Valters Capital, SIA ("we", "us", "our") operates the ValtersIT Hub API platform at api.valtersit.com ("Service"). This Privacy Policy covers api.valtersit.com only. The public website at valtersit.com is covered by its own, separate Privacy Policy.
This Policy explains how we collect, use, store, and protect your personal data, and what rights you have under the EU General Data Protection Regulation (GDPR) (Regulation 2016/679) and applicable Latvian data protection law.
We are committed to processing your personal data lawfully, transparently, and only for the purposes described in this Policy.
If you have questions, contact us at: https://www.valtersit.com/contacts/
This Policy applies to:
If you are a business user providing us with personal data of your employees or end users, you are responsible for ensuring you have a lawful basis to share that data with us.
When you create an account, we collect:
| Data | Purpose | Legal Basis |
|---|---|---|
| Email address | Account identification, communications | Contract (Art. 6(1)(b)) |
| Password (bcrypt hashed — never stored in plain text) | Authentication | Contract (Art. 6(1)(b)) |
| 2FA secret (encrypted) | Account security | Contract (Art. 6(1)(b)) |
| Registration timestamp | Security, audit | Legitimate interest (Art. 6(1)(f)) |
| Last login timestamp | Security monitoring | Legitimate interest (Art. 6(1)(f)) |
We do not collect your name, physical address, or phone number unless you voluntarily provide it in a support request.
Payment processing is handled by Stripe, Inc. We do not store card numbers, bank details, or full payment information. We store:
| Data | Purpose | Legal Basis |
|---|---|---|
| Stripe Customer ID | Link payments to your account | Contract (Art. 6(1)(b)) |
| Subscription plan and status | Service delivery | Contract (Art. 6(1)(b)) |
| Credit balance and transactions | Service delivery, dispute resolution | Contract (Art. 6(1)(b)) |
| Payment timestamps | Accounting, legal obligations | Legal obligation (Art. 6(1)(c)) |
| Invoice data | Tax and accounting compliance | Legal obligation (Art. 6(1)(c)) |
Stripe's privacy policy: https://stripe.com/privacy
When you use the API, we collect:
| Data | Purpose | Legal Basis |
|---|---|---|
| API endpoint called | Billing (credit consumption) | Contract (Art. 6(1)(b)) |
| Query parameters (filters used) | Usage analytics, billing | Contract (Art. 6(1)(b)) |
| Timestamp of request | Rate limiting, audit | Legitimate interest (Art. 6(1)(f)) |
| IP address | Rate limiting, fraud prevention, security | Legitimate interest (Art. 6(1)(f)) |
| User agent string | Security monitoring | Legitimate interest (Art. 6(1)(f)) |
| Credits consumed | Billing | Contract (Art. 6(1)(b)) |
| Response cached (yes/no) | Billing accuracy | Contract (Art. 6(1)(b)) |
We do not store the content of API responses in your request log — only metadata about the request.
For Standard and Pro subscribers, we store:
This data is used solely to provide the "CVE History" and "Updated" notification features. If your Subscription ends (cancellation, failed renewal, or plan switch to Pay-As-You-Go), this data becomes inaccessible to you and is retained for 35 days in case you resubscribe. After 35 days, the detailed content above (queried CVE IDs' snapshot data and hashes) is permanently erased. A minimal record — that an account tracked a given CVE ID, and when — is retained indefinitely afterward for audit and legal-compliance purposes (e.g. responding to billing disputes).
For Pro subscribers, we store webhook URLs you configure. These may contain personal data if you include identifying information in your webhook URL. We recommend using non-identifying webhook endpoints.
We store:
Sessions expire after 30 days of inactivity. All sessions are invalidated on password change.
Our servers automatically collect:
These logs are retained for 30 days for security purposes.
For fraud detection, we associate pseudonymous canary markers with API keys. If canary data is accessed externally, we log the triggering IP and timestamp to detect API key leakage. This data is minimized and not linked to any other personal data beyond your account.
If you contact us via https://www.valtersit.com/contacts/ or email, we collect:
This data is retained for 2 years to enable ongoing support and dispute resolution.
We may use privacy-respecting analytics (without cookies or third-party tracking) to understand aggregate traffic patterns. No personal data is shared with third-party analytics providers.
We use your personal data only for the purposes listed above. Specifically:
We do not:
We share your data only with:
| Recipient | Data Shared | Purpose | Location |
|---|---|---|---|
| Stripe, Inc. | Email, billing events | Payment processing | USA (SCCs apply) |
| Hetzner Online GmbH | Server data (infrastructure) | Hosting | Germany/EU |
| GitLab B.V. | Code repository (no customer data) | Development | EU |
| Google LLC (Gmail SMTP) | Email address, email content (account verification, password reset/changed, purchase and payment confirmations, security notifications) | Transactional email delivery | USA (Google Workspace; EU-US Data Privacy Framework / SCCs apply) |
Stripe and US data transfers: Stripe is certified under the EU-US Data Privacy Framework. Where required, we rely on Standard Contractual Clauses (SCCs) for transfers to the US.
We do not use any other third-party services that process your personal data beyond those listed above. We do not use Google Analytics, Facebook Pixel, or similar tracking tools.
If we are required by law to disclose your data (e.g., court order, law enforcement request), we will notify you where legally permitted to do so.
| Data Category | Retention Period |
|---|---|
| Account data (active account) | Duration of account |
| Account data (closed account) | 90 days post-closure, then deleted |
| Billing records and invoices | 5 years (Latvian accounting law) |
| Credit transaction history | 5 years (accounting/tax) |
| API request logs | 12 months (the IP address and user-agent on each log entry are anonymized after 90 days; the entry itself, without those identifying fields, is kept longer for usage/billing accuracy) |
| CVE history data (detailed: snapshots, hashes) | 35 days after Subscription ends, then erased |
| CVE history data (minimal: which CVE ID, when) | Retained indefinitely for audit/legal-compliance purposes |
| Session data | 30 days from creation or until revoked |
| Server access logs | 30 days |
| Support communications | 2 years |
| Email verification tokens | 24 hours |
| Password reset tokens | 1 hour |
When retention periods expire, data is permanently deleted or anonymized.
We implement the following technical and organizational measures:
Technical measures:
Organizational measures:
Despite these measures, no system is 100% secure. In the event of a data breach affecting your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours as required by GDPR Article 33-34.
api.valtersit.com uses one httpOnly, Secure, SameSite=Strict cookie for authentication (refresh token). This cookie:
We do not require cookie consent for technically necessary cookies under GDPR Recital 47 and ePrivacy Directive Article 5(3).
If we add any non-essential cookies in future, we will update this Policy and implement appropriate consent mechanisms.
As a data subject, you have the following rights:
You may request a copy of all personal data we hold about you.
You may correct inaccurate personal data. You can update your email and password directly in your account settings.
You may request deletion of your personal data. We will delete your data within 30 days, except where we are required to retain it by law (e.g., billing records for accounting purposes).
You may request that we restrict processing of your data in certain circumstances.
You may request your personal data in a structured, machine-readable format. We will provide your account data, API usage history, and transaction history in JSON format.
You may object to processing based on legitimate interest (e.g., security logging). We will assess whether our legitimate interests override your rights.
Where processing is based on consent (if applicable), you may withdraw consent at any time without affecting the lawfulness of prior processing.
We do not engage in automated decision-making or profiling that produces significant legal effects.
To exercise your rights: Contact us at https://www.valtersit.com/contacts/. We will respond within 30 days. We may ask you to verify your identity before fulfilling your request.
If you believe we have processed your personal data unlawfully, you have the right to lodge a complaint with:
Latvian Data State Inspectorate (Datu valsts inspekcija):
Website: https://www.dvi.gov.lv
Email: info@dvi.gov.lv
Address: Blaumaņa iela 11/13-15, Rīga, LV-1011, Latvia
You also have the right to lodge a complaint with the data protection authority of your EU member state of residence.
Our Service is not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will delete it promptly.
We may update this Privacy Policy to reflect changes in our practices or applicable law. We will notify registered users of material changes via email at least 30 days before they take effect. The "Last updated" date at the top of this Policy will always reflect the most recent version.
Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.
For any privacy-related questions, requests, or concerns:
Valters Capital, SIA
Anninmuizas Bulvaris 41 - 87, Latvia, Riga, LV-1067
https://www.valtersit.com/contacts/
We aim to respond to all privacy inquiries within 5 business days.
This Privacy Policy was drafted in accordance with GDPR (Regulation 2016/679), the Latvian Personal Data Processing Law (Fizisko personu datu apstrādes likums), and the ePrivacy Directive (2002/58/EC).