Privacy Policy

This Privacy Policy applies when Lancaster Solutions LLC determines why and how personal information is processed through the Asuruas website, accounts, sales, support, security, and billing operations. When Asuruas processes personal information contained in Customer Data solely on a customer's instructions, the customer is the controller or business and Lancaster Solutions LLC acts as a processor or service provider under the Data Processing Addendum.

• Account and identity information, such as name, email address, organization, role, password hash, verification state, MFA state, and session records.
• Billing and subscription information, such as plan, billing interval, Stripe customer and subscription identifiers, invoice and payment status, tax information, and checkout records. Stripe receives payment-card details directly; Asuruas does not store full card numbers.
• Customer Data, such as websites, URLs, crawl scope, audit evidence, page content, structured data, technical metadata, screenshots, reports, findings, tickets, notes, integrations, and uploaded materials.
• Communications, such as contact, sales, onboarding, support, security, privacy, and feedback messages.
• Usage and device information, such as IP address, user agent, browser and device characteristics, authentication events, request and error logs, feature use, queue activity, and performance telemetry.
• Consent and preference records, such as accepted legal-document versions, cookie or local-storage choices, communication preferences, and suppression records.

• You, account administrators, and authorized users.
• Websites and systems that Customer authorizes Asuruas to assess.
• Service providers, including Stripe, Mailgun, Cloudflare, and infrastructure providers.
• Security, fraud-prevention, and public technical sources used to validate domains or respond to abuse.

• Create and administer accounts and organization workspaces.
• Verify website authority, run authorized audits, preserve evidence, generate reports, and support remediation workflows.
• Process subscriptions, invoices, payment status, plan entitlements, and cancellation.
• Send verification, security, billing, support, and other transactional communications.
• Secure the service, prevent abuse, troubleshoot, monitor availability, investigate incidents, and enforce agreements.
• Comply with law, respond to lawful process, establish or defend claims, and maintain required business records.
• Improve Asuruas using service telemetry and aggregated or de-identified information.

• Contract: processing needed to provide the service, administer subscriptions, and respond to requested support.
• Legitimate interests: securing and improving the service, preventing fraud, operating the business, and communicating with business contacts, balanced against individual rights.
• Legal obligation: tax, accounting, sanctions, lawful process, and legally required security or privacy responses.
• Consent: optional technologies or communications where consent is required. Consent may be withdrawn without affecting earlier lawful processing.

We disclose information to authorized users in the Customer workspace; subprocessors that host, secure, email, or bill for the service; professional advisers; transaction counterparties in a merger, financing, or sale; and authorities or other parties when required by law or reasonably necessary to protect rights, safety, and service integrity.

We do not sell personal information for money. We do not share personal information for cross-context behavioral advertising and do not use Customer Data for third-party advertising.

The current provider register is published at /legal/subprocessors. Provider-specific privacy terms may apply when you interact directly with Stripe-hosted checkout, Cloudflare verification, or another external service.

Asuruas uses necessary session cookies and browser storage for authentication, security, legal preferences, and optional checklist progress. Google Analytics 4 and Google Tag Manager are optional and remain disabled unless a visitor affirmatively selects Allow analytics. Advertising storage, advertising user data, and advertising personalization remain denied by default. Analytics disclosure added August 11, 2026. Details are in the Cookie Policy.

We retain information only as reasonably necessary for the purposes described, the selected plan, legal obligations, security, disputes, and backup lifecycle. Plan history windows concern access to audit history and do not necessarily define every security, billing, legal, or backup record. Specific periods and deletion stages are described in the Data Retention Policy.

A workspace deletion request is subject to identity and authority verification and a 14-day cancellation period. After execution begins, active-system deletion is targeted within 30 days. Protected backup copies expire through the documented backup cycle unless a legal hold or mandatory retention requirement applies. A durable deletion receipt may retain identifiers, timestamps, scope, checks, and cryptographic evidence without retaining the deleted workspace content.

Asuruas is operated from the United States. Providers may process information in the United States and other disclosed locations. Where applicable law requires a transfer mechanism, we rely on measures such as adequacy decisions, the EU Standard Contractual Clauses, the UK addendum, contractual safeguards, or an applicable data-privacy framework. Customers requiring a specific region or transfer arrangement should obtain a signed order before submitting covered data.

We use reasonable administrative, technical, and organizational safeguards designed for the service and risk, including access controls, password hashing, encrypted transport, tenant context and database controls, audit logging, backup safeguards, provider review, and incident procedures. No system can guarantee absolute security.

Depending on applicable law and your relationship with Asuruas, you may request access, correction, deletion, restriction, portability, or objection, or withdraw consent. You may also have a right to appeal a denied request or complain to a regulator. We may verify identity, authority, residency, and request scope and may decline or limit a request where law permits.

For Customer Data processed on behalf of a Customer, submit the request to that Customer first. We will assist the Customer as required by the Data Processing Addendum and applicable law.

Where a U.S. state privacy law applies, the categories described in this policy also describe the personal information collected, sources, purposes, and recipients. We do not sell personal information or share it for cross-context behavioral advertising. We do not discriminate for exercising a legally protected privacy right. Applicability depends on the law's scope and thresholds.

Asuruas is not directed to children under 13 and is not intended for use by minors. Do not submit children's personal information through the service unless legally necessary, properly authorized, and covered by an appropriate written agreement. Contact us if you believe a child provided information directly to Asuruas.

We assess suspected incidents and provide notices required by applicable law and contracts. If we process affected Customer Data as a processor, we notify the Customer without undue delay after confirming a personal-data breach affecting that Customer, subject to legitimate law-enforcement restrictions and the information available at the time.

Privacy requests and questions may be sent to clancaster@lancastersolutionsllc.com with the subject "Asuruas Privacy Request." We may update this policy as the service, providers, or law changes. Material changes will be posted with a revised version and effective date and may require renewed acceptance.

Effective August 9, 2026.