Privacy Policy

1. Information we collect

We collect only what we need to provide and secure the service.

• Account information: name, email address and profile picture from your sign-in provider (for example Google), and your organization name.
• Service data: applications and domains you register, domain verification records, repository and deployment metadata, scan configuration, test results, findings and certificates.
• Usage and device data: IP address, browser type, pages visited, timestamps and diagnostic logs.
• Communications: messages you send to us and your notification preferences.
• Payment information: if you purchase a paid plan, payments are handled by our payment processor. We do not store full card numbers.

2. How we use information

• To provide, operate and maintain the service, including running security tests against hosts you have verified.
• To authenticate you, prevent fraud and abuse, and keep PreStrike secure.
• To communicate with you about your account, findings, updates and support requests.
• To improve and develop the service, and to analyze aggregated usage.
• To comply with legal obligations and enforce our Terms and Conditions.

We do not sell your personal information, and we do not use your service data to train third-party models.

3. Legal bases for processing

Where the GDPR or similar laws apply, we process personal data to perform our contract with you, for our legitimate interests (such as securing and improving the service), to comply with legal obligations, and with your consent where required.

4. Cookies and similar technologies

We use cookies that are necessary to keep you signed in and protect your session. We may use limited analytics to understand how the service is used. You can control cookies through your browser settings, though disabling necessary cookies may prevent sign-in.

5. How we share information

We share personal information only in these circumstances:

• Service providers who process data on our behalf, such as hosting, authentication, email, analytics and payment providers, under contractual confidentiality and security obligations.
• Members of your organization, according to the permissions your administrators set.
• Public certificates and badges, which show the security status and metadata you choose to publish for an application.
• Legal and safety reasons, where required by law or to protect rights, safety and security.
• Business transfers, such as a merger or acquisition, with notice to affected users.

6. Data retention

We keep personal information for as long as your account is active and as needed to provide the service. Scan results and findings are retained according to your plan. When you delete your account or request deletion, we delete or anonymize your data within a reasonable period, except where we must retain it for legal, security or accounting purposes. Backups are overwritten on a rolling schedule.

7. Security

We use industry-standard safeguards including encryption in transit, access controls, logging and least-privilege practices. No system is perfectly secure; if we become aware of a breach affecting your personal information, we will notify you as required by law.

8. International transfers

We may process and store information in countries other than your own. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses for transfers of personal data from the EEA, UK or Switzerland.

9. Your rights and choices

Depending on where you live, you may have the right to:

• Access, correct or delete your personal information.
• Export your data in a portable format.
• Object to or restrict certain processing, and withdraw consent at any time.
• Opt out of marketing emails using the unsubscribe link.
• Lodge a complaint with your local data protection authority.

To exercise these rights, contact us using the details below. We may need to verify your identity before responding. California residents may also have rights under the CCPA/CPRA; we do not sell or share personal information for cross-context behavioral advertising.

10. Children’s privacy

PreStrike is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us data, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. We will post the new version here and update the date above. For material changes we will give additional notice, such as by email.

12. Contact us

Questions or requests about this policy can be sent to [email protected].