How DAEDALUS handles customer data.

Submitted inspection data is used to run DAEDALUS.

DAEDALUS may store the submitted URL, purchaser name, legal business or organization name, purchaser role, business-use and purchasing-authority declarations, inspection claims, authority proof status, evidence artifacts, report records, verification activity, and payment or package-access records.

Owner and client surfaces are separated.

Owner dashboards, confidential exports, operational error ledgers, and proof-bundle controls are restricted to owner access. Client report access is limited to the matching proof-room or intentional share path.

Live secrets should not be submitted for routine inspection.

DAEDALUS expects sandbox evidence or controlled proof artifacts for payment and restricted workflows. Live API keys, passwords, and payment credentials should not be placed in ordinary intake fields.

Payment and email providers process their parts of the workflow.

Stripe handles checkout, hosted invoices, subscriptions, and payment confirmation. Resend handles outbound report-share email when configured. DAEDALUS stores provider references such as payment status, invoice IDs, checkout session IDs, and email message IDs; it does not store full card numbers.

Stripe Checkout collects the billing address used for a card purchase. When a customer requests a hosted invoice, DAEDALUS sends the submitted business billing address to Stripe and retains only the billing-location evidence needed for payment, compliance, and audit records.

Shared report links and verification pages create activity records.

When a report is printed, shared, opened, verified, or emailed, DAEDALUS may record the event, timestamp, report ID, and proof movement status. These records support integrity, custody, and owner dashboard rollups.

Private proof is retained only while its approved lifecycle requires it.

Reports, evidence, verification activity, authority records, proof packets, and payment-boundary records may be retained so DAEDALUS can show what happened later. When an authorized deletion or approved deadline applies and no hold prevents it, DAEDALUS removes customer identity and private report evidence. It keeps only the report ID, issue date, declared scope, verdict, original integrity marker, and a status explaining that the private report was removed.

Minimum invoice, contract, tax, dispute, fraud, security, or legal-hold evidence may remain for its applicable duty. Exact periods still require the published policy and governing legal/accounting rules. Stripe, Resend, deployment logs, and backup copies may follow separate provider schedules.

Customers can ask about access, export, correction, or deletion.

Send privacy and stored-record requests to admin@pathionlabs.com. DAEDALUS verifies the requester against a stable customer account, inventories the linked records, prepares a protected export, checks legal or operational holds, and previews the exact deletion scope before execution. A deletion request is not marked fulfilled until the application records a completed receipt and verifies that customer access and private evidence were removed. Some minimized financial or legal evidence may remain with its retention basis recorded.

Do not submit private production credentials.

Routine inspection is designed for public web surfaces and controlled evidence. Customers should redact unrelated personal data and use sandbox or purpose-built evidence for restricted workflows whenever possible.