1. Scope and Legal Roles

This Privacy Policy applies to the services, websites, portals, developer APIs, and applications provided by Diliguard. Diliguard acts in two distinct legal capacities under applicable data protection legislation:

• Data Controller: Diliguard acts as Data Controller with respect to account registration data, contact inquiries, user authentication credentials, and billing information collected directly from customers.
• Data Processor: When clients submit investigative queries, company identifiers, or individual names for automated due diligence screening, Diliguard acts strictly as a Data Processor. Such processing is governed by our Data Processing Agreement.

2. Categories of Data Collected and Sourcing

We collect and process the following categories of information:

• Account Information: Full name, professional email address, organization name, job title, encrypted authentication credentials, and subscription status.
• Technical & Telemetry Data: IP address, browser type, operating system, timestamps, API endpoint requests, and query volume metrics.
• Direct Statutory Intelligence: Intelligence results returned by Diliguard are retrieved in real time from authoritative primary sources, including 16+ official government corporate registries (such as Companies House UK, Handelsregister Germany, and SEC EDGAR US), global sanctions watchlists (OFAC, UN, EU, UK HMT), and public blockchain ledgers.
• No Third-Party Data Brokers: Diliguard does not purchase, resell, or aggregate bulk personal contact databases from commercial data brokers.

3. Purpose Limitation and Zero AI Model Training

Diliguard processes information solely to provide, maintain, and secure the risk intelligence services requested by our clients. Specifically:

• No AI Model Training: Client-submitted queries, target parameters, uploaded investigation materials, and generated intelligence reports are strictly confidential. They are NEVER used to train, fine-tune, or reinforce machine learning models or generative AI systems.
• No Data Reselling: Search queries and results generated by one client are never disclosed, resold, or shared with other clients or third-party organizations.

4. Data Retention and Automated Cryptographic Purging

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy or required by statutory compliance regulations:

• Client-Configured Retention: Clients can establish automated data retention policies within the portal to immediately purge scan artifacts after export or retain records across custom compliance audit windows.
• Cryptographic Security: All data is encrypted in transit using TLS 1.3 protocols and encrypted at rest using AES-256 standard encryption.
• Immutable Audit Logging: Audit logs recording search timestamps and user identifiers are maintained for compliance defensibility without storing unprotected raw payloads.

5. International Data Transfers and Sub-Processors

Diliguard infrastructure is hosted on secure cloud servers located within the European Union and the United Kingdom. Where data is transferred across international borders, Diliguard relies on Standard Contractual Clauses (SCCs) approved by the European Commission and the UK International Data Transfer Agreement (IDTA) to ensure equivalent data protection.

6. Your Statutory Rights

Under GDPR, UK GDPR, and applicable privacy laws, data subjects maintain the following legal rights regarding their personal data:

• Right of Access: You have the right to request a copy of the personal information Diliguard holds about you.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal records.
• Right to Erasure: You may request the deletion of your personal data where retention is no longer necessary or legally required.
• Right to Restriction and Objection: You may object to or request restriction of certain processing activities under specific statutory grounds.