privacy
what we collect, and why.
This is what happens to your data when you connect Stripe, and your app, to Entitled. For the technical constraints that enforce it, see the security page and the data processing agreement.
Updated 27 September 2026.
What we collect
From Stripe
Customer id, email, and account creation date, plus, for each subscription, its id, status, plan or product name, price id, period end date, and whether it is set to cancel, read with a restricted key that cannot write and cannot see card details. The encrypted snapshot kept for a run holds exactly that set (see the DPA for the full list), nothing more of the original Stripe object.
From your app
Only the one column you mapped (a boolean, a status, or a plan name) for each customer, read through your endpoint or your own Postgres database. Nothing else in your app or your database is read or stored.
Account
The email address you give to claim a scan, so we can send the link back to your report, alerts if you subscribe to Watch, and receipts for a paid plan.
Site analytics
Visits to this site are counted with Umami, self-hosted on our own server. No third party receives them, and it sets no cookies. We can see which page was viewed and which button, link or campaign brought someone here, but not who they are: claim and unsubscribe tokens and report ids are stripped from the address before anything is recorded, and everything in the address except that arrival information is dropped. Events carry a page name and at most the plan bought, never an email address or anything read from Stripe or your app.
Using your saved report
If you save a report, we record when you use it: viewing it, signing in, saving settings, reviewing a finding. That is how we tell whether the product is actually helping, and how we improve it. This is separate from the anonymous site analytics above: it is tied to your report, visible only to us, and never shown to anyone else who opens the same link.
Why we collect it
To compare who paid in Stripe against who has access in your app, and to show you where the two disagree. The account email exists so a scan you ran anonymously has a way back to you. Analytics tells us which pages are read, nothing about who reads them.
Where it is stored
On one server in Frankfurt, Germany, inside the EU. Your Stripe key and database or endpoint credentials are sealed with a per-secret key that is itself wrapped under a master key pair split across two processes: the web app holds only the public half and can seal a credential but cannot open one. Only the worker, holding the private half, can decrypt. There is deliberately no way for the web app to read a secret back out, not a permission it simply doesn’t use.
How long we keep it
An open disagreement is kept for as long as it stays open: that is the current answer to the question you are paying for. Once a finding is resolved, it and its history are removed after the plan’s history window (0 days on the free scan, 7 days on the audit, 365 days on Watch). A cleanup runs automatically once a day and removes anything past this window; see the DPA for the exact timing.
Deletion
One button on your report deletes the sealed credentials, the snapshot, and every finding and its history at once, immediately, nothing held back for later.
Before that happens, we keep one anonymous record: how far you got (connected, scanned, claimed, paid), how many scans ran, how many findings were still open, and, if you choose to say, why you left. It carries no email address, no report contents, and nothing that identifies you or this report once it is gone.
Payments
Polar is the merchant of record for the $49 audit and the $99/year Watch subscription. Your card details are handled by Polar and its payment processor; we never receive or store them.
Subprocessors
Stripe
Source of billing and subscription data, read through a restricted key you create and can revoke at any time.
Resend
Sends the claim link back to your report, and Watch alerts and weekly summaries, by email.
Polar
Processes payment for the $49 audit and the $99/year Watch subscription. Polar is the merchant of record; we never see your card number.
DigitalOcean
Hosts the web app, the worker, and the database on one server in Frankfurt (fra1), Germany.
Your rights
You can ask what we hold on you, export a report as a copy of its data, or delete it, at any time. Export and delete are both available directly from your report page; for anything else, or if you no longer have the link, email support@entitled.dev.
Contact
This policy is issued by Entitled. For anything on this page, write to support@entitled.dev.