Privacy Policy
Last updated: 3 October 2026
Vaydel is a brand owned and operated by Digitize Solutions, a company registered in Lebanon ("we", "us", "our"). This policy explains what personal data we collect through vaydel.com and the Vaydel platform, why, and what rights you have. Contact us any time at [email protected].
1. Two roles, two kinds of data
- We are the controller of data about our website visitors, the people who chat with our website assistant, and our clients' account users (the people who sign up and manage a Vaydel account). This policy covers that data.
- We are a processor for the data of our clients' employees who receive simulated phishing emails and training. Our client (their employer) decides what is processed and why; we act only on its instructions under our Data Processing Addendum. If you are such an employee, please contact your employer first; we'll help them answer your request. Section 9 summarizes how we handle that data.
2. What we collect, and where it comes from
| Data | Examples | Source |
|---|---|---|
| Account data | Name, work email, role/title, company name, company domain, registration country and number, phone (if given) | You, at signup |
| Login and security data | Hashed password, one-time verification codes, session cookies, sign-in timestamps, IP address | You and your browser |
| Billing data | Name, email, country, postcode, plan, subscription and payment status, invoices | You via Paddle's checkout; Paddle tells us the outcome. We never see or store your card details. |
| Messages | Emails to support, messages you send to our website assistant, and contact details you choose to leave there (name, email, company) | You |
| Usage and audit data | Actions taken in your account (e.g. employee list imported, campaign created), with time and user | Our platform |
| Technical data | IP address, browser and device type, pages requested, error logs | Your browser, our servers and Cloudflare |
We don't knowingly collect special categories of data (health, religion, biometrics, etc.), and we don't buy personal data from data brokers.
3. Why we use it, and our legal basis
Where the EU or UK GDPR applies, we rely on these legal bases. In Lebanon, we process data in line with Law No. 81/2018 on Electronic Transactions and Personal Data.
| Purpose | Legal basis |
|---|---|
| Creating and running your account, delivering the service, reporting | Performance of our contract with you |
| Verifying your company domain and identity, preventing fraud and abuse (a simulated-phishing platform must not be used against people who haven't authorized it) | Legitimate interests; contract |
| Billing, invoicing, tax and accounting records | Contract; legal obligation |
| Answering your questions and following up when you ask us to (support, website assistant, sales enquiries) | Legitimate interests; steps before a contract at your request |
| Service emails (verification codes, password resets, reports, billing notices) | Contract |
| Keeping the platform secure, fixing errors, improving the service | Legitimate interests |
| Complying with the law and responding to lawful requests | Legal obligation |
We don't sell personal data, we don't show advertising, and we don't use your data for profiling with legal or similarly significant effects.
4. AI features
Some features use an AI model provided by Anthropic (Claude) through its commercial API: generating simulation and training content, explaining to an employee what they missed, writing report summaries, and our website and dashboard assistants. We send only what each task needs, not full records. Under Anthropic's commercial API terms, data sent through the API is not used to train its models.
5. Who we share data with
We use these service providers ("sub-processors"), each only for its function:
| Provider | What for | Location |
|---|---|---|
| Amazon Web Services (AWS) | Hosting, database, file storage, and sending email (Amazon SES) | European Union (Ireland) |
| Cloudflare | Domain name service, content delivery, and protection against attacks | Global network |
| Anthropic | AI features (Section 4) | United States |
| Paddle | Checkout, payments, tax, invoicing and refunds, as our Merchant of Record | United Kingdom and its processors |
| Zoho | Our support mailbox ([email protected]) | Depends on Zoho's data centre for our account |
Paddle acts as an independent controller for the data you enter at checkout; its privacy policy applies to that data. We may also disclose data where the law requires it, to protect our rights or users' safety, or to a buyer of our business (who would remain bound by this policy).
6. International transfers
Our platform's data is stored in the European Union (AWS, Ireland), and our team operates from Lebanon. Some providers above are located outside the EU. Where EU/UK personal data is transferred to a country without an adequacy decision (including Lebanon), we rely on the European Commission's Standard Contractual Clauses or other safeguards recognized by applicable law. You can ask us for a copy of the relevant safeguards.
7. How long we keep data
| Data | Kept for |
|---|---|
| Account and usage data | While your account is active, then up to 12 months (for support, disputes and security), then deleted or anonymized |
| Campaign and training data of client employees | As set in the client's agreement (by default 12–24 months from collection), or earlier at the client's request |
| Billing records | As long as tax and accounting law requires (Paddle keeps the transaction records it is legally required to keep) |
| Website-assistant leads and support emails | Up to 24 months after our last contact, unless you become a client |
| Security logs | Up to 90 days |
| Verification and sign-in codes | Minutes; they expire after use |
8. Cookies
We use only cookies needed for the site to work, and no advertising or analytics cookies:
| Cookie | Purpose |
|---|---|
vaydel_session | Keeps you signed in to your account |
vaydel_admin_session | Keeps our staff signed in to the internal console |
vaydel_signed_in | Tells our website you're signed in, so it shows your dashboard instead of the sign-up pages. It holds no personal data and grants no access by itself |
vaydel_locale | Remembers your language choice |
When you open checkout, Paddle sets its own cookies to process the payment securely, and Cloudflare may set security cookies to protect the site from attacks.
9. Data of our clients' employees (as processor)
When a client runs a simulation, we process its employees' names, work email addresses, department (if provided), interactions with the simulation and training (sent, opened, clicked, training completed, quiz results), and the IP address and browser of a tracked click. We process this only to deliver the service to that client, under its instructions and our Data Processing Addendum. Simulated landing pages never ask for real passwords or payment details. Employees can exercise their rights through their employer, and we will assist.
10. Security
We protect data with encryption in transit (TLS) and at rest, access controls with one-time codes for staff, hashed passwords, httpOnly session cookies, audit logs of account actions, rate limiting, and attack protection. No system is perfectly secure; if a breach affects your personal data, we will notify you and the competent authority where the law requires.
11. Your rights
Depending on where you live, you can ask us to: access your data; correct it; delete it; restrict or object to its use (including any use based on legitimate interests); receive it in a portable format; and withdraw consent where we rely on it. Email [email protected]; we'll answer within 30 days and may need to verify your identity. You can also complain to your data protection authority (in the EU, the authority of your country; in Lebanon, under Law No. 81/2018).
12. Children
Vaydel is a business service and isn't intended for anyone under 18. We don't knowingly collect children's data.
13. Changes
We'll post any update here with a new "last updated" date, and tell account holders by email before material changes take effect.
14. Contact
Digitize Solutions (Vaydel) · [email protected]