Privacy Policy

VAPT Insights ("we", "us", or "our") operates the platform available at vaptinsights.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read it carefully. If you disagree with its terms, please discontinue use of the Service.

We comply with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws.

2.1 Information You Provide Directly

• Account data — name, email address, company name, and password hash when you register.
• Billing data — payment method details processed by our PCI-compliant payment processor (Stripe). We do not store raw card numbers.
• Communications — emails, support tickets, and any content you send us directly.

2.2 Information Collected Automatically

• Usage analytics — page views and catalogued interactions with public navigation and calls to action collected via Google Analytics and Vercel Analytics. We do not send credentials, form contents, scan targets, or account identifiers as analytics event parameters.
• Log data — server logs including IP address (hashed for rate-limiting), browser type, and timestamps. Logs are retained for 30 days.
• Cookies and consent signals — session cookies support authentication. Google Analytics operates with analytics and advertising storage denied by default and may send restricted cookieless measurements; accepting analytics enables storage and full interaction measurement until you withdraw consent through Cookie settings.

2.3 Scan & Project Data

• SBOM files, dependency manifests, and scan reports you upload or generate are stored in your isolated project workspace and are never accessed by our team unless required for technical support with your explicit consent.
• Free in-browser tools (SBOM viewer, etc.) process all data entirely in your browser memory. Nothing is transmitted to or stored on our servers.

• To provide, operate, and maintain the Service.
• To process transactions and send billing receipts.
• To send transactional emails (account alerts, scan completions) via Resend and Zoho Mail using @vaptinsights.com addresses only.
• To analyse aggregate usage trends and improve product features.
• To measure which public calls to action contribute to registration, login, and security-scan interest and evaluate advertising performance.
• To enforce our Terms of Service and prevent fraud or abuse.
• To comply with legal obligations.

We do not sell, rent, or share your personal information with third parties for advertising or marketing purposes.

If you are located in the European Economic Area (EEA), we process your personal data under the following lawful bases:

• Contract performance — processing necessary to deliver the Service you subscribed to.
• Legitimate interests — fraud prevention, platform security, and product analytics.
• Legal obligation — retaining billing records as required by applicable tax law.
• Consent — for full Google Analytics interaction and advertising-performance measurement and where we send marketing emails.

We share data only with the following trusted sub-processors to operate the Service:

All sub-processors are contractually bound to process data only as instructed and maintain appropriate security standards.

Google Analytics consent is denied by default. Before acceptance, Google may receive restricted cookieless measurements used for aggregate modeling. Selecting Accept analytics enables full catalogued interaction measurement. Use the persistent Cookie settings control on any public page to decline or withdraw consent; subsequent full interaction events are then suppressed.

• Account and project data is retained for the lifetime of your account.
• Upon account deletion, all personal data, project configurations, and scan telemetry are permanently purged within 30 days.
• Billing records are retained for 7 years as required by applicable tax regulations.
• Server logs are purged after 30 days.
• Some data may be retained in fully anonymized or aggregated form for product improvement purposes only.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your personal data ("right to be forgotten").
• Restriction — request that we restrict processing of your data.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email us at [email protected]. We will acknowledge your request within 5 business days and fulfill it within 30 days.

CCPA residents have the right to know, delete, and opt-out of the sale of personal information. We do not sell personal information.

We implement industry-standard technical and organizational measures to protect your data including AES-256 encryption at rest, TLS 1.3 in transit, Row-Level Security (RLS) database isolation, Content Security Policies, rate limiting, and regular security scanning. However, no transmission over the Internet is 100% secure and we cannot guarantee absolute security.

Your data is stored and processed in the United States via our infrastructure providers. If you are located in the EEA or United Kingdom, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to legitimize such transfers.

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us immediately and we will delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page and, where material changes occur, notify registered users by email. Continued use of the Service after changes constitutes acceptance of the revised policy.

If you have any questions, concerns, or requests regarding this Privacy Policy, or if you need to contact our Data Protection Officer (DPO) / Grievance Officer, please reach out to us using the details below. We are committed to addressing your query within 24 hours.