Privacy, explained.
Discretion depends on clear choices, not absolute promises. This page explains what Aditora asks for and the limits of the protection it provides.
Draft for operator review. Business identity, contact details and operational policies must be completed before public intake opens.
What you choose to share
Requests need only a problem description. Your name and contact details are optional. Specialist applications require a name or alias, expertise, capabilities and a reachable contact method. We do not provide client accounts, public profiles, uploads, advertising trackers or third-party analytics.
Why information is kept
The operator uses submissions to assess requests, review applications, coordinate lawful services and maintain private working notes. Legal bases, the controller’s full identity and the retention period must be confirmed by the operator before launch. No information is automatically shared with specialists.
How information is protected
Sensitive submission fields and private notes are encrypted in storage using application-held keys. Administrator access requires a password and a second factor. Notifications contain only a generic notice. This is server-side encryption, not end-to-end encryption: a compromised running server may access information. Infrastructure providers may process connection metadata.
Connection data and cookies
Short-lived, keyed hashes of connection addresses are used for shared abuse controls and expire after their rate window. The application does not persist raw addresses for this purpose. Proxy and hosting logs depend on operator configuration. Only administrator authentication uses session cookies; public visitors do not need a cookie banner for advertising or analytics because neither is installed.
Retention and deletion
The administrator can delete records from active storage. The proposed backup policy is 30 days; it must be confirmed and enforced by the operator. Active deletion does not immediately remove copies from backups. To request access, correction or deletion, use the operator’s published privacy contact once configured. A reference alone is not proof that a request belongs to you. The operator will evaluate proportionate verification without asking for unnecessary identity documents.
Controller and privacy contact
Not configured. The operator must publish the legal name, business address, registration details, privacy contact, hosting and processor information, retention decisions and the applicable supervisory authority before launch.