Privacy Policy

Drel is an AI-native security assessment platform operated by Atela Capital S.L., registered in Madrid, Spain ("Drel", "we", "us"). For data protection purposes, Atela Capital S.L. is the data controller.

We take privacy seriously — we collect only what we need to operate the service, we don't sell your data, and we give you control over what you share with us.

This policy explains what data we collect, why we collect it, how we use it, and your rights as a user. If you have questions, reach out at hello@drel.ai.

Account data. When you sign up, we collect your email address and, optionally, your name and company. This is used to authenticate you and communicate with you about your account.

Assessment inputs. When you generate an AI Security Review, we process the system description and questionnaire answers you provide. This content is used solely to generate your AI Security Review and improve our AI models (see AI training below).

Usage data. We collect standard analytics — pages visited, features used, session duration, and error logs. This helps us understand how the product is used and where to improve it.

Payment data. Billing is handled by Stripe. We store only a reference to your Stripe customer ID — we never see or store your full card number.

Support communications. If you contact us by email, we retain those messages to resolve your issue and improve our support.

We do not train any model on your data. Drel runs no model-training pipeline — your documents and assessment inputs are used only to generate your AI Security Review, and for nothing else.

Generation runs on AWS Bedrock, which does not use your inputs or outputs to train its foundation models and does not retain them after processing. Processing happens in the EU (eu-west-1 / eu-central-1) by default.

We do not share your raw assessment content with third parties for any purpose.

We use the data we collect to:

• Provide and operate the Drel service • Authenticate your account and protect against unauthorized access • Generate AI Security Reviews based on your inputs • Send transactional emails (account confirmation, billing receipts, password reset) • Send product updates and announcements (you can unsubscribe at any time) • Improve the product through usage analytics • Respond to support requests • Comply with legal obligations

If you are in the EEA, UK, or Switzerland, we process your data under the following legal bases:

Contract performance (Art. 6(1)(b)). Creating your account, generating AI Security Reviews, processing payments, and providing customer support — these are necessary to deliver the service you signed up for.

Legitimate interest (Art. 6(1)(f)). Product analytics, security monitoring, and service improvement. We have assessed that these interests do not override your rights and freedoms.

Consent (Art. 6(1)(a)). Marketing communications and non-essential analytics cookies. You can withdraw consent at any time without affecting the lawfulness of prior processing.

Legal obligation (Art. 6(1)(c)). Retaining billing records for tax compliance and responding to lawful government requests.

We do not sell your personal data. We share data only with the following categories of service providers, under strict data processing agreements:

Infrastructure. We use AWS and Vercel to host the application and store data. Data is stored in the EU (eu-west-1) by default.

Payments. Stripe processes all billing. Their privacy policy applies to payment data.

Analytics. We use privacy-focused analytics tools that do not track individuals across sites.

AI providers. Assessment generation uses large language model APIs. Inputs are sent to these providers under data processing agreements that prohibit training on your data.

We may disclose data if required by law, court order, or to protect the rights and safety of Drel and its users.

We retain your account data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where we are required to retain it for legal or financial compliance purposes (typically up to 7 years for billing records).

Assessment packs are retained for the duration of your subscription. On the Evaluation tier, AI Security Reviews are retained for 90 days. You can export or delete your assessments at any time from the dashboard.

If you are in the EEA, UK, or Switzerland, you have the following rights under GDPR:

• Access (Art. 15). Request a copy of the personal data we hold about you. • Rectification (Art. 16). Ask us to correct inaccurate or incomplete data. • Erasure (Art. 17). Request deletion of your personal data ("right to be forgotten"). • Portability (Art. 20). Receive your data in a structured, machine-readable format. • Objection (Art. 21). Object to processing based on legitimate interests. • Restriction (Art. 18). Ask us to restrict processing in certain circumstances. • Withdraw consent (Art. 7(3)). Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email hello@drel.ai with subject line "Privacy Request". We will respond within 30 days as required by law. We may ask you to verify your identity before processing the request.

Supervisory authority. You have the right to lodge a complaint with your local data protection authority. In Spain, this is the Agencia Espanola de Proteccion de Datos (AEPD) at https://www.aepd.es.

We use a minimal set of cookies:

Essential cookies are required for the service to function — session authentication and CSRF protection. These cannot be disabled.

Analytics cookies help us understand how the product is used. In the EU/EEA, the UK and Switzerland they are set only after you actively accept them — you'll see a cookie preferences prompt on your first visit. Elsewhere they are set by default and you can decline at any time using the Cookies link in the site footer. Your choice is remembered for a year and applies across drel.ai and app.drel.ai.

We do not use advertising or tracking cookies. We do not participate in cross-site tracking networks.

For the full inventory of cookies we set, including names, purposes, and durations, see our Cookie Policy.

We apply industry-standard security practices to protect your data:

• All data in transit is encrypted with TLS 1.2+ • Data at rest is encrypted using AES-256 • Access to production systems is restricted to authorized personnel with MFA • We conduct regular security assessments of our own infrastructure (we use Drel for this) • Vulnerability disclosures can be sent to security@drel.ai

No system is perfectly secure. If you believe you have found a security issue, please report it responsibly before public disclosure.