Controller

MB Codearmory, company code 306047013, Šumsko g. 166, LT-02196 Vilnius, Lithuania. Contact for any privacy question or request: info@codearmory.eu. This policy covers the data of StealthASF users (account holders and visitors). Data contained in pages that users retrieve through the Service is described in section 7 of the Terms: there the user is the controller.

What we collect and why

Data	Purpose	Legal basis (GDPR art. 6)
Email address, password (stored only as a salted hash), account and organisation name	Create and secure your account, contact you about it	Contract (b)
API keys (stored only as a hash and a short visible prefix)	Authenticate your API requests	Contract (b)
Request records: target URL, request settings, engine, status, usage, credits, time	Run and bill requests, show your history, prevent abuse	Contract (b); legitimate interest in security (f)
Credit ledger, plan, Stripe customer and subscription identifiers	Billing and accounting	Contract (b); legal obligation (c)
IP address and request metadata in web server logs; IP address held in memory for rate limiting and signup limits	Security, abuse prevention, troubleshooting	Legitimate interest (f)

We do not keep the content of the pages you retrieve, we do not sell personal data, and we do not use it for advertising. We do not use analytics or advertising trackers.

Cookies

One strictly necessary cookie, sasf_session, keeps you logged in (HTTP-only, expires after 7 days). No other cookies are set, so no cookie consent is needed.

Who processes data for us

Provider	Role	Location
Contabo GmbH	Server hosting (application and database)	Data centre in France (EU)
Stripe	Payments and billing portal; card details go directly to Stripe and never to us	EU entity; may transfer data to the USA under Standard Contractual Clauses
DataImpulse	Residential proxy network through which requests to target websites are routed; it receives no account data	Global network

How long we keep it

• Account, API key and request records: while your account exists; deleted within 30 days after you ask us to close it, except billing records.
• Billing and accounting records: 10 years, as required by Lithuanian accounting law.
• Web server logs: 14 days. In-memory rate-limit data: until the window expires or the server restarts.

Your rights

You may request access to, correction, deletion, restriction or a portable copy of your personal data, and object to processing based on legitimate interest, by emailing info@codearmory.eu. We answer within one month. You may also complain to the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt) or the authority of your country.

Security

Passwords and API keys are stored only as hashes, traffic is encrypted with TLS, the application runs in isolated containers without root privileges, and the browser engine's network access is restricted by a firewall.

Changes

We will post changes here and notify account holders by email of material changes.