Privacy Policy

1. Who we are

Mycelia Networks (“Mycelia”, “we”, “us”) operates the website mycelia-networks.com and the Sentra platform, an external attack surface management and remediation service. Operator: Mycelia Networks, Barcelona, Spain. For any privacy matter, contact us at privacy@mycelia-networks.com.

2. What data we collect

• Account data: name, email address, password (stored hashed), company name and plan information when you register.
• Scan data: the domains you submit for scanning and the technical results our scanner collects about those domains (DNS records, certificates, exposed services, security headers). This information relates to internet-facing infrastructure, not to private systems.
• Billing data: processed by our payment provider (Stripe). We do not store card numbers.
• Usage data: log and device information needed to operate, secure and improve the service (IP address, browser type, pages visited, timestamps).
• Communications: messages you send us via the contact form or email.

3. Why we process it (legal bases under GDPR)

• To provide the service you contracted (Art. 6(1)(b) — contract).
• To secure our platform, prevent abuse and keep audit records (Art. 6(1)(f) — legitimate interest).
• To comply with legal obligations, including tax and accounting (Art. 6(1)(c)).
• To send product updates or marketing only where you have consented (Art. 6(1)(a)) — you can withdraw consent at any time.

4. Who we share it with

We use a small number of processors to run the service, under data processing agreements: cloud hosting and database (Railway, Supabase), payments (Stripe), transactional email (Resend), content delivery and DNS (Cloudflare), and AI analysis of scan results (Anthropic). We do not sell personal data. We may disclose data where required by law or competent authority.

5. International transfers

Where a provider processes data outside the EU/EEA, transfers rely on adequacy decisions or Standard Contractual Clauses.

6. Retention

Account data is kept while your account is active and for the period required by law after closure. Scan results are retained according to your plan and deleted on account deletion or on request, except where we must keep records for legal or security-audit purposes.

7. Your rights

You may request access, rectification, erasure, restriction, portability, and object to processing by writing to privacy@mycelia-networks.com. You also have the right to lodge a complaint with the Spanish supervisory authority (AEPD, aepd.es).

8. Security

We apply technical and organisational measures appropriate to the risk, described on our Security page, including encryption in transit and at rest, tenant isolation and audit logging.

9. Changes

We will post any changes to this policy on this page and update the date above. Material changes will be notified to registered users by email.