Privacy Policy

Privacy policy for the Excalion website and Chrome extensions by Oletros SAS.

Last updated: August 26, 2026

Identity and contact

Excalion is a product of Oletros SAS, registered office at 149 Avenue du Maine, 75014 Paris, France.

For any privacy-related inquiry: hello@excalion.io

Scope

This policy covers:

  • The Excalion website (excalion.io)
  • All Excalion Chrome extensions distributed via the Chrome Web Store or enterprise deployment

Each extension also has its own privacy policy accessible at /apps/[extension]/privacy-policy/. In case of conflict, the extension-specific policy prevails for that extension.

Data collected via the website

When you visit excalion.io, we may collect:

  • Technical data: IP address, browser type, operating system, pages visited, referring URL, timestamps
  • Analytics data: aggregated usage statistics to improve the website (no personal profiling)

We do not use tracking cookies. We do not collect personal information unless you voluntarily provide it (e.g. via a contact form).

Data collected via the extensions

Extensions with crowdsourced intelligence (12 out of 13)

Most Excalion extensions contribute anonymized scan findings to a shared intelligence database. This is opt-in by default with an explicit toggle to opt out in each extension’s settings.

What is sent:

  • Anonymized domain-level findings (security scores, detected vulnerabilities, tracker counts, compliance results)
  • Never: IP addresses, browsing history, page content, personal data, credentials, full URLs

What you get in return:

  • Crowdsourced blocklists (malicious domains, phishing, fraud patterns)
  • Domain reputation scores enriched by the network
  • Sector benchmarks and threat alerts
  • Trend history

If you opt out:

  • The extension works fully in local-only mode (scan, score, findings all computed locally)
  • You lose access to crowdsourced intelligence features
  • The trade-off is displayed clearly in the extension UI. No dark pattern.

Some extensions also query external databases in real time (PhishTank, OpenPhish, CVE databases, breach databases via k-anonymity). Only domain names or partial hashes are sent for these lookups, never personal data.

Invisible (100% offline)

Invisible is the exception. It makes zero network requests, collects zero data, and has no connection to the Excalion backend. All data stays in chrome.storage.local on your device.

ShadowSaaS (enterprise)

ShadowSaaS is deployed via MDM/GPO in enterprise environments. It sends anonymized SaaS detection data (canonical domains only, no employee identification, no full URLs) to the organization’s Excalion enterprise backend. See the extension-specific policy for details.

Data recipients

Your data may be accessed by:

  • Oletros internal teams for product development and support
  • Hosting provider: OVH SAS, 2 rue Kellermann, 59100 Roubaix, France
  • Authorities when required by law

We do not sell, rent, or share personal data with third parties for marketing purposes.

Data retention

Data type Retention period
Website analytics 12 months
Crowdsourced scan findings Aggregated and anonymized, retained indefinitely
Extension preferences Stored locally in your browser, deleted on uninstall
Contact inquiries 24 months

Your rights

Under the General Data Protection Regulation (GDPR), you have the right to:

  • Access your personal data
  • Rectify inaccurate or incomplete data
  • Erase your data (“right to be forgotten”)
  • Restrict processing of your data
  • Object to processing based on legitimate interests
  • Portability of your data to another service
  • Withdraw consent at any time (e.g. opt out of crowdsourced intelligence)

To exercise these rights, contact us at hello@excalion.io.

You may also file a complaint with the French data protection authority: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

Cookies

The Excalion website uses only strictly necessary cookies. No marketing or analytics cookies are set without your consent.

The extensions do not use cookies. They store data locally via chrome.storage.local.

Minors

We do not knowingly collect information from children under the age of 16. If you become aware that a minor has provided us with personal information, contact us and we will take steps to remove it.

The Excalion website and extensions may contain links to third-party websites. This policy does not apply to those websites. We recommend reading their privacy policies independently.

Changes to this policy

We may update this policy from time to time. Changes are posted on this page with an updated date. Continued use of the website or extensions after changes constitutes acceptance.

Applicable law

This policy is governed by French law. In the event of a dispute, the courts of Paris have exclusive jurisdiction.

The French version of this policy prevails over any translation.

Contact

Oletros SAS 149 Avenue du Maine, 75014 Paris, France hello@excalion.io