Privacy Policy

This Privacy Policy explains how AIPentest (“we”, “us”) collects, uses, and shares information when you use our website, dashboard, and scanning service. By using the product you agree to this policy. For rules about using the product, see our Terms and Conditions.

• Account data — name, email, display name, and authentication details (including Google sign-in identifiers when you choose that method). Authentication is handled by Supabase Auth.
• Scan data — target URLs, project names, ownership-verification artifacts, scan status, findings, reports, and related metadata you submit or that agents generate.
• Test credentials — optional test-account emails and passwords you provide for authenticated testing. Credentials are intended to be stored in an encrypted vault; they must not be production secrets.
• Billing data — unlock and subscription records and payment status when you purchase a brief or plan. Card details are processed by the payment provider; we do not store full card numbers.
• Technical data — IP address, browser/device info, cookies/session tokens, and basic logs needed for security and reliability.

• Provide, secure, and improve authorized scans, findings, and reports
• Authenticate users, enforce ownership checks, and prevent unauthorized testing
• Process paid unlocks, subscriptions, and usage limits
• Send transactional email (confirmations, password resets, security notices)
• Comply with law and enforce our Terms

We do not sell your personal information. We do not use your application source code or production customer data to train a public foundation model. Scan context sent to AI systems is scoped and sanitized; raw passwords and session tokens are not placed in LLM prompts.

We share data only as needed to run the service, including with:

• Infrastructure providers (hosting, database, and auth — currently including Supabase) that process data under contract
• Payment processors for checkout when you purchase an unlock or plan
• Email delivery for transactional messages (including auth emails sent via Supabase)
• AI / model providers that help generate findings and fix guides from sanitized scan context
• Authorities when required by law or to protect rights and safety

We use cookies and similar technologies for authentication, session security, and basic site function. You can control cookies in your browser; disabling them may prevent sign-in or dashboard use.

We keep account, scan, finding, and billing records for as long as your account is active and as needed for operations, dispute resolution, security, and legal obligations. Scan findings and reports are stored in your project database under row-level security so other customers cannot read them. You may request account deletion by contacting us; some records may be retained where required by law or for legitimate business needs (for example, completed payments).

We use industry-standard measures such as encryption in transit, row-level access controls, ephemeral scan workers, and encrypted storage of test credentials (as that vault ships). No method of transmission or storage is 100% secure; please protect your password and do not submit production secrets.

• Update profile details in your account settings
• Request access, correction, or deletion by contacting us
• Depending on your location, you may have additional rights under applicable privacy laws

We may process information in the United States and other countries where our providers operate. If you access AIPentest from elsewhere, you understand your information may be transferred to those locations.

AIPentest is not directed to children under 16 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children.

We may update this Privacy Policy. Material changes will be reflected by the “Last updated” date on this page. Continued use after changes constitutes acceptance.

Privacy questions: hello@aipentest.app.