TesseraPrivacy notice
Version under legal review. Last updated: 6 October 2026.
This is a courtesy translation of the Italian privacy notice. In case of any difference, the Italian version prevails.
Who processes the data
The data controller is Hyperion S.r.l., Piazza Santo Stefano 6, 20122 Milan, Italy, VAT no. IT14450290961. For any request, write to info@hyperionsrl.cloud or to the certified email address (PEC) hyperionsrl@pecaruba.it.
What data we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Address of the site to analyse and confirmation of authorisation | Running the Quick Check and producing the report | Performance of the requested service (Art. 6(1)(b) GDPR) |
| Results of the analysis: findings, page addresses, TLS output, PDF and web report | Delivering the report to you | Performance of the requested service (Art. 6(1)(b)) |
| Technical connection data: IP address, date and time, browser type, requests made | Security of the service, abuse prevention, troubleshooting | Legitimate interest of Hyperion (Art. 6(1)(f)) |
| Site of the monthly check, subscription status and your account email | Running the scheduled scans and emailing you the results or notices | Performance of the requested service (Art. 6(1)(b)) |
| Email and payment details received from Stripe (package, amounts, name or company name, VAT number and address, if provided), when you write to us or buy scans | Replying, crediting scans, support and accounting | Pre-contractual measures or performance of the contract (Art. 6(1)(b)) and tax obligations (Art. 6(1)(c)) |
We do not collect special categories of data and we do not use profiling cookies or traffic analytics tools. The site does not set cookies and the fonts are hosted on our own servers.
The report may contain technical information about the analysed site, for example internal page addresses, cookie names or code comments. Scans must only be requested for your own sites or sites you are authorised to test: see the terms of use.
Who we share it with
- Microsoft Azure: hosts the application, the report storage and the technical logs, in the Italy North region.
- Supabase, Inc.: handles sign-in with the email link and the database of accounts, scans, verified domains, payments and monthly checks. Supabase is based in the United States.
- Aruba S.p.A.: sends the sign-in and monthly check emails from the noreply@hyperionsrl.cloud mailbox.
- Anthropic PBC, through the Claude API: receives the address of the analysed site and the text of the findings (name, risk level, description and recommendation) to write the summary and, for reports in Italian, to translate the descriptions. It does not receive the content of the site's pages or the data of Tessera users. Anthropic is based in the United States.
- Stripe (Link, LLC, United States, and Stripe Payments Europe Ltd., Ireland): sells the scans as reseller (merchant of record) and handles payment, VAT, receipt and invoice. It receives your email, name or company name, VAT number if provided, billing address and card details, which Hyperion does not see. For the sale, fraud prevention and legal obligations it acts as an independent controller: see Stripe's privacy policy.
We do not sell the data and we do not use it to train models.
How long we keep it
- Reports: the access link expires after 7 days and the files are deleted automatically after 90 days.
- Technical logs: 30 days.
- Billing and payment data: 10 years, as required by Italian law (Article 2220 of the Civil Code).
- Contact emails: for as long as needed to handle the request.
- Monthly checks: for the duration of the subscription; after cancellation they stay in your account, with your history, until you ask for deletion.
Your rights
You can request access, rectification, erasure, restriction, portability and objection to processing (Articles 15-22 GDPR) by writing to the contacts above. If you believe the processing breaks the law, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it).