This site runs zero trackers. Here is every datum our forms accept, why we ask for it, and how to erase it.
This notice governs the public website at eventlakes.com, where EventLake acts as the Data Fiduciary for visitors who submit an enquiry, request a time-bound trial licence, or file a vulnerability report. For how the EventLake security platform handles telemetry inside a customer deployment, read Trust.
1 · Passive browsing: what we do not collect
Reading any page on this website sets no cookies, loads no third-party scripts, fonts, or pixels, and sends no telemetry to any advertising or analytics network.
Local UI preferences only
Interactive calculators (Pricing, Sizing) and optional audio cues keep your selections in your own browser’s localStorage or sessionStorage so a page refresh does not reset your work. Those values never leave your device unless you explicitly submit a form.
Strict same-origin enforcement
The origin enforces default-src 'self'; script-src 'self'; connect-src 'self'. Fonts and SVGs are self-hosted from our own tree; no browser request crosses to an external font or analytics provider.
Ephemeral peer budgets
To protect public forms against automated floods, our reverse proxy and API maintain bounded, in-memory token buckets keyed by peer IP address. Rate-limit counters are ephemeral and are not joined to marketing profiles.
2 · Interactive doors: what each form collects and why
Personal data enters our systems only when you fill in a form and press submit, or when you use one of the zero-install verification tools below.
| Surface & Endpoint | Fields Accepted | Purpose & Lawful Basis | Storage & Retention |
|---|---|---|---|
Book a demo / Commercial enquiryPOST /v1/leads/demo |
Work email (required), mobile number (required), name, company, role, optional sizing notes, explicit consent checkbox. | Responding to your commercial or architectural enquiry and scheduling a walkthrough you asked for (consent under the DPDP Act). | Stored in our bounded lead store with your consent timestamp. Encrypted under a per-subject key when the keystore is active so erasure destroys the key. |
Time-bound trial licencePOST /v1/trials/request(Trial licences) |
Work email, company, deployment posture (on-premise or SaaS), optional sizing estimate. | Issuing and delivering a time-bound evaluation licence key and onboarding instructions you requested. | Recorded in the trial-request ledger for the lifecycle of the evaluation licence and any follow-on commercial agreement, or until you request erasure. |
Vulnerability disclosure (VDP)POST /v1/trust/vdp(Security) |
Affected surface, severity, description, reproduction steps, and optional reporter handle or contact email. | Triaging, reproducing, and remediating reported security defects, and acknowledging the finder when contact details are supplied. | Assigned a tracking reference (EL-VDP-…) in our PSIRT intake queue. You may submit anonymously by leaving the contact field blank. |
Link & message reputation checkersPOST /v1/reputation/checkPOST /v1/message/check(Check a message) |
A URL, domain, IP, hash, or pasted message text containing up to 25 extracted indicators. | Checking whether an indicator appears in our shareable threat-intelligence set at your request. | Stateless: evaluated in memory inside the HTTP request and dropped when the response is written. Nothing from your pasted text is stored. |
Stop a reportPOST /v1/report/unsubscribe(Stop a report) |
Recipient address or signed unsubscribe token from a scheduled email report. | Immediately halting automated report delivery to an address you control. | Records the suppression entry so the scheduler refuses future mail to that address; returns a constant confirmation sentence to prevent address enumeration. |
Encrypted DNS setup checkPOST /v1/dns/setup-check(Encrypted DNS) |
A single-use verification nonce generated in your browser during resolver setup. | Confirming whether your device’s DNS queries are arriving over DoH/DoT. | Holds the random nonce in a bounded in-memory set for the duration of the setup check; stores no browsing history. |
3 · Your rights as a Data Principal (DPDP Act)
Under the Digital Personal Data Protection Act (and equivalent data-protection regimes), you have the right to know what personal data we hold about you, to correct or update it, to withdraw consent, and to have it erased.
Ask what we hold
Write to contact@eventlakes.com from the email address you submitted. We will return the exact record held in our lead, trial, or VDP store and update any inaccurate field.
Crypto-shredding & deletion
Send an erasure request to contact@eventlakes.com. Where your contact details are sealed under a per-subject key, fulfilling erasure destroys that key so the ciphertext is permanently unreadable across live storage and backups.
No unsealed storage when configured
When a node is configured with a per-subject keystore and that keystore is unavailable, our intake endpoint refuses the submission (HTTP 503) rather than quietly writing personal data in cleartext without an erasure key.
Direct escalation path
If a privacy or erasure request is not resolved to your satisfaction, address your grievance to the Data Protection Officer at contact@eventlakes.com. Every commercial lapse leaves our privacy and obligation plane active (For auditors).
4 · Website visitor data vs. Customer platform data
We keep a strict architectural boundary between our own commercial intake on eventlakes.com and the security telemetry processed inside an EventLake customer deployment:
You are the sole controller & custodian
When you run EventLake on-premise, the software runs on disks and networks you control. EventLake receives zero telemetry, zero user identifiers, and zero phone-home beacons from your estate.
Governed by your customer agreement
When we operate EventLake as SaaS for your organisation, we act under your customer agreement. Device serials, phone numbers, SIM identifiers, and MAC addresses are dropped at ingest rather than stored (see the field-by-field table on Trust).