Privacy Policy
Effective as of
1. Introduction
PentestCheck is a continuous, automated security validation platform operated by IBLabs (“we”, “our”, “us”). This Privacy Policy explains how we collect, use, store and protect the personal data of people who visit https://pentestcheck.com and use the application at https://pentestcheck.com.
IBLabs is the controller of the personal data described in this policy. It applies to visitors and users everywhere, including the European Economic Area (EEA), the United Kingdom, Brazil and California. We may update it from time to time; when we do, we will publish the new version on this page with a new effective date.
2. Data we collect
We collect three categories of personal data:
2.1 Account data
- •Name and email address (required for registration)
- •Organization name (optional)
- •Billing data processed by a third-party payment gateway (we do not store card data)
- •Authentication logs (IP address, timestamp, user-agent)
2.2 Scan operation data
When you run a scan, we collect and store the following operational data:
- •Target domains submitted for scanning
- •Subdomains discovered during execution
- •IP addresses and ports identified
- •Technologies and HTTP headers detected (fingerprinting)
- •Vulnerabilities found, including CVEs and misconfigurations
- •Threat Score calculated (0–10) per execution
- •Execution metadata: duration, engines used, timestamps
2.3 Usage data (only with your consent)
If you accept optional cookies, we collect information about how you use our website and app: pages viewed, features used, sign-ups, scans started, checkouts, the ad campaign that brought you to us, device and browser type, and approximate location derived from your IP address. We never send your name, email address, scan targets or authentication tokens to these tools.
3. How scan data is handled
All scan data is strictly isolated per organization. A user from one organization never has access to scan data from another organization.
We do not sell, license, or share scan data with third parties, including advertisers, data brokers, or competitors.
We use scan data exclusively to: (a) display results in the interface, (b) generate PDF reports, (c) compute diffs between scan runs, and (d) send alerts via the webhook configured by the user.
4. PDF Reports
PDF reports are generated on demand and available for download while the account is active.
After deletion, the associated data is removed from our systems within 90 days.
5. Webhooks and integrations
The platform allows configuring webhook URLs to receive alert notifications in external services (Slack, Discord, Telegram, proprietary systems).
Review the privacy policies of destination platforms before configuring webhooks to third-party services.
6. Retention and deletion
After subscription cancellation, data is available for a grace period of 30 days.
To request immediate deletion of data, please contact our team.
Analytics data in Google Analytics 4 is kept for 14 months and then deleted automatically. If Microsoft Clarity is enabled, its data is kept for Clarity's standard retention periods set by Microsoft.
8. Legal bases for processing
Under the EU GDPR, the UK GDPR and Brazil's LGPD, we rely on the following legal bases:
- •Contract — to create and run your account, perform the scans you request, generate reports and process payments (GDPR / UK GDPR Art. 6(1)(b); LGPD Art. 7, V).
- •Legitimate interests — to secure the platform, prevent fraud and abuse, keep authentication logs and send essential service messages (GDPR / UK GDPR Art. 6(1)(f); LGPD Art. 7, IX). You can object to this processing at any time.
- •Consent — for the analytics and ad-measurement cookies and tools described in section 7 (GDPR / UK GDPR Art. 6(1)(a), together with the EU ePrivacy rules and the UK PECR on cookies; LGPD Art. 7, I). They only run after you click “Accept”, and you can withdraw your consent at any time in “Cookie preferences”.
- •Legal obligation — to keep billing and tax records (GDPR / UK GDPR Art. 6(1)(c); LGPD Art. 7, II).
9. International transfers
Some of the providers we rely on process personal data outside the country where you live. In particular, Google and Microsoft (the optional tools in section 7) and our payment processor operate servers outside Brazil, the EEA and the UK, including in the United States. Where the law requires it, these transfers are covered by appropriate safeguards offered by those providers, such as the European Commission's Standard Contractual Clauses (with the UK Addendum), and by the transfer mechanisms allowed under LGPD Art. 33.
10. Your privacy rights
Depending on where you live, you have the rights below. Exercising them is free, and we will never treat you differently for doing so.
EEA and UK (GDPR / UK GDPR)
- •Access — get a copy of the personal data we hold about you.
- •Rectification — have inaccurate or incomplete data corrected.
- •Erasure — have your data deleted when there is no longer a reason for us to keep it.
- •Restriction — ask us to limit how we use your data, for example while a request is being resolved.
- •Objection — object to processing based on our legitimate interests.
- •Portability — receive the data you gave us in a structured, machine-readable format, or have it sent to another provider.
- •Withdrawal of consent — at any time, for anything based on consent (see “Cookie preferences”).
Brazil (LGPD)
- •Confirmation that we process your data, and access to it.
- •Correction of incomplete, inaccurate or outdated data.
- •Anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the LGPD.
- •Portability of your data to another provider.
- •Deletion of data processed on the basis of your consent.
- •Information about the public and private entities we share your data with, and about the possibility of refusing consent and its consequences.
- •Revocation of consent at any time.
To exercise any of these rights, email [email protected] or use our contact page. We may need to verify your identity before acting on a request, and we respond within the time limits set by applicable law (for example, one month under the GDPR).
You also have the right to lodge a complaint with a data protection authority — for example, the supervisory authority in your EU country, the UK Information Commissioner's Office (ICO) or Brazil's National Data Protection Authority (ANPD).
11. California privacy rights (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the right to:
- •Know what personal information we collect, use and disclose, and get a copy of it.
- •Delete the personal information we collected from you.
- •Correct inaccurate personal information.
- •Opt out of the sale or sharing of your personal information.
- •Not be discriminated against for exercising any of these rights.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We use Google Ads only to measure conversions, with ad personalization switched off, and only after you accept cookies. The categories of personal information we collect are those described in section 2: identifiers (such as name, email address and IP address), commercial information (your plan and billing history) and, only with your consent, internet activity on our website and app.
You, or an authorized agent acting on your behalf, can submit a request to the email address in section 12. We will verify the request before fulfilling it and respond within 45 days, as the law requires.
12. Privacy contact
For any question about this policy or your personal data, visit our contact page or email [email protected].