Privacy Policy

We collect information you provide directly to us, such as when you create an account, compile your asset lists, submit vulnerabilities, or communicate with our support team. This includes:

• Account information (name, email, organization details)
• Asset information (domains, IPs, applications you authorize for testing)
• Vulnerability reports and security findings
• Communication records (support tickets, emails, chat logs)
• Usage data (platform interactions, feature usage, API calls)

We also automatically collect technical information including IP addresses, browser type, device information, and usage patterns to improve our services and security.

We use the information we collect to:

• Provide, maintain, and improve our continuous pentesting services
• Generate security reports and vulnerability assessments
• Communicate with you about your account, security findings, and service updates
• Process payments and manage billing
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations and enforce our terms
• Conduct research and analytics to improve platform performance

We do not sell your personal information or vulnerability data to third parties. Your security findings remain strictly confidential and are only shared with authorized personnel within your organization.

We implement industry-standard security measures to protect your information:

• Encryption: All data in transit uses TLS 1.3 encryption. Data at rest is encrypted using AES-256.
• Access Controls: Role-based access controls ensure only authorized personnel can access sensitive data.
• Authentication: Multi-factor authentication (MFA) is required for all accounts.
• Monitoring: Continuous security monitoring and intrusion detection systems.
• Regular Audits: Third-party security audits and penetration testing of our infrastructure.

While we take reasonable measures to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to maintaining the highest standards.

We do not share your personal information or vulnerability data with third parties except in the following circumstances:

• Service Providers: We may share data with trusted service providers who assist in operating our platform (e.g., cloud hosting, payment processing), subject to strict confidentiality agreements.
• Legal Requirements: We may disclose information if required by law, court order, or government regulation.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.
• Protection of Rights: We may share information to protect our rights, property, or safety, or that of our users or others.

Vulnerability data and security findings are never shared with third parties except as explicitly authorized by you or required by law.

Depending on your location, you may have certain rights regarding your personal information:

• Access: Request access to your personal information
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal information
• Portability: Request a copy of your data in a portable format
• Opt-out: Opt out of certain data processing activities
• Withdraw Consent: Withdraw consent where processing is based on consent

To exercise these rights, please contact us at [email protected]. We will respond to your request within 30 days.

We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this policy. Specifically:

• Account data is retained while your account is active and for 30 days after account closure
• Vulnerability reports and security findings are retained according to your subscription plan and may be archived
• Billing and payment records are retained as required by law (typically 7 years)
• We may retain anonymized or aggregated data for analytics purposes

BugValluk operates globally, and your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for international data transfers, including:

• Standard Contractual Clauses (SCCs) approved by relevant data protection authorities
• Compliance with GDPR, CCPA, and other applicable data protection laws
• Data processing agreements with all service providers

By using our services, you consent to the transfer of your information to countries that may have different data protection laws than your country of residence.

We use cookies and similar tracking technologies to enhance your experience, analyze usage patterns, and improve our services. You can control cookies through your browser settings, though disabling cookies may limit some platform functionality.

We use both session cookies (which expire when you close your browser) and persistent cookies (which remain until deleted or expired) for authentication, security, and analytics purposes.

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately at [email protected].

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

• Posting the updated policy on this page with a new "Last updated" date
• Sending an email notification to your registered email address
• Displaying a prominent notice on our platform

Your continued use of our services after changes become effective constitutes acceptance of the updated Privacy Policy.