Privacy Policy
How Augis handles personal data.
What we collect about your account and about the people in a Lookup, why, who receives it, how long we keep it and what your rights are.
1Who we are and what this policy covers
This Privacy Policy explains how we process personal data under the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the French Data Protection Act (Loi Informatique et Libertés) and similar laws, who receives it, how long we keep it and what rights you have.
It covers two groups of people:
- People who use Augis (you): we are the controller of your account and activity data. Sections 2 to 12 apply.
- People who are the subject of a Lookup: information about them comes from public sources, public blockchains and breach indexes. Section 3 is the notice for them, and explains how to object or ask for removal.
We have not appointed a data protection officer, because the law does not require one for our processing. Privacy requests go to the contact point in section 14.
2Personal data about the people who use Augis
The table lists each category, why we process it, the legal basis under Article 6 GDPR and how long we keep it.
| Category | What it includes | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Account | Username, password stored only as a salted scrypt hash, creation date, IP address of recent sign-ins | Create and secure your account, prevent abuse | Contract; legitimate interests (security) | While your account exists |
| Plan and payments | Plan, credit balance, order identifier, amount and status. Never card or wallet seed details | Provide paid plans, keep accounting records | Contract; legal obligation | While your account exists, then 10 years for accounting records |
| Lookup history | The identifier you looked up, its type and the Result, including saved Wake reports | Let you review your own work | Contract | 14 to 730 days depending on your plan; not saved at all in incognito mode |
| Report details you type | Case reference and the name of the person who prepared a Report, which can be personal data | Print them on your Report | Contract | Kept with the saved Report, or not at all if you do not save it |
| Verified-access requests | Organisation, role, stated purpose and our decision | Decide who may use restricted functions, keep an audit trail | Legitimate interests (preventing misuse); legal obligation where it applies | While access is active, then up to 5 years to evidence who had access |
| Sign-up and sign-in in progress | Email, username, hashed password and a one-time code, before your account exists; one-time codes for password, email and two-step sign-in changes | Confirm that the email is yours and that the request comes from you | Contract; legitimate interests (security) | Deleted after use, and in any case after 1 hour (sign-up) or 15 minutes (codes) |
| Contact and law-enforcement forms | Name, email, the message and the details given in the form | Answer you, and verify and answer requests from authorities | Legitimate interests; legal obligation for requests from authorities | Up to 3 years after the last exchange; up to 5 years for requests from authorities |
| Support messages | What you send to contact@augis.eu and our replies | Answer you and fix problems | Contract; legitimate interests | Up to 3 years after the last exchange |
| Security and technical data | Session cookie, rate-limit counters, IP address, request metadata (address requested, time, browser) | Keep you signed in, detect abuse, protect the Service | Legitimate interests (security); strictly necessary | Session lifetime; security logs no longer than 12 months |
Providing account, plan and payment data is necessary for the contract: without it we cannot give you an account. We do not use your data for advertising or profiling, we do not make automated decisions that produce legal effects about you, and we do not sell your data.
3Information about the people you look up
When you run a Lookup, Augis returns information about the identifier you entered. This section is the information notice required by Article 14 GDPR for the people concerned.
| Who is the controller | We are the controller of how the Service collects and presents this information. You are the controller of your own use of a Result, and responsible for your own legal basis (see the Terms). |
| Categories of data | Public profiles and usernames; email addresses, phone numbers, domains, IP addresses and company or officer records found in public registries; records that appear in breach datasets (for example name, email, phone, the service concerned and the year); public blockchain addresses and the transfers between them. |
| Where it comes from | Public websites and registries, public blockchains, and a breach index operated by a third-party aggregator. We do not collect data by hacking, by phishing or from private accounts. |
| Why we process it | To give our users the Result they ask for, so that they can protect themselves and others, prevent fraud, check due diligence, trace stolen funds, report as journalists and support lawful investigations. |
| Legal basis | Legitimate interests (Article 6(1)(f)): ours and our users’ interest in access to public information for those purposes, balanced against the rights of the person concerned. The balance rests on the safeguards below. Where a Result relates to criminal offences or sanctions, we only reflect information published by public authorities or public records, and the user is responsible for any further use. |
| Safeguards | Passwords and secret credentials found in breach data are removed from what we display. We keep no copy of a Lookup beyond the history of the user who ran it, and delete it after the retention period of their plan, or never if they chose incognito mode. Access needs an account and a paid plan, is rate-limited and is bound by the acceptable-use rules. Restricted functions are logged. |
| Recipients | The user who ran the Lookup. We do not publish Results and we do not sell them. |
| Your rights | You can ask for access to what we hold about you, ask us to correct or erase it, object to the processing, or ask us to restrict it. Because we do not keep a store of Lookups about people, the most effective step is a suppression request: tell us the identifier (username, email, phone, domain or address) and we will stop returning it, where that is technically possible and does not defeat a legal obligation. We cannot delete data at its source (a public site, a registry, a blockchain or a third-party breach index): we will tell you whom to contact. |
| How to ask | Through contact@augis.eu. We may need to confirm that the identifier is yours. We aim to answer within one month. |
4How a Lookup is processed
When you run a Lookup, the identifier you entered is used to query the relevant sources. A username sweep sends the username to the public sites being checked. A breach check forwards the query to a breach data provider, the aggregator behind the breach index. Other lookups contact the registry or data service concerned.
When you use Wake, the Bitcoin or Ethereum address you enter is looked up in public blockchain data. Our server asks public blockchain explorers and a price service for the transactions and the prices involved, so they see the address and our server, not who you are. Blockchain data is public by design. Names attached to addresses come from our own address intelligence, sanctions screening and contract analysis.
Assistant. The messages you write to the dashboard assistant are processed by our own server to answer you. We do not keep the conversation: it lives in your browser tab and is lost when you reload the page. We count the number of messages per account to apply a daily limit. If we connect an external language-model provider to the assistant, we will list it in this table before doing so.
We use the identifier only to return your Result and, unless you chose incognito mode, to save it to your history. We do not share your history with anyone, except as section 5 describes.
5Who receives data
We use a small number of service providers, each limited to its own task and bound by contract or by the provider’s own terms:
| Provider | Role | Data it receives |
|---|---|---|
| Anti-robot verification provider | Checks that a form is filled in by a person and not a robot (processor) | A technical token, the IP address and browser data of the visitor |
| Email provider | Sends the verification codes and receives your messages to contact@augis.eu (processor) | Your email address and the content of the message |
| Payment processor | Cryptocurrency payment processing (independent controller for payments) | The order you create, not your account history |
| Breach data provider | Source of the breach index your breach Lookups query | The identifier you query |
| Public blockchain explorers and a price service | Transactions and prices for Wake | The blockchain address you trace |
| Public sites and registries | Checked by Parallax | The username, domain or company you look up |
| Our hosting provider | Infrastructure on which the Service runs (processor) | All data we hold, encrypted in transit |
We may disclose data where the law requires it, on a lawful request from a competent authority (see our law enforcement guidelines), to enforce our Terms, or to protect people from serious harm. None of these parties is an advertising or tracking network.
6International transfers
Some providers process data outside the European Economic Area, for example in Switzerland (which has an adequacy decision from the European Commission) or in the United States. Where the law requires safeguards, we rely on an adequacy decision (for example the EU-US Data Privacy Framework, for certified providers) or on the European Commission’s standard contractual clauses, with supplementary measures where needed. You can ask for a copy of the safeguards through contact@augis.eu.
7Cookies and local storage
We use a small number of items stored on your device. Those that are strictly necessary to provide what you asked for need no consent under Article 82 of the French Data Protection Act and the ePrivacy rules:
- A technical token from our anti-robot verification provider on the sign-up, sign-in and contact forms, which tells people from robots. It exists to protect the Service and is strictly necessary.
- A session cookie that keeps you signed in. It is HttpOnly, Secure and SameSite, so page scripts cannot read it. Strictly necessary.
- Local preferences: your light or dark theme, your answer to the cookie notice, and the name you last typed in “Prepared by”. They stay on your device.
We set no advertising, analytics or cross-site tracking cookies. If that changes, we will ask for your consent first.
8Retention and deletion
Each category has the retention period shown in section 2. History is deleted automatically when the retention period of your plan ends. You can delete individual Lookups, or your whole history, from the dashboard at any time. Incognito Lookups are never written down, so there is nothing to delete.
To close your account and remove the data tied to it, contact contact@augis.eu. We keep only what we are legally required to keep, such as payment records, and anything needed to establish or defend a legal claim, for as long as the limitation period runs.
9Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy (Article 15);
- have inaccurate data corrected (Article 16);
- have your data erased where the conditions of Article 17 are met;
- restrict the processing (Article 18);
- receive the data you gave us in a portable format (Article 20);
- object to processing based on legitimate interests (Article 21), on grounds relating to your situation;
- withdraw consent where we rely on it, without affecting earlier processing;
- give instructions about what happens to your data after your death, under French law;
- lodge a complaint with a supervisory authority.
Send a request through contact@augis.eu. We may need to confirm that you own the account first. We answer within one month, which we may extend by up to two further months for complex requests, and we will tell you if we do. Exercising your rights is free, unless a request is manifestly unfounded or excessive.
The supervisory authority in France is the Commission Nationale de l’Informatique et des Libertés (CNIL), www.cnil.fr. You may also complain to the authority of the country where you live or work.
10Automated decisions and risk scores
We make no automated decision about you that produces legal effects or similarly significant effects. Wake shows a risk reading for a blockchain address. It describes the address and the flow of funds, not you, and it is an input for a human to assess.
11Security
We protect data with the measures described on Security & Privacy, including hashed passwords, encrypted connections, rate-limited sign-in, access control on restricted functions and audit logging. No system is perfectly secure, but we limit what we collect so that there is less to lose.
If a personal data breach is likely to put people’s rights at risk, we notify the CNIL within 72 hours of becoming aware of it, and we inform the people concerned without undue delay where the risk is high.
12Children
Augis is intended for adults. You must be at least 18 years old to create an account, and we do not knowingly collect data from anyone younger. If you think a child has given us data, contact us and we will delete it.
13Changes to this policy
When we change this policy in a material way, we will update the effective date and version, and notify you in the dashboard before the change takes effect where it affects how we use your data. Earlier versions are available on request.
14Contact
For any privacy request or question, including a suppression request about an identifier, use contact@augis.eu. Please say whether you write as a user of Augis or as a person concerned by a Result, so that we apply the right procedure.
Ready to start investigating?
Create a free account, then pick a plan whenever you need more credits.
Get Started