Privacy policy

This policy explains which personal data IKANGAI Security Alerts processes, why, and what rights you have. As of November 2026.

Who is responsible

IKANGAI e.U., Martin Treiber
Blütengasse 8, 8010 Graz, Austria
office@ikangai.com, +43 699 17308210

For questions about your data, write to office@ikangai.com.

What we process and why

Your account. Your email address, your language, your email setting, your plan and when the account was created. We need them to log you in and send you alerts (Art. 6(1)(b) GDPR, contract).

Logging in. When you ask for a login link, we store a fingerprint of the link (never the link itself), your email address, your IP address and a random identifier of your browser, so we can limit login emails and ask for a code when the link is opened elsewhere. These entries are deleted after one day. If someone tries too often, the IP address also appears in our error log (Art. 6(1)(f) GDPR, our legitimate interest in protecting the service and other people's inboxes).

Your setup. The software, devices and services you list, versions you add, what we think each runs on and who looks after it, your conversation with the assistant (its last 40 entries), and the status and notes of your to-dos. This is the service itself (Art. 6(1)(b) GDPR). Please don't enter passwords or other secrets in the chat or in notes.

Connected websites and servers. If you connect a WordPress site, it sends us its WordPress version and the names and versions of its plugins and themes. If you connect a Linux server, it sends us its system version and the names and versions of its installed packages. No content, user accounts or passwords. We keep the latest report and when it arrived (Art. 6(1)(b) GDPR).

Payments. For the Pro plan, payment is handled by Stripe. We keep only Stripe's customer and subscription numbers and your plan, not your payment details. Invoices are kept for seven years, as Austrian tax law requires (Art. 6(1)(c) GDPR).

What learning from others means

To judge whether a problem really affects you, the service also considers what most other people with the same match marked ("fixed" or "doesn't apply"). It only uses this once at least 10 accounts have that match, and never passes on counts, names, notes or anything else about who they are. Product names typed into the "Add" box are remembered without any link to you, so the next person typing the same thing gets the answer straight away.

Cookies

We use two cookies, both needed for logging in, and no tracking, analytics or advertising:
- "sid" keeps you logged in, for 30 days or until you log out.
- "browser" recognises the browser that asked for a login link, for 15 minutes.
Strictly necessary cookies do not need consent (§ 165(3) TKG 2021).

Who else receives data

• Our hosting provider in the EU runs the server (processor, Art. 28 GDPR).
• World4You Internet Services GmbH, Austria, delivers our emails (processor).
• Anthropic (USA) provides the AI assistant. It receives your chat messages, the names of your tools with what they run on and who looks after them, and the security problems to check against them. It does not receive your email address. Anthropic does not use this data to train its models. Data goes to the USA on the basis of the EU standard contractual clauses (Art. 46 GDPR) in Anthropic's data processing terms.
• TypeSafe receives a product name and a published security advisory, to check whether they belong together, and nothing about you.
• Stripe Payments Europe, Ltd., Ireland, handles Pro payments and receives your email address for that. For payment data, Stripe is responsible itself: https://stripe.com/privacy.
• Product names and versions (never your email address) are looked up in public security databases such as OSV.dev.

How long we keep it

Until you delete your account under Settings, "Delete my account and data", which deletes your account, setup, to-dos and login data at once. Encrypted backups are overwritten after 30 days. Server logs are kept for 14 days. Invoices are kept for seven years.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). Write to office@ikangai.com. If you think we process your data unlawfully, you can complain to the Austrian Data Protection Authority (Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at) or the authority where you live.