Privacy Policy

This policy explains what personal data HackGrade collects, why, who receives it, how long we keep it and what your rights are. It is written to meet Israel's Protection of Privacy Law 1981 (as amended by Amendment 13), the EU and UK GDPR and the California Consumer Privacy Act.

1. Who we are

The controller of your personal data is [COMPANY LEGAL NAME / ADDRESS]. For any privacy question or request, write to [SECURITY/PRIVACY EMAIL].

2. What we collect

• Account data: your email address, a hash of your password (never the password itself), your language, your plan and when you confirmed your email and accepted our Terms.
• Sites and verification: the domains you add, the verification method and token, and the results of our periodic ownership checks.
• Scan authorizations: for every Scan Authorization you accept, we record the site, the date and time, the version and a fingerprint (hash) of the exact text you saw, your language, your IP address and your browser's user agent. This is our proof that a scan was authorized.
• Scan results and reports: what our scans found on your site, scan history, grades and PDF reports. These can include small excerpts of your site's pages (for example a header or an error message) as proof. We redact secrets and personal data we notice in proof excerpts.
• Test-account credentials (optional): if you give us a test account for authenticated scans, we store its username and password encrypted (Fernet, AES-128 with an HMAC integrity check). They are decrypted only in memory while a scan runs, are never shown again or written to logs, and are deleted automatically after 90 days without use, or at once when you remove them.
• Branding (agency plans): the agency name and logo you upload for white-label reports.
• Free scans: the website address you enter and the results. We store a salted hash of your IP address (not the IP itself) to prevent abuse.
• Security and usage logs: sign-in sessions (with a hashed IP address and your browser type), rate-limit counters and server logs kept by our web server for security.
• Payments: handled by our payment providers. We receive only the plan, the amount, the status of the payment and a customer reference, never your full card number.
• Messages: what you send us by email.

Providing this data is voluntary, but without an email address and password we cannot open an account, without verification and authorization we cannot run deep scans, and without payment we cannot provide paid plans.

3. Why we use it and our legal basis

• To provide the Service you asked for: accounts, scans, reports, monitoring and alerts (performance of our contract with you).
• To make sure only authorized people scan a site, to keep evidence of authorization and to prevent fraud and abuse (our legitimate interest in operating lawfully and safely, and our legal obligations).
• To bill you and keep accounting records (contract and legal obligation).
• To send service emails such as verification, security alerts, scan results and renewal reminders (contract). We send marketing emails only if you opt in, and you can unsubscribe at any time.
• To improve the Service using anonymous, aggregated statistics (legitimate interest).

Where Israeli law requires consent, you give it by accepting this policy when you create your account; you may withdraw it at any time by deleting your account. We do not sell your personal data, we do not "share" it for cross-context behavioral advertising, and we do not use it for automated decisions that have legal effects on you.

4. Who receives your data

We use a small number of service providers ("processors") who act only on our instructions and under contracts that protect your data:

• Hosting: DigitalOcean and Contabo, which host our servers and scanning infrastructure.
• Payments: Grow (Meshulam) and Paddle. Paddle acts as reseller and is an independent controller for the payment data it collects.
• Email delivery: our email delivery provider, which sends account and alert emails.

We may also disclose data when the law requires it, to protect people or our Service from harm, or to the owner or hosting provider of a website that was scanned without authorization. If our business is sold or merged, your data may move to the new owner under this policy.

5. International transfers

We are based in Israel, which the European Commission recognizes as providing adequate protection. Our providers may process data in the EU, the United States or other countries. Where data leaves Israel, the EU or the UK, we rely on adequacy decisions or standard contractual clauses and on our providers' safeguards.

6. How long we keep data

• Account, sites, scan history and reports: while your account is open. When you delete your account, we delete them from our live systems immediately; backups are overwritten within 30 days.
• Scan authorization records: while your account is open, and deleted with it.
• Test-account credentials: up to 90 days after last use, or until you remove them.
• Free scan results: up to 12 months.
• Sessions: up to 14 days. Rate-limit and sign-in counters: up to 30 days.
• Copies of e-mails we send you: up to 90 days.
• Waitlist sign-ups: until we have told you about the launch, or earlier if you ask us to remove you.
• Payment and invoice records: as long as tax and accounting law requires (in Israel, generally 7 years).
• Refund and payment-dispute evidence (checkout acceptances, full-report confirmations and the confirmation e-mail ID, full-report view and PDF download times, with IP address and browser): at least 18 months, even if you delete your account, then deleted. Legal basis: our legitimate interest in handling refunds and chargebacks.

7. Security

We protect data with encryption in transit (TLS 1.2+), encryption of test-account credentials at rest, hashed passwords and IP addresses, strict access controls, a strict Content Security Policy and regular security testing of our own platform. If a security incident affecting your personal data occurs, we will notify you and the competent authorities as the law requires.

8. Your rights

Depending on where you live, you can ask us to: see the data we hold about you and get a copy; correct it; delete it; restrict or object to some uses; receive it in a portable format; and withdraw consent. California residents may also request to know and to delete, and will not be discriminated against for using their rights. You can delete your account yourself in Account settings; for any other request write to [SECURITY/PRIVACY EMAIL]. We answer within 30 days and may need to confirm your identity. You may also complain to Israel's Privacy Protection Authority or, in the EU or UK, to your local data-protection authority.

9. Cookies

We use only cookies that are strictly necessary for the Service: a sign-in session cookie and a security (CSRF) cookie, both valid for up to 14 days. Your language choice is kept in your browser's local storage. We do not use advertising or analytics cookies and we do not load third-party trackers or fonts. See our Cookie Notice.

10. Children

HackGrade is not intended for anyone under 18 and we do not knowingly collect their data.

11. Changes

We will post any change here with a new version and date and, if it is significant, tell you by email before it takes effect.