Legal

Privacy & Cookie Policy

Last updated: Sep 25, 2026

This website (skanslabs.com) is operated by La Costa Services, LLC (“Skans Labs”, “we”, “us”). This combined Privacy & Cookie Policy explains what we collect when you visit, how we use it, the cookies and local storage the site uses, and the rights you have under the EU/UK GDPR, California’s CCPA/CPRA, and Canada’s PIPEDA. It covers both this website and the Skans customer portal (your account); the Skans software you install is additionally governed by the Software License Agreement, and business customers are covered by our Data Processing Addendum.

What we collect

• Server logs. Our hosting provider records standard request data — IP address, browser type, and pages requested — kept briefly to operate and secure the site. This is the only information collected automatically from website visitors; the portal and your appliances’ check-ins record more, as described below.
• Messages you send. If you email us or submit the briefing form, we receive what you choose to provide — typically your name, email address, and message.
• Preferences. A light/dark theme choice in your browser’s local storage, and a small cookie recording that you acknowledged the cookie notice. Both stay on your device and neither identifies you.

We use Cloudflare Web Analytics, a privacy-first measurement tool that sets no cookies, does not fingerprint your device, and collects no cross-site or personally identifying data — only aggregate page metrics. Beyond that we run no advertising and no cross-site tracking, set no marketing cookies, and build no profiles of visitors.

Your account (the Skans customer portal)

When you create an account on the Skans customer portal we collect and hold the details you provide and generate in using it:

• Account details — your name, company, email address, phone number, and (optionally) postal address and country.
• Credentials — a password, stored only as a salted hash, and your multi-factor-authentication enrollment.
• Sign-in records — the IP address and approximate location, browser, and times you sign in, shown back to you in Settings so you can spot access you do not recognize.
• Sign-in through another provider — if you choose to sign in with Google, Microsoft, GitHub or your organization’s own identity provider, that provider sends us your email address, name and an account identifier, which we link to your portal account. Your password there never reaches us.
• Payments — purchases are processed by Stripe. You enter your card on Stripe’s checkout page, so we never receive or store your card number; we pass Stripe your email address and what you are buying, and we hold your Stripe customer reference, your purchases and subscriptions, and any PO or cost-center reference you add to a receipt.
• Licenses & appliances — the licenses issued to you and, for each appliance that checks in: its appliance id, the license key and edition it presented, its software version and update channel, the time of its first and latest check-in and how many times it has checked in, the IP address it checked in from, the country derived from that address, a flag if that address is on an IP reputation list, and a health summary made of counts only (devices, agents, agents pending, open and critical incidents, pending requests, a compliance percentage and whether backups are healthy) — no hostnames or addresses from inside your network.
• Sanitizer seats — for each Sanitizer seat that checks in: the license key, a fingerprint of the machine (a hash the app computes, not its name or address), the time of its first and latest check-in, when the seat was released if it was, the times of the copies it reports writing in the last 30 days (which is how the Community copy limit is kept), and, on an organization’s pooled license, which of that organization’s named people the seat belongs to. We do not record a seat’s IP address or country.
• Offsite Vault — if a site uses the Offsite Vault, we store the backups its appliance sends. They arrive already encrypted with a key that stays at your site; we hold no copy of that key and cannot read them. Each backup’s name is encrypted with the same key before it is sent, so we cannot read file names, host names, database names or paths either. What we do see is described next. Alongside each stored backup we keep only that encrypted name, keyed codes for its backup set and for the chain of database backups it belongs to that we cannot reverse, whether it is a full, differential, log or self-contained backup, a coarse type (configuration, database, disaster recovery or device), its size, its SHA-256 hash, when it was stored and its state; for the site, a random folder identifier, its storage region, usage and retention settings; the appliance credential used to upload (a revocable identifier and secret, not your license key) and the appliance identifier it was issued to; the IP address each upload request comes from; and an audit record of each download, retention change, enroll-code or credential issue or revocation, subscription lapse, vault deletion and integrity failure — who did it, when and from which IP address — kept for one year and visible to you in the portal. The backups of a site stored in the European Union region are stored only in the European Union; the records listed here are held in the United States for every site. Erasure: when the license owner deletes the site’s vault in the portal, its credentials are revoked at once and every stored backup is marked for deletion; once you destroy the site key, the stored backups are unreadable to anyone immediately, and we physically remove each one after its 14-day lock expires, normally within a day, so within about 15 days of the request. If the Offsite Vault subscription ends, we email the site’s license owner at once, who can take the subscription over during a 30-day read-only period; otherwise, after it, we keep the newest backups that fit in the storage the site’s edition includes, in whole restorable units (a full backup with the differential and log backups that depend on it), and delete the rest, as described in our Terms.

We use this to operate your account, issue and manage your licenses, secure the service, provide support, meet legal and tax obligations, and — unless you opt out — send service and CVE-watch email. The Skans appliance itself is built to keep your operational data on your own premises; it does not send your network’s contents to us. You can view, export, or delete this information at any time from your account Settings.

Cookies & local storage

We use only strictly-necessary storage — there are no analytics or advertising cookies, so there is nothing non-essential to opt into.

Our analytics provider, Cloudflare Web Analytics, is cookieless and so does not appear in the table above. You can clear the items that are listed at any time in your browser, and re-open the notice with the “Cookie preferences” link in the footer.

How we use information

To respond to your inquiries, to operate and secure the website, and to meet legal obligations. We do not use it for automated decision-making or profiling.

Legal bases (GDPR). Our legitimate interest in operating and securing the site (server logs); your consent or our legitimate interest in replying (messages you send); and legal obligation where applicable.

Sharing & processors

We share information only with service providers who help us run the site and email — for example Cloudflare (hosting, CDN and privacy-first analytics, and — for sites that use the Offsite Vault — storage of their encrypted backups in the United States or European Union region the customer chooses), Stripe (payment processing, billing contact and card data), our infrastructure hosts (account, licensing and Offsite Vault records, in the United States) — under confidentiality obligations; email is sent from our own mail server in the United States, or where required by law; business customers can rely on our Data Processing Addendum, which lists our sub-processors. We do not sell or “share” (as the CCPA/CPRA defines those terms) your personal information, and never have.

International transfers

La Costa Services, LLC is based in California, USA. If you contact us or use the portal from outside the United States, your information will be processed in the U.S. This includes Offsite Vault records for a site whose backups are stored in the European Union region; the backups themselves stay in the EU. Where the EU or UK GDPR requires a transfer mechanism, we use the Standard Contractual Clauses (with the UK Addendum where it applies). We are not certified under the EU-U.S. Data Privacy Framework.

Data retention

Server logs are kept briefly for security and then discarded. Messages you send are kept only as long as needed to handle your inquiry and meet legal obligations. Offsite Vault backups are kept under the site’s retention settings and the Terms; the Offsite Vault audit record is kept for one year.

Your rights

Everyone. You may ask us to access, correct, or delete the information you have sent us — email [email protected] and we will respond within the time your law allows.

EU / UK (GDPR). You have the rights of access, rectification, erasure, restriction, data portability, and objection, and the right to lodge a complaint with your supervisory authority.

California (CCPA/CPRA). You have the right to know, delete, and correct your personal information, and to opt out of its sale or sharing. We do not sell or share personal information, so there is nothing to opt out of; we also honor the Global Privacy Control (GPC) browser signal. Exercising any right will never result in discriminatory treatment.

Canada (PIPEDA). You may access the personal information we hold about you and withdraw consent, subject to legal and contractual limits.

Do Not Sell or Share My Personal Information. We do not sell or share your personal information for cross-context behavioral advertising, and we honor opt-out preference signals such as GPC — so there is nothing you need to do.

Email

We email you only in reply to your inquiry or with your consent. Any commercial email we send identifies us and includes an easy way to unsubscribe, consistent with the U.S. CAN-SPAM Act and Canada’s CASL.

Children

This site is intended for businesses and is not directed to children under 16; we do not knowingly collect their information.

Security

The site is served over HTTPS, and we apply reasonable safeguards to the limited information we hold.

Changes

We may update this policy from time to time; the “last updated” date above reflects the current version.

Contact

The data controller for skanslabs.com is:

La Costa Services, LLC
72811 Highway 111 # 1028
Palm Desert, California 92260-3312
United States
[email protected]

For privacy requests, put “Privacy request” in the subject.