Privacy Policy

Account data: your name, email address, organization name, and authentication credentials (managed via our secure identity provider).

Target & scan data: the assets you register (domains, IPs, CIDR ranges, URLs, API specifications), ownership-validation records, scan configuration, findings, and reports generated for you.

Technical data: IP address, browser type, device information, and usage analytics collected when you access the platform.

Payments are processed by our payment processor (Stripe). We do not store or process your full card numbers, CVV, or other sensitive payment instrument data on our servers.

Stripe handles card data in compliance with the Payment Card Industry Data Security Standard (PCI DSS). We store only the identifiers returned by Stripe (such as a customer or subscription reference) needed to manage your billing and subscription.

We use your data to: provide and operate the scanning service; verify that you are authorized to test the assets you register; manage your account, subscriptions, and billing; deliver scan results and reports; improve and secure our platform; and comply with legal obligations.

We do not sell your personal data. We process your data only for the purposes described in this Policy.

We use session cookies (including HttpOnly, Secure, SameSite cookies) to keep you authenticated and protect your session. We also use essential cookies required for the functionality of the service.

Cookies used for authentication are cleared when you log out and do not persist beyond your session except where required to maintain your login.

You can control optional analytics cookies through your browser settings; however, disabling essential cookies may prevent the platform from functioning.

Scan logs (including terminal output and raw findings) are retained only as long as needed to deliver reports and support your account. Retention periods are defined per data category and aligned with your subscription lifecycle.

When you delete a target or your account, we make reasonable efforts to delete or anonymize associated target and scan data, except where we are legally required to retain records.

We implement appropriate technical and organizational measures, including encryption in transit and at rest, to protect your data against unauthorized access.

Depending on your jurisdiction (e.g., under the Brazilian LGPD or the EU/UK GDPR), you may have the right to access, correct, delete, or restrict the processing of your personal data, and the right to data portability.

You may withdraw consent at any time where processing is based on consent. You also have the right to lodge a complaint with your local data-protection authority (e.g., ANPD in Brazil or the relevant GDPR supervisory authority).

To exercise any of these rights, contact our team with your request; we will respond within the period required by law and verify your identity before actioning changes.

We engage processors to deliver the service, including our cloud hosting provider, our payment processor (Stripe), and LLM/AI model providers used to execute scans. Each processor is bound by appropriate data-processing terms.

We may update this Privacy Policy to reflect changes in our practices or legal requirements and will communicate material changes before they take effect.

For privacy inquiries or to exercise your rights, contact the Safe-say team. This Policy is governed by applicable data-protection legislation in the jurisdictions where Safe-say operates.