Privacy Policy

1) Information We Collect

• Account Data: Required: email address. Optional: first and last name, organization, title. Passwords are stored in hashed form.
• Payment Data: Processed by our third-party payment provider. We do not store full card numbers. We keep basic transaction records.
• Usage & Logs: IP address, device/browser info, timestamps, actions (e.g., scan started/completed), error logs.
• Scan Data: Technical data gathered from targets you submit (e.g., headers, banners, responses, and vulnerability indicators) and the resulting reports.
• Cookies & Analytics: Strictly necessary cookies for authentication/session, and—where enabled—analytics cookies set by Google Analytics 4 to measure aggregate usage. You can disable non-essential (analytics) cookies; essential cookies are required for login.
• Cookie-Consent Records: When you make a cookie choice in our consent banner, we keep a record of that choice—including the categories you accepted or rejected, a timestamp, and the IP address and browser user-agent from which it was made—as a compliance audit trail. If you are signed in, this record is linked to your account; otherwise it is retained on an anonymous basis.

2) How We Use Information

• Provide, operate, secure, and improve the Services and your account.
• Send transactional emails (e.g., receipts, scan notifications, security alerts). Marketing emails only if you opt in; you can opt out at any time.
• Analyze aggregate usage to improve reliability and user experience (not for profiling or selling personal data).
• Investigate and prevent fraud, abuse, security incidents, or violations of the AUP/Terms; comply with legal obligations.

3) How We Share Information

• Service Providers (Sub-processors): We share information with vetted vendors who process it on our behalf, limited to what’s necessary and under confidentiality and security obligations. Our current sub-processors are:
  • Google Firebase Authentication — account authentication, including Google, Microsoft, Apple, and email/password sign-in.
  • Stripe — payment processing for subscriptions and credit purchases (including embedded checkout). Card data is handled by Stripe; we do not receive or store full card numbers.
  • HubSpot — customer relationship management, marketing email (where you opt in), and support ticketing.
  • Resend — delivery of transactional emails (e.g., receipts, verification, and scan notifications).
  • Cloudflare — DNS, content delivery, and network/security (WAF) protection for the Services.
  • Google Analytics 4 — aggregate usage analytics (only when analytics is enabled and you have not opted out of non-essential cookies).
  • Google reCAPTCHA Enterprise — abuse and bot protection on public forms (e.g., the contact/support form). Information submitted through protected forms may be processed by Google for this purpose, subject to Google’s Privacy Policy and Terms.
  This list may be updated as our vendors change; the current version is maintained in this Policy.
• Legal: In response to valid legal requests or to protect rights, property, or safety.
• Business Transfers: As part of a merger, acquisition, or similar transaction, with notice to you as required.
• With Your Consent: For integrations or sharing you initiate.

We do not sell personal information. Scan results remain confidential and are not shared externally without your direction, except as required by law.

4) Data Security

• TLS encryption in transit; encryption of sensitive data at rest where feasible.
• Hardened cloud infrastructure, least-privilege access, audit logging.
• No storage of full payment card data on our systems.
• While we use industry-standard safeguards, no method is 100% secure; you are responsible for using strong passwords and safeguarding credentials.

5) Data Retention

• Account data is retained while your account remains active and as required for legal/accounting purposes.
• Scan data/reports are retained for your access and may be subject to retention limits or archival; you can export reports at any time.
• Server logs are kept for a limited period for security and diagnostics.
• Backups are encrypted, retained briefly, and rotated.

6) Your Rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to certain processing. We will verify your request and respond within a reasonable period. You can opt out of marketing emails via the unsubscribe link. We will not discriminate for exercising rights.

To request deletion of your account and associated personal data, use our Request Account Deletion form. Deletion requests are currently reviewed and actioned manually by our team; we will verify the request against the account email before processing it.

7) International Transfers

We process data in the United States. By using the Services, you consent to transfer of your information to the U.S. and other locations where our providers operate. Where required, we use appropriate safeguards (e.g., SCCs). Service is unavailable in certain restricted jurisdictions (see Terms).

8) Children’s Privacy

The Services are not intended for children under 16. We do not knowingly collect personal information from children. If you believe a child has provided personal data, contact us to request deletion.

9) Changes to this Policy

We may update this Policy from time to time. Material changes will be posted in the Services or sent to your account email. Continued use after the effective date constitutes acceptance.