Privacy Policy

Exarlo values your privacy. This Privacy Policy outlines how we collect, use, store, and protect your information when you use our automated security assessment services.

1. Information We Collect

• Client Information: When you request an assessment, we collect your email address for report delivery and communication.
• Target Information: We collect the domain names you submit for security analysis.
• Payment Information: Payments are processed by our Merchant of Record, Paddle.com. Paddle collects and processes your payment details directly under its own privacy policy; Exarlo never receives or stores your full card number. We only store limited payment metadata (e.g., Paddle order/transaction IDs and payment status) needed to fulfil and support your order.
• Assessment Data: We temporarily store the raw data, vulnerability findings, and generated reports associated with your scan.
• Usage Data: We may collect anonymous analytics data regarding your interaction with our website to improve our services.

2. How We Use Your Information

We use the collected information to:

• Perform the requested security assessments.
• Deliver your assessment reports securely.
• Process payments and deliver order receipts.
• Provide customer support.
• Improve the accuracy and performance of our scanning engines.

3. Data Retention and Security

Security is our priority. Assessment reports and sensitive vulnerability data are retained for 90 days to allow you to re-scan and verify fixes. After this period, detailed scan findings are securely purged from our active databases, unless you explicitly request earlier deletion.

We implement industry-standard security measures, including encryption at rest and in transit, to protect your data from unauthorized access, alteration, or disclosure.

4. Information Sharing

We do not sell, trade, or rent your personal information to third parties. We may share information with trusted service providers strictly for the purpose of operating our business, provided they adhere to confidentiality agreements. These include our Merchant of Record and payment processor (Paddle.com) and our transactional email provider (Resend), used to take payment and deliver your reports.

We may disclose information if required by law or in response to valid requests by public authorities.

5. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, or delete your personal data. To exercise these rights or request the immediate deletion of an assessment report, please contact us.

For privacy inquiries, please contact support@exarlo.xyz.