Privacy notice

Last updated: 27 September 2026

This notice explains what personal data the hosted ObfusGuard service at obfusguard.com processes — the web analyzer and the API — why, and for how long. It does not cover on-premise installations, which run entirely on the customer's own systems.

Who is responsible

ObfusGuard, Athens, Greece
Contact for any privacy question or request: support@obfusguard.com

Files you submit for analysis

Files uploaded through the website or the API are processed in memory-backed temporary storage. They and their results are deleted automatically within minutes of processing — the uploaded file itself as soon as the analysis response is sent, results and extracted content no later than about ten minutes after — and in any case whenever the service restarts. We do not keep copies of submitted files and do not use them to train our models.

Please do not submit files containing personal data you are not entitled to share. If your files must not leave your network, the on-premise version runs entirely on your own infrastructure.

API keys

When you request an API key we store:

• your email address, organisation and stated use case;
• a one-way fingerprint of your key (never the key itself);
• when the key was created, confirmed, last used and revoked;
• for each API request: the time, the SHA-256 hash of the submitted file, the resulting verdict and score, the processing time and the type of client (for example the TheHive/Cortex analyzer).

We use this to operate your key, enforce its allowance, prevent abuse, answer support requests and contact you about your key. The legal basis is the performance of the service you requested (GDPR Art. 6(1)(b)), and our legitimate interest in keeping the service secure (Art. 6(1)(f)).

Security and rate limiting

To limit abuse we process your IP address when you upload files or request a key. IP addresses used for rate limiting are deleted within 48 hours. Technical server logs are deleted after at most 30 days. The legal basis is our legitimate interest in protecting the service (Art. 6(1)(f)).

Cookies

We set three cookies, all strictly necessary for the site to work:

• a session cookie, which protects forms against cross-site request forgery and lets you access your own analysis results;
• upload_counter, which holds only the number of files you have analysed today and the date, to apply the daily upload limit — it expires after 24 hours;
• cookie_consent_accepted, which only remembers that you dismissed the cookie notice.

We use no analytics, advertising or tracking cookies.

Service providers

We rely on these providers, which process data on our behalf:

• OVHcloud — server hosting, in France.
• Zoho — email, in Zoho's EU data centre. Used to send key confirmation emails and to receive your messages.
• jsDelivr — delivers the page styling. Your browser fetches these files directly from jsDelivr, which therefore sees your IP address.

We do not sell personal data or share it for advertising.

How long we keep it

• Unconfirmed keys expire after 7 days.
• Per-request usage records are deleted after 365 days.
• Revoked or expired keys, with their usage records, are deleted 90 days after they stop being valid.
• Rate-limiting IP addresses: within 48 hours.
• Technical server logs: at most 30 days.

Your rights

You can ask for access to, correction or deletion of your data, restriction of or objection to its processing, and a copy in a portable format. Write to support@obfusguard.com from the address your key is registered to. Deleting your data also revokes your key.

You may also complain to a data protection authority — in Greece, the Hellenic Data Protection Authority (www.dpa.gr).