Version v1.6 · Effective date 2026-10-22

Privacy Policy — v1.6

Version: v1.6 Effective Date: 2026-10-22 Entity: AlphaDelve Tech Limited

1. Introduction

BastionLog respects your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the BastionLog service ("the Service").

BastionLog provides digital-footprint fact logs for international trade. Because of the nature of the Service, we process two categories of data: (a) your account information, and (b) the company queries you submit (including documents you upload) and the reports generated from them.

This Policy is intended to comply with the principles of applicable data protection laws, including (where relevant) the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486), Singapore's Personal Data Protection Act 2012 (PDPA), the EU General Data Protection Regulation (GDPR), and the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018.

The Service is not directed at people under 18.

If the Chinese and English versions of this Policy differ, the English version prevails, except where applicable law mandatorily provides otherwise.

2. Information We Collect

2.1 Account Information

When you create and use an account, we collect:

Email address;
Account name / organization name (optional);
Authentication credentials (hashed and salted; we do not store plain-text passwords);
Consent and declaration records: the version and time of the Terms of Service you accepted, your business-use declaration, and the two confirmations you give at checkout (Terms of Service Section 12.2);
Account status: for example whether the account has been disabled, when, and the reason (entered by our support staff when handling a breach of the Terms or at your request);
API-key metadata: when each key was created, when it was last used, and whether it has been revoked (plain-text keys are not stored).

2.2 Query Data

When you use the Service to query a company, we collect and store:

The company name and domain you queried;
Other query details you choose to provide, such as a registration or tax number, the counterparty's email address, or bank identifiers (BIC / IBAN);
The country code or jurisdiction you specified;
The timestamp of your query;
The attention signal report generated in response to your query (facts, source URLs, ISO timestamps).

Reports generated through the API are saved to your history too. Document reports you generate through the API, and company logs or reports you request through the API with a request identifier (Idempotency-Key), are saved as your own stored reports and appear in your web "History". This lets you retrieve a result you have already paid for, after a network failure or a repeated submission, by reusing the same request identifier — without being charged again and without the sources being queried again. These records follow the same retention and deletion rules as reports generated on the website (Section 5.3).

Share links. You can create a share link for one of your reports (with an optional expiry, revocable at any time). Anyone holding the link can view that report; whether and with whom you share it is your decision. We store only a keyed hash of the link token, not the link itself: the full link is shown to you only for a short time after you create it, and after that we cannot show it again — you can revoke it or create a new one.

2.2a Precheck Data

Before you confirm and pay for a complete query, the Service may offer a precheck (see Terms of Service Section 11.4).

Where it is sent: a precheck sends the company name and jurisdiction you enter to the public sources available for that jurisdiction — an official registry interface, or, where no such interface exists, a single search performed through a third-party public search engine. In the search-engine case, the company name you entered is contained in the query sent to that engine. All such requests are made by our gateway, not from your device, and carry no information about you or your account. This is the same category of information a complete query sends, in a smaller scope.

We do not create a query-history record for prechecks. Unlike the complete queries described in Section 2.2, a precheck leaves no entry in your query history — we do not store which companies you prechecked.

To enforce the precheck allowance we record a usage count only (how many prechecks an account used in a given calendar month). We do not record what was searched. That count contains no company name, domain, or other query content.

The scope and limits of free features, including prechecks, are set out in Terms of Service Section 11.4 and on the pricing page.

2.2b Public Lookup (No Account)

Visitors can enter a company name on our homepage and see whether the official registry interface of one of our directly connected jurisdictions returns a match for that name. For this feature:

the name you enter is sent to the official registry interface of the jurisdiction you select;
we do not create an account record and we do not store what you searched;
requests are subject to the rate-limit logging described in Section 2.5 (truncated IP address, request path, counter), and to a short-lived counter used for rate-limiting only (keyed by a keyed hash of the IP address; the raw IP address is not stored).

The result states only whether that interface returned a match at that moment. It is not a statement that a company does or does not exist. Section 9 applies where a public record names an individual.

2.2c Public-List Name Check Data

The Service offers public-list name checks (see Terms of Service Section 11.1): the company name you submit is matched against publicly available lists on our Singapore gateway.

Input is limited to company names. The feature does not accept natural-person names as input.
The list data is compiled by OpenSanctions. Matching runs through an online interface provided by OpenSanctions (located in Germany): we send only the company name you submit (no account data) and it returns any matching list entries. Repeat queries for the same name within a short period are answered from a cache on our servers and are not sent again.
The output is a factual statement only — whether the name matched an entry on a public list at that time, with the source and timestamp. No score, rating, or recommendation is produced (Terms of Service Section 5).
Public-list name check queries are recorded as part of your query history under Section 2.2; the lists themselves are public material and contain no data about you.

2.2d Document Upload and AI Field Extraction

Signed-in users can upload trade documents (for example invoices, bills of lading, contracts). The Service identifies the businesses named in them so that you can choose which ones to include in a report. For this feature:

Uploaded files are held only temporarily while your request is processed (larger files are buffered as temporary files on the server) and are deleted once processing finishes; we do not keep the original uploaded file. The extracted text (up to about 60,000 characters per document) is sent to our AI service provider, Google (Gemini API), to identify the document type, key fields, and the company and person names that appear in it.
AI-extracted results are labelled "AI-extracted · to be verified". They are candidates for your selection only and are not a source of facts; we run checks only on the businesses you select.
The report generated after your selection (including the extracted key fields) is saved as your stored report and follows Section 5.3.
Documents may contain information about third-party individuals (for example contact persons or signatories). Please upload only documents you are entitled to provide.

2.2e MX Facts for a Counterparty Email Address

If you provide a counterparty's email address in a query, the Service looks up the public DNS mail-exchange (MX) records of that address's domain and states in the report, as a fact, "MX present / no MX / source unavailable". We do not connect to the counterparty's mail server and do not send any message to that address.

Addresses at common personal-mailbox providers (for example free webmail) are not passed to reputation collectors.
Data-breach record check: for other addresses (not at personal-mailbox providers), our gateway sends the full email address to Have I Been Pwned (haveibeenpwned.com) to check whether it appears in publicly disclosed data breaches; the report states only the breach metadata returned (breach name, date and the categories of data involved), never the breached content itself.
To avoid repeated lookups, the gateway caches the result; the email address in the cache key is stored only as a keyed hash, not in plain text. The cache duration is the first tier in Section 5.1 (no more than 15 days).

2.2f Look-alike Domain Facts

To help you check emails that ask you to change a payee's bank account, the Service can take one official domain of a counterparty, generate up to 60 visually similar spellings using fixed rules, and check whether those spellings exist in the DNS, when they were registered, and whether they have MX records.

What we look up is public DNS and RDAP registration data about other domains, through public DNS resolvers (DNS-over-HTTPS resolvers operated by Cloudflare and Google) and registries' RDAP services. We do not visit those domains' websites and do not probe ports or services.
The report states only "this spelling exists in the DNS / registration date / MX present or not / character difference from the official domain"; it makes no judgement about who controls the domain or what it is used for.
Results are cached for 1 day.
To prevent abuse, signed-out visitors may run at most 5 checks per IP address (IPv6 per /48 network) per 24 hours, and signed-in users at most 50 checks per account per 24 hours; a visitor's counter key is only a keyed hash of the IP address — the raw IP address is not stored — and the counters expire automatically after 24 hours.

2.2g Official Tax / Business Number Checks

If the registration number you enter in a query is itself a tax or business number (for example an EU VAT number or an Australian ABN) and passes our local format and check-digit checks, the Service sends that number to the official lookup service of the authority that issued it, for one exact lookup by number (there is no search by name). Signed-in and signed-out users can also check a single number with the free "tax number check" tool.

Sources: currently live are the EU VIES service (the European Commission's VAT number check), Australia's ABN Lookup (Australian Business Register) and New Zealand's NZBN (the New Zealand Business Number register of the Ministry of Business, Innovation and Employment, MBIE). The connection to UK HMRC ("Check a UK VAT number") has been built and will be switched on once the official access credentials are issued (planned); until then, numbers of that kind are not sent anywhere.
What is sent: only the number. Requests are made by our query gateway (Section 5.1) and carry no information about you or your account.
What we show and keep: whether the source holds a record of the number, the registered name and trading name on that record, the country, the time of the check and a link to the source. The name returned by the source is shown next to the name you entered; if the wording differs we say only that it differs, without any judgement.
No addresses: addresses returned by VIES and HMRC are never read, shown or stored (the source cannot tell a sole trader's home address from a business address). ABN Lookup publishes only the state and postcode, and we show only those two. For NZBN we show the registered address only for company-type entities; for sole traders, partnerships, trusts and any other type we show none.
Sole traders: a sole trader's registered name may be their own name; that processing is covered by Section 9.
Cache: the gateway caches a result for at most 1 day, encrypted, with the number used only as a keyed hash for lookup; nothing is cached when the source is unavailable.
Storage: a result inside a report is saved with that report (Section 5.3; stored encrypted, see Section 6). The free tool does not store the number you check or the result; it records only a quota count (signed-out visitors 10 checks per network per 24 hours, signed-in users 100 per account per 24 hours; the visitor counter key is a keyed hash of the IP address and expires after 24 hours).
In the gateway's request logs, the number checked is masked and not recorded in plain text.

2.3 Usage Data

We may collect limited technical data about your use of the Service:

API request timestamps and response status codes;
Aggregated usage patterns for service improvement.

We do not use tracking cookies, advertising identifiers, or third-party analytics that profile individual users for marketing purposes.

2.3a Cookies

We use only cookies that are strictly necessary to provide the Service:

Sign-in session: keeps you signed in after you sign in;
Form security token: stops others from submitting forms using your signed-in session (cross-site request forgery);
Language preference: remembers the interface language you chose;
Short-lived cookies needed to complete a step: for example resetting your password, staff two-step verification, carrying a query you filled in before registering over to after you register, and showing a share link you just created once; these are deleted once the step is completed, and otherwise expire when the step's validity period ends (for example, that of the password-reset link);
and the token the human-verification component (Section 2.6) needs to complete verification.

These cookies are not used for tracking or advertising.

2.4 Registration Abuse-Prevention Data

(a) Registration guards — active

To prevent bulk registration for the free allowance, we apply two checks at sign-up:

Disposable-mailbox block: if the domain of your email address is on the list of disposable-mailbox domains kept locally on our server, registration is refused with a neutral message. The check runs locally; no external service is called.
24-hour sign-up count: we count successful sign-ups from the requesting network (the IPv4 address; for IPv6, the /48 network prefix) over a rolling 24-hour window. Above the limit, new sign-ups from that network are not accepted for the time being. The count is held in an in-memory database only as a keyed HMAC-SHA256 hash with timestamps — the raw IP address is not stored — and expires automatically after about 24 hours. Requests whose source cannot be attributed (for example from internal addresses) are not counted.

(b) Per-account device / IP hashes — still inactive

We currently do not store device characteristics or the registration IP address in any form in your account record (including as keyed hashes). We reserve the right to activate this control in the future; before we do, we will update this policy first. If activated, it would derive a signal only from the User-Agent and Accept-Language headers that your browser sends with the request and process the IP address used at registration; the registration page would not use JavaScript to read screen, time-zone, platform, or other terminal-device information for this purpose; any such values would be stored only as keyed HMAC-SHA256 hashes; and it would affect only whether the free allowance is granted, never your ability to register or to pay.

Legal basis: legitimate interests (GDPR Art 6(1)(f)) — preventing abusive bulk registration. We process only pseudonymous hashes and do not use them for profiling.
Retention: the counts in (a) expire after about 24 hours; if (b) is activated, those hashes would be kept for as long as your account exists and deleted (or irreversibly anonymised) with it.
What we do not do: use them for advertising, use them to profile you, or share them with third parties.

Rate-limit warning logs: when a request triggers our rate limits, the server log records a truncated IP address (IPv4 reduced to /24, i.e. only the first three parts kept; IPv6 reduced to /48), the request path and a counter. The rate-limit counter counts per individual IP address (so that different users in the same network are not counted as one), but its key is only a keyed hash of that IP — the raw IP address is not stored — and it expires after a short time.
Application request logs: our application does not log the browser User-Agent, the referring page (Referer) or forwarded-address request headers; in the application's access log, IP addresses are truncated to the first three parts (IPv4) or the /48 network (IPv6).
Web-server access logs: the web server in front of the application keeps an access log for each request, including the full IP address, time, request line (with token-type query parameters masked), status code, referring page (token parameters likewise masked) and browser User-Agent, for security and troubleshooting.
Login throttling: after repeated failed sign-in attempts for the same email address within 15 minutes, further attempts are progressively delayed. The counter is keyed by a keyed hash of that email address in an in-memory database, expires after 15 minutes without a new failure, and is cleared on successful sign-in. It behaves the same for existing and non-existing accounts, so it does not reveal whether an address is registered.
Feature-quota counters: some free tools and the homepage free preview have a per-network or per-account limit per 24 hours (see Sections 2.2f and 2.2g); visitor counter keys are keyed hashes of the IP address, and these counters expire after 24 hours.
Why: to detect and block automated abuse and attacks — legitimate interests (GDPR Art 6(1)(f)), for security purposes.
Retention: application logs and web-server access logs are kept on the host for 30 days and then deleted; in no case longer than 90 days.
What we do not do: these logs and counters are not used for advertising, not used to profile you, and not shared with third parties.

2.6 Human Verification (Cloudflare Turnstile)

On the sign-in page, the registration page and the free preview on our homepage we use Cloudflare Turnstile to tell people apart from automated programs. The page loads a verification widget from Cloudflare; the widget runs in your browser and Cloudflare collects the signals it needs (for example your IP address and browser characteristics). Cloudflare returns a one-time token; our server sends only that token to Cloudflare to check the result and does not send your IP address or account information. Cloudflare's processing of the signals it collects is governed by its own privacy terms (Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/).

Why: to prevent credential stuffing and bulk registration — legitimate interests (GDPR Art 6(1)(f)).
If verification fails, that sign-in or registration is not accepted; you can try again.

2.7 Staff Accounts: Two-Step Verification and Audit Trail

This section covers the accounts of our staff (support and administration), and the records left when staff act on your account.

Staff two-step verification: staff must pass a time-based one-time code (TOTP) to sign in. We store the encrypted authenticator secret, the last time step used, lock status, and SHA-256 hashes of recovery codes (recovery codes are not stored in plain text); pending sign-in records (a random identifier, attempt and failure counts) are no longer used once verification completes or expires.
Audit trail: sensitive staff actions — for example granting staff rights, enrolling an authenticator, using a recovery code, authenticator lock-out, increasing or reducing an account's available allowance, handling refunds and support tickets, disabling or restoring an account, forcing sign-out, revoking API keys, carrying out an erasure request, re-running a failed job — are written to an audit record: the action, the time, a pseudonymous identifier of the staff member who acted, and the necessary details (for example the disable reason or the allowance involved). Audit records do not contain email addresses.
Why: to keep account and billing actions traceable and prevent internal misuse — legitimate interests (GDPR Art 6(1)(f)) and legal obligation.
Retention: audit records are kept as evidence of transactions and actions for 7 years (the record-keeping requirements of Hong Kong company and tax law for business records) and are then deleted by a scheduled job; when your account is deleted, identifiers in audit records that point to you are anonymised (Section 5.3).

3. How We Use Your Information

We use the information we collect solely for the following purposes:

(a) Service delivery: To process your company queries (including documents you upload) and generate attention signal reports.

(b) Historical review: To enable you to review past queries and reports (a core feature of the Service — see our Terms of Service, Section 9).

(c) Service improvement: To analyze aggregated, anonymized usage patterns to improve the accuracy and performance of our data collection and signal generation.

(d) Account administration: To manage your account, send service messages (Section 10), and respond to your support requests.

(e) Security and abuse prevention: To operate the controls described in Sections 2.4 to 2.7.

(f) Legal compliance: To comply with applicable legal obligations, respond to lawful requests from public authorities, and enforce our Terms of Service.

We do not sell, rent, or share your personal data with third parties for their own marketing purposes. We do not use your query data to build profiles about you or to make automated decisions about you.

4. Legal Basis for Processing

Depending on your jurisdiction and the nature of the data, our legal basis for processing includes:

Performance of a contract: Processing necessary to provide the Service you have requested (e.g., generating reports for your queries, keeping your history, telling you a report is ready).
Legitimate interests: Processing necessary for service improvement, abuse prevention, and security, where such interests are not overridden by your data protection rights.
Consent: Where required by applicable law, we will obtain your explicit consent before processing your data for specific purposes.
Legal obligation: Processing necessary to comply with applicable laws.

5. Data Storage and Retention

5.1 Processing and Storage Locations

(a) Singapore — application, database and query gateway

Your account details, query history, reports, and billing ledger are stored on servers located in Singapore (a dedicated server provided by OVH). By using the Service, you acknowledge that this data will be transferred to and stored in Singapore.

The queries you submit (company name and jurisdiction, the email domain or domain spellings described in Sections 2.2e and 2.2f, and the tax numbers described in Section 2.2g) are sent to sources through our query gateway, which is also in Singapore. Public-list name checks are sent from that gateway to the online interface of OpenSanctions (Section 2.2c). To reduce repeated requests to external sources, the gateway caches source responses. Responses that may contain personal data — for example registry records naming officers, domain-registration records, public-list matches, and web-page or search-result text — are cached for no more than 15 days; private contact fields in domain-registration records (WHOIS / RDAP) are removed before caching. Purely technical records that cannot contain personal data — DNS records, certificate-transparency entries, archive snapshot timestamps, and IP-address infrastructure data — may be cached for up to 30 days. The gateway does not persistently store your reports or account details.

(b) European Union (France) — encrypted off-site backups

For disaster recovery, we keep database backups (daily base backups and the continuous transaction log, plus a nightly logical export) and a copy of the configuration secrets needed to restore the Service in OVH object storage in France (Gravelines). All backups are encrypted before they leave our Singapore server (client-side encryption); the storage provider holds only ciphertext and has no access to the decryption key; we also keep a copy of the key offline. Database backups are kept for 14 days and are then replaced by newer backups and deleted.

(d) Applicable law

BastionLog is operated by AlphaDelve Tech Limited, a Hong Kong legal entity. The Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) applies by reference to the data user's control, independently of server location. Where relevant, Singapore's Personal Data Protection Act 2012 and the EU GDPR may also apply (see Section 11).

5.2 Data Region Tagging

Our architecture includes a data_region tag field that records which data protection regime applies to a record (currently uniformly Hong Kong, the operating entity's jurisdiction).

This tag does not indicate a storage location — storage locations are set out in Section 5.1. The field is reserved for data-region routing if BastionLog expands to additional deployment regions; it does not currently change any processing behaviour.

5.3 Retention Period

Account data: Retained for as long as your account remains active.
Query history and reports (including reports generated through the API, Section 2.2): Retained for as long as your account remains active, to enable historical review functionality. Tracked-company snapshots are kept for 730 days, unless an active tracked-company subscription needs a snapshot as a comparison baseline.
Retention of other records (carried out by a cleanup job that runs daily):
- report-generation job records (including the query parameters you submitted): deleted 90 days after the job finishes or fails; the report itself is kept as in the item above;
- usage records (which interface was called and the result status; no IP address or email address): 400 days;
- email-verification records: deleted 30 days after use or expiry;
- audit and action records: 7 years (Section 2.7); records of your consents and declarations, such as accepting the Terms, are kept for the life of your account and anonymised when it is deleted;
- account-export download files: expire 24 hours after they are generated;
- gateway caches, logs and counters: see Sections 2.2e to 2.2g, 2.4, 2.5 and 5.1.
Deleting your account: signed-in users can delete their account themselves from the account page (current password and confirmation of the email address required); you can also ask us to delete it by contacting us (see Section 13). We will process such requests within the time required by applicable law (one month under the GDPR; forty (40) days under the Hong Kong PDPO s.19(1) — whichever applies to you), subject to any legal retention obligations that require us to keep certain records — for example, the billing ledger, evidence of your withdrawal-related confirmations, and any records we are required to retain by law. On deletion, identifiers pointing to you in the billing ledger and in audit records are anonymised (the records themselves are kept so that transactions can be reconciled), and support tickets are deleted; query-metadata records in your query history (one of the company name, registration number or domain queried, the country and a few facts) are unlinked from your account: company and person names in the recorded facts are removed; the item you entered (one company name, registration number or domain) and the country are kept in encrypted form, used only for aggregate service statistics and anti-abuse reconciliation, and can no longer be linked to you. The deletion itself leaves one record containing only a keyed hash of your e-mail address (not the address), used solely to re-apply your deletion if we ever restore data from a backup (see "Copies in backups" below).
Long-inactive accounts: if your account is not signed in to or used for 24 consecutive months, we will send a notice to your account e-mail address 30 days and 7 days before the deletion date; signing in before then keeps the account. If you still have not signed in by then, we delete the account in the same way as described under "Deleting your account" above (Terms of Service Section 17). Accounts that must be preserved because of legal proceedings or a regulatory requirement are excepted.
Copies in backups: deleted data may remain in the encrypted backups described in Section 5.1(b) until those backups are rotated out within 14 days. We do not restore deleted data from backups for any other purpose; if a backup must be restored for disaster recovery, we re-apply the deletions we have already accepted after the restore.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption in transit: the website and API are served only over HTTPS (TLS 1.2 and TLS 1.3, with authenticated-encryption cipher suites only); our calls to official data services also use HTTPS.

Encryption at rest:

The following data is stored in our database, currently encrypted with application-layer AES-256-GCM: your account email address, your saved reports (including the tax-number check results in them), the queries you submit (company names, domains, registration numbers, counterparty email addresses, bank identifiers and similar), your query history, tracking subscriptions and support ticket content. The encryption keys are kept outside the database and backed up separately from it.
Accounts are looked up by email address through what is currently a keyed HMAC index, so the address itself is not stored in readable form.
Passwords are currently stored only as bcrypt hashes; API keys, share links and email-verification tokens are stored only as keyed hashes; staff two-step verification secrets are stored encrypted.
The gateway cache for tax-number checks is encrypted and kept for at most 1 day (Section 2.2g). Once the UK HMRC service is switched on, its access token is held only in server memory and is never written to disk, a database or a log.
Database backups are encrypted before they leave the server (Section 5.1(b)).
Snapshots and caches of public-source data are protected by access controls while application-layer encryption is being rolled out in phases; server-level encryption measures are planned.

Log minimisation: application request logs do not record the browser User-Agent, the referring page or forwarded-address headers; IP addresses in the application's access log are truncated (Section 2.5); gateway logs do not record checked tax numbers in plain text.

Staff access control:

role-based access control (support, finance and super-administrator roles each get only the permissions they need), with no access by default;
mandatory two-step verification for staff accounts; no access to the back office until it is set up;
every write action by staff in the back office is recorded in an audit record (Section 2.7), and the list of staff permissions is reviewed regularly;
access to servers and databases is limited to a small number of authorised people.

Other: regular security review of our infrastructure and dependencies (including a weekly dependency vulnerability scan).

However, no method of electronic storage or transmission over the Internet is 100% secure. We cannot guarantee absolute security of your data.

6.1 Personal Data Breach Notification

We take the security of your personal data seriously. If a personal data breach occurs, we will act promptly to contain it and to assess any risk to your rights and freedoms, and we will notify the relevant supervisory authority and, where required, you, as set out below.

Containment and assessment: we will take immediate steps to contain the breach, investigate its cause and scope, and record the details in our internal breach register.
Notifying the supervisory authority (GDPR / UK GDPR Article 33): where the GDPR or the UK GDPR applies (for example, the UK Information Commissioner's Office (ICO) where UK personal data is involved), we will notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.
Notifying data providers: where an incident involves data we obtained from an official data service, or our access credentials for that service, we will notify that provider as agreed with it; where no time limit is agreed, within 72 hours of becoming aware.
Notifying you (GDPR Article 34): where a breach is likely to result in a high risk to your rights and freedoms, we will communicate the breach to you without undue delay.
Hong Kong position: the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) does not currently impose a mandatory breach-notification obligation; the guidance of the Privacy Commissioner for Personal Data (PCPD) provides for voluntary notification. We will nonetheless handle breaches to the standard described above, and we may voluntarily notify the PCPD (using 72 hours as a guide).
How you will be told: where we notify you, we will do so by email (using the address on your account), through the Service interface, or by a public notice on our website, depending on the nature of the breach and the information available to us.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Right of access: You may request a copy of the personal data we hold about you.
Right of rectification: You may request correction of inaccurate or incomplete data. Signed-in users can change their password themselves on the account page; for other corrections (for example changing your account email address), email support@bastionlog.com.
Right of erasure: You may request deletion of your personal data, subject to legal retention obligations. Signed-in users can delete their account themselves on the account page (Section 5.3); transaction and action records that we must keep by law are anonymised rather than left pointing to you.
Right to restrict processing: You may request that we limit the processing of your data in certain circumstances.
Right to object: Where we process your data on the basis of legitimate interests (for example the abuse-prevention and security measures in Sections 2.4 to 2.6), you may object at any time on grounds relating to your particular situation (GDPR Article 21); we will stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims. Section 9.5 describes how individuals named in reports can object.
Right to data portability: You may request a copy of your data in a structured, machine-readable format (signed-in users can also export it themselves from the account page).
Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time.

To exercise any of these rights, you can submit your request (for example to access or erase your personal data) through our Trust Center, which provides an easy online process: https://app.prighter.com/portal/18835136460; or you can contact us at the address in Section 13. We will respond to your request within the timeframe required by applicable law (one month under the GDPR; forty (40) days under the Hong Kong PDPO s.19(1) — whichever applies to you).

8. Third-Party Services and Processors

BastionLog uses the following third-party services to provide the Service. Except as described below, or as required by law, we do not share your personal data with third parties.

| Provider | Purpose | Data it receives | Location | |---|---|---|---| | OVH (OVH group) | Dedicated server in Singapore (application, database, query gateway); object storage in France (encrypted backups) | All data on the server (as hosting provider); ciphertext only for backups | Singapore; France (Gravelines) | | Google (Gemini API) | (1) drafting the report summary from facts already collected; (2) extracting fields from documents you upload (Section 2.2d); (3) on the gateway, checking that the summary wording is neutral and grounded in the facts | Report facts (which may include names and roles of individuals in public records); document text; summary wording to be checked. No account information | Processed by Google on its global infrastructure (under Google's data processing terms for the Gemini API paid services) | | Cloudflare (Turnstile) | Human verification on the sign-in page, the registration page and the homepage free preview (Section 2.6) | Signals collected by the widget directly in your browser (including IP address); our server sends only a one-time token | Determined by Cloudflare | | Spaceship / Spacemail | Sending service messages (Section 10) and hosting our support mailbox support@bastionlog.com | Your email address and the message content; emails you send to support@ | United States (Spaceship, Inc.), under the EU Standard Contractual Clauses and UK clauses in its data processing addendum | | Public DNS resolvers (DNS-over-HTTPS by Cloudflare and Google) | Looking up public DNS records of domains (including look-alike domains, Section 2.2f) | The domain names looked up; no information about you | — | | Public search engines | Where a jurisdiction offers no official registry interface, prechecks and some collection run a search through a third-party public search engine | Company name and jurisdiction, sent by our gateway, with no information about you | — | | Public data sources | Public registries (WHOIS, RDAP, crt.sh, Internet Archive, government business registries, etc.) | Company name, jurisdiction or domain; real-time queries with no information about you | Each source's jurisdiction | | Official tax / business number lookup services | Live: EU VIES (European Commission), Australia's ABN Lookup (Australian Business Register), New Zealand NZBN (MBIE). Planned: UK HMRC (Section 2.2g) | Only the number checked; sent by our gateway, with no information about you | EU; Australia; New Zealand (planned: UK) | | Third-party aggregator of mainland China company registration data (Juhe) | When you look up a mainland China company, retrieving its business registration record (third-party aggregated, not a direct official connection; labelled as such in the report) | The company name or unified social credit code you submit; no account data | Mainland China | | Have I Been Pwned (haveibeenpwned.com) | Data-breach record check (Section 2.2e) | The counterparty email address you provide in a query (except addresses at common personal-mailbox providers); sent by our gateway, with no information about you | Determined by the service |

OpenSanctions. Public-list name checks run through the online interface of OpenSanctions (located in Germany and subject to the EU GDPR) (Section 2.2c). We send it only the company name queried, never your account data; where a company is registered under a natural person's name, that name may be personal data.

AI service providers. In production the only AI service provider is Google (Gemini API, paid services); we will update this policy before adding any other AI service provider. Production has a technical control: if the configuration points to a provider that is not permitted, the application will not start. We use the paid tier of the Google Gemini API; under Google's current terms applicable to paid services, data submitted is not used by Google to improve its products (including training models); if those terms change, we will update this policy.

Other Cloudflare services. We do not currently use Cloudflare to host this site's DNS or to proxy its traffic. If we do in future, we will update this table first.

Payment services. Online payment is not yet open. When it opens, we will list the payment provider and the data it receives in this table.

9. Personal Data About Individuals Named in Public Records

9.1 What this is

Our reports reproduce information taken from public sources — government company registries, WHOIS/RDAP domain records, and public directory mirrors. Those sources sometimes name individuals: for example a company's directors, officers, or company secretary, a registrant name in a domain record, or a legal representative. These individuals have no contractual relationship with us and, in most cases, will not know they have been the subject of a query.

For this processing, AlphaDelve Tech Limited acts as a controller within the meaning of the GDPR. Our legal basis is GDPR Article 6(1)(f) (legitimate interests): BastionLog exists to give traders verifiable facts about a counterparty, and reproducing the names already published in an official registry, together with the source and the time of collection, is necessary for and proportionate to that purpose. We have recorded a balancing assessment: we reproduce only what the source states, we add no assessment or inference about any individual, and we do not use this data to make automated decisions about anyone. Under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486), the corresponding basis is Data Protection Principle 1 — the data is collected by lawful and fair means for a purpose directly related to our function, and the collection is not excessive (we take only the name and role, and no more than the source already made public).

9.2 Categories of source

Public government registries (for example, company registries);
WHOIS / RDAP domain registration records;
Public directory mirrors of those registries.

Local copies of official bulk registers. To find companies quickly and accurately by name or registration number, we keep, on our servers in Singapore, copies of some bulk register files that official bodies publish as open data: Norway (Brønnøysund Register Centre), Australia (ASIC company register), Kazakhstan (Ministry of Justice legal-entity register), Brazil (Federal Revenue CNPJ open data) and the Open Ownership beneficial-ownership register. These copies consist mainly of company records; where they concern individuals, we keep only names and their roles or interests (for example, partners' names, roles and dates of entry in the Brazilian register, and names and types of interest in the beneficial-ownership register). Private contact details (telephone numbers, email addresses), sole traders' street addresses, dates of birth, personal addresses, identity numbers and nationalities are removed when the files are loaded, and the system checks samples automatically at start-up and refuses to run if any such field is found. The copies are replaced in full whenever they are refreshed from the official source, and they are included in the encrypted backups described in Section 5.1(b).

9.3 Categories of data

Names of individuals named in a public record (for example, directors, officers, company secretary, registrant, or legal representative); and
the role in which each name appears (for example, "director", "registrant").

Some sources record the role and the name in a single field. For example, the "representative" (代表者) field of Japan's public corporate information (gBizINFO) reads like "取締役副社長 [name]"; we reproduce that field as it is (only collapsing repeated spaces to one), without splitting or rewording it, and label its registered role "代表者 (as recorded in the register)". Other information returned by the same source, such as shareholders or business locations, is discarded and is neither cached nor reported.

We do not process identity-document numbers, private residential addresses, or private contact details (private telephone numbers or email addresses) for this purpose. Those categories are outside our processing and are excluded at the point of collection.

9.4 Retention

This data is retained in two forms, both kept only for as long as your account remains active: (a) the fact summary in your query history, limited by a per-jurisdiction allowlist (for example, the retained officer fields are the name and role, bounded to 300 characters); and (b) the full reports you save (whether generated on the website or through the API, Section 2.2), kept as generated (with identity numbers, private home addresses and private contact details excluded under Section 9.3) so that you can view them later or retrieve a result you have paid for. It is not used to build profiles and is not transferred onward for marketing. Bulk source material that is collected for verifiability but never displayed in a report is not retained in the systems that serve the product; contact fields from such material (for example, Norway's business-register email and mobile fields) are excluded before delivery.

9.5 Your rights, and how individuals can object

If you are an individual named in a report, the rights described in Section 7 apply to you, including the right to object (GDPR Article 21). If you object, we will by default suppress your name — we will no longer display it in future reports, and the report will state that a name from a public record has been withheld at your request. We are not altering the underlying public source; we are choosing not to display the name and to say so, which keeps the report accurate and transparent.

To object, email support@bastionlog.com; individuals in the EU or the UK may also submit through our representative, Prighter (https://app.prighter.com/portal/18835136460, see Section 13). We will handle your request within 40 days (the Hong Kong PDPO s.19(1) period), or within the GDPR's one-month period where that applies — whichever applies to you.

GDPR Article 14 generally requires us to tell individuals when we obtain their personal data. Article 14(5)(b) relieves that obligation where informing each individual would involve a disproportionate effort. The records we rely on are public, number in the tens of millions across many jurisdictions, and the individuals are not parties to the customer's query; contacting each one individually would be impracticable and disproportionate. We rely on this public notice (this section) as a proportionate alternative, and we provide the objection path in Section 9.5. This reliance is recorded as part of our record of processing activities.

The suppression list itself contains personal data. We store only the matching key needed to suppress the name and the date and time of the objection — nothing more.

9.7 Personal data about others that you provide

Counterparty email addresses you enter in a query (Sections 2.2 and 2.2e) and names that appear in documents you upload (Section 2.2d) may be personal data of third-party individuals. For that data:

you are the provider of the data and you confirm that you are entitled to provide it to us (for documents, see also Terms of Service Section 3.1);
we process it on the basis of legitimate interests (GDPR Article 6(1)(f)), namely helping you check a trading counterparty, with the same security measures (Section 6) and retention rules (Section 5.3) as your other data;
the individuals concerned can exercise the rights described in Section 7 by contacting us as set out in Section 13.

10. Direct Marketing

We do not use your personal data for direct marketing.

You will receive service messages from us, because they are part of delivering the service you asked for. These are not marketing:

email address confirmation, account and security notices;
a welcome email (once, after you confirm your email address);
a report-ready notice (when a report has been generated or could not be generated and you have left the waiting page; the email does not contain the report);
a free-allowance-used notice (once per account, explaining that further reports are priced per report);
report expiry reminders (one reminder 30 days and one 7 days before reports you bought or were given expire);
billing, order confirmations and withdrawal-right notices;
service updates and functional changes;
notices we are required by law to give you, such as changes to these terms.

All service messages are sent from support@bastionlog.com; replying to a message reaches our support inbox. Disabled accounts no longer receive these messages (except notices required by law).

If a message ever promotes a paid upgrade or another product, it is marketing — not a service message — and we will not send it to you on the basis of your account data.

Individuals named in reports. We do not send email, or any other message, to the directors, registered agents or registrants whose names appear in a report. That data is never used to contact anyone. See Section 9.

Hong Kong PDPO section 35C. Because we do not use your personal data for direct marketing, the section 35C notification and consent requirements do not arise for your account data. If that ever changes, we will give you the notice section 35C requires and obtain your response before any such use, and we will update this policy first.

11. International Data Transfers

Your account details, query history, and reports are stored in Singapore, and your queries are sent to sources through our query gateway in Singapore (see Section 5.1). Encrypted backups are stored in France (EU).

If you access the Service from outside those locations, your data will be transferred to and processed in Singapore and, encrypted backups are also transferred to France.

Transfers between Singapore and France: the transfer to France consists only of encrypted backups, of which the storage provider holds only ciphertext. These transfers are subject to the transfer limitation obligation under Singapore's Personal Data Protection Act 2012; we accordingly ensure the recipient affords a comparable standard of protection to that data.

Processors: the providers listed in Section 8 (for example Google and Cloudflare) may process the data they receive wherever their facilities are located.

External sources: each jurisdiction's official registry and public sources are located in that jurisdiction, so querying them necessarily involves transferring the company name and jurisdiction to it.

For users in jurisdictions with data transfer restrictions (such as the EU/EEA), where the transfer is not made on the basis of an adequacy decision, we rely on standard contractual clauses (and the UK International Data Transfer Addendum / IDTA where the UK GDPR applies) as the legal mechanism for such transfers.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When changes are made:

The updated policy will be posted on the BastionLog website or made available through the Service;
The "Date" at the top will be updated.

For material changes, we will notify you via email or through the Service interface at least 30 days before the changes take effect. We encourage you to review this Policy periodically to stay informed about how we protect your data.

13. Contact

For questions about this Privacy Policy or to exercise your data protection rights, please contact:

AlphaDelve Tech Limited

Email: support@bastionlog.com
Telephone: +852 5920 3010
Address: RM 18 2/F, TUSPARK, 118 WAI, YIP STREET, KWUN TONG, HONG KONG

Signed-in users can also raise a support ticket from their account; tickets are handled by our support team and are recorded against the account.

Representative (GDPR Art 27 / UK GDPR Art 27)

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

European Union (EU): Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria
United Kingdom (UK): Prighter Ltd, 20 Mortlake High Street, London, SW14 8JN, United Kingdom

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter, or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/18835136460

14. Supervisory Authority

If you believe that your data protection rights have been violated, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction:

Hong Kong: Office of the Privacy Commissioner for Personal Data (PCPD)
Singapore: Personal Data Protection Commission (PDPC)
United Kingdom: Information Commissioner's Office (ICO)
EU/EEA: Your local Data Protection Authority