclose personal data if required by law (for example, a valid court order or a legal obligation under Irish or EU law), but only to the extent required.
8. International Transfers
Personal data may be transferred outside the European Economic Area when it is processed by a sub-processor located outside the EEA. Where this happens, the transfer is protected by appropriate safeguards:
- Backblaze (USA): EU Standard Contractual Clauses, Module Two (controller-to-processor).
- Cloudflare (USA for DNS configuration): EU Standard Contractual Clauses, Module Three (processor-to-processor).
- Stripe (non-EU customers): EU Standard Contractual Clauses.
For EU customers, Stripe processing happens in Ireland via Stripe Payments Europe, Ltd. and does not involve an international transfer.
The full transfer arrangements are documented in the Data Processing Agreement (dpa-2026-10, §13).
9. How Long We Keep Personal Data
Retention periods are governed by the Data Retention & Deletion Policy (docs/legal/RETENTION.md, version retention-2026-10). In summary:
| Category | Retention |
|---|---|
| Active account data | Indefinite — you own it, we keep it while you use the service |
| Data after cancellation | 30 days, then deleted |
| Data after suspension | 90 days, then deleted |
| Abandoned signup data | 7 days, then deleted |
| Audit logs (including IP addresses) | 7 years (GDPR Article 30 record-keeping) |
| Billing records | 7 years (tax and accounting obligation) |
| Webhook events | 90 days |
Deletion is executed by an automated worker job that removes the tenant's database, object storage, search index, DNS record, and control-plane records. Each deletion is recorded in an audit log keyed by a salted hash of the tenant ID — never the plaintext ID — so the deletion can be proven without retaining personal data.
10. Your Rights
Under the GDPR, you have the following rights:
- Access (Article 15): obtain a copy of the personal data we hold about you.
- Rectification (Article 16): correct inaccurate personal data.
- Erasure (Article 17): request deletion of your personal data, subject to legal retention obligations.
- Restriction (Article 18): ask us to restrict processing while a dispute is resolved.
- Portability (Article 20): receive your personal data in a machine-readable format, or have it transmitted to another controller.
- Object (Article 21): object to processing based on legitimate interest.
- Withdraw consent (Article 7(3)): withdraw any consent you have given. This does not affect the lawfulness of processing that occurred before withdrawal.
How to exercise your rights: email privacy@athelos.pro from the email address associated with your account, or from an address we can verify as authorized to act on your behalf. You can also export or delete your data from the application's settings.
Response time: we respond within 30 days. If the request is complex, we may extend by a further 60 days and will inform you.
Fee: the first request is free. We may charge a reasonable fee for manifestly unfounded or excessive requests, in accordance with Article 12(5).
11. Right to Lodge a Complaint
If you believe we have not handled your personal data in accordance with the GDPR, you have the right to lodge a complaint with a supervisory authority. Because our data protection governing law is Ireland, the lead supervisory authority is:
Data Protection Commission (Ireland) 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland Website: https://www.dataprotection.ie Phone: +353 578 684 800
You may also lodge a complaint with the supervisory authority in the EU member state where you live or work, or where you believe the infringement occurred.
We would prefer you contact us first at privacy@athelos.pro — many issues can be resolved faster that way.
12. Cookies and Tracking
Marketing site (athelos.pro)
Only strictly necessary cookies. No analytics, no advertising, no tracking. See §2.
Application (<tenant>.athelos.pro)
| Cookie | Purpose | Duration | Category |
|---|---|---|---|
authjs.session-token | Session authentication | Session or per NextAuth config | Strictly necessary |
authjs.csrf-token | CSRF protection | Session | Strictly necessary |
The session cookie carries only the session identifier. It does not carry IP address, user agent, or any tracking identifier. Sessions are stored server-side and are deleted on logout or on expiry.
Do Not Track
Because we do not track, we do not need to honor DNT signals — there is no tracking to opt out of.
13. Automated Decision-Making
The service does not perform automated decision-making that produces legal effects or similarly significantly affects you within the meaning of Article 22 GDPR.
The AI features in ATHELOS (Ollama-based model running on the same infrastructure) are assistive: they suggest, summarize, or draft content that you then review and decide whether to use. They do not make decisions about you or your clients. They do not process data from other tenants, and they do not send data to any third-party model provider.
14. Children's Data
ATHELOS is not intended for use by anyone under 16. We do not knowingly collect personal data from children. If we learn that a child under 16 has provided personal data, we will delete it.
15. Changes to This Policy
We may update this policy. Material changes will be announced by email to the account owner at least 30 days before they take effect. The version number at the top of this document is authoritative — the current version is always published at https://athelos.pro/privacy.
If you disagree with a change, you may terminate per §12 of the Terms of Service.
16. Contact
- Privacy and data protection:
privacy@athelos.pro - Security matters:
security@athelos.pro - Commercial and legal:
legal@athelos.pro
Version History
| Version | Date | Change |
|---|---|---|
privacy-2026-10 | 2026-10-19 | Initial Privacy Policy. |