Privacy Policy

This policy explains what personal data HackGrade collects, why, who receives it, how long we keep it and what your rights are. It covers the website hackgrade.com, your HackGrade account, our scans and reports, the support chat and our emails. It is written to meet Israel's Protection of Privacy Law 1981 (as amended by Amendment 13), the EU and UK GDPR and the California Consumer Privacy Act, and, for sign-in with Google, the Google API Services User Data Policy.

1. Who we are

HackGrade (hackgrade.com) is a website security scanning service operated from Israel. HackGrade is the controller of your personal data. For any privacy question or request, write to support@hackgrade.com.

2. What we collect

• Account data: your email address, a hash of your password if you set one (never the password itself), your language, your plan and when you confirmed your email and accepted our Terms.
• Sign-in with Google or GitHub: if you choose it, only your email address and the account identifier that the provider assigns to you. Section 3 explains exactly what we receive and how we use it.
• Sites and verification: the domains you add, the verification method and token, and the results of our periodic ownership checks.
• Scan authorizations: for every Scan Authorization you accept, we record the site, the date and time, the version and a fingerprint (hash) of the exact text you saw, your language, your IP address and your browser's user agent. This is our proof that a scan was authorized.
• Scan targets, results and reports: the website addresses you scan, what our scans found on them, scan history, grades and PDF reports. These can include small excerpts of your site's pages (for example a header or an error message) as proof. We redact secrets and personal data we notice in proof excerpts.
• Test-account credentials (optional): if you give us a test account for authenticated scans, we store its username and password encrypted (Fernet, AES-128 with an HMAC integrity check). They are decrypted only in memory while a scan runs, are never shown again or written to logs, and are deleted automatically after 90 days without use, or at once when you remove them.
• Branding (agency plans): the agency name and logo you upload for white-label reports.
• Free scans: the website address you enter and the results. We store a salted hash of your IP address (not the IP itself) to prevent abuse.
• Security and usage logs: sign-in sessions (with a hashed IP address and your browser type), rate-limit counters, and the access logs of our web server, which record your IP address, browser, the page requested and the time.
• Payments: handled by our payment providers. We receive only the plan, the amount, the status of the payment and a customer reference, never your card number.
• Messages: what you send us by email, for example to support@hackgrade.com.
• Support chat: the email address you give before chatting (we don't ask for your name), your messages and our replies (from Grady, our AI assistant, or a person on our team), the page you wrote from, your language, a hashed IP address and any thumbs up or down you give an answer. If you are signed in, the conversation is linked to your account and Grady can use your plan, renewal date, sites, grades and top findings to answer you. When you leave the chat, we email you a copy of the conversation.
• Marketing consent (optional): if you tick the box to get security tips and offers, we record your email, the time, the exact wording you saw and its version, your language, where you agreed and a hashed IP address. While you are subscribed we may also note that you viewed a plan or started checkout, so we can follow up. We record nothing of this kind for anyone who hasn't subscribed.
• Newsletter and welcome code (optional): when you sign up for our newsletter we keep the sign-up (your email, language, the exact consent wording and its version, the time and a hashed IP address) and send a confirmation link; nothing is sent to you as marketing until you confirm (double opt-in). After you confirm, if you are not yet a customer, we email you a personal single-use code for 25% off your first purchase. We store codes only as a keyed hash (never the code itself) together with a hash of the email it belongs to, and we record when a code is used (plan, price, discount, date) so it can be used only once and to see which offers work.
• Cookies: see section 10.

Providing this data is voluntary, but without an email address (with a password, a sign-in link or a sign-in provider) we cannot open an account, without verification and authorization we cannot run deep scans, and without payment we cannot provide paid plans.

3. Signing in with Google (and other providers)

You can create a HackGrade account and sign in with your Google account instead of a password. This section explains exactly what happens to the data we receive from Google.

What we receive. We ask Google only for the scopes "openid" and "email". From Google we receive and keep only your email address, whether Google has verified it, and your Google account identifier (a number that identifies your Google account to us). We do not request or receive your name, profile photo, contacts, calendar, Google Drive files, Gmail messages or any other Google data, and we have no access to your Google account beyond this. We don't store the tokens Google issues during sign-in: we use them once to confirm who you are and then discard them.

Why we use it. Only to create your HackGrade account, to sign you in, to keep your account linked to your Google account, and to send you the emails that come with your account (such as security alerts, scan results and billing notices) to that address. We use it for nothing else.

How we store and protect it. Your email address and Google account identifier are stored in our account database on our servers. All data travels over encrypted connections (HTTPS with TLS 1.2 or newer), the sign-in flow is protected with PKCE and a one-time state, and Google's identity token is checked for a valid signature before we trust it. Access to the database is limited to the HackGrade systems and staff who need it to run the Service.

Sharing. We do not sell data received from Google and we do not share it with anyone, except our hosting and email providers listed in section 5, and only as needed to run your account and send you its emails, or when the law requires it. We never use it for advertising, we never send it to Grady's AI provider or any other AI service, and we do not use it to develop, improve or train AI or machine learning models. No person reads it unless you ask us to, it is needed for security or abuse investigations, or the law requires it.

Retention and deletion. We keep this data while your account is open. When you delete your account in Account settings, your email address and Google account identifier are deleted from our live systems immediately, and backups are overwritten within 30 days. A sign-in that you start but don't finish is deleted after 30 minutes. You can also ask us to delete your data by writing to support@hackgrade.com. You can revoke HackGrade's access to your Google account at any time at myaccount.google.com/permissions; this stops sign-in with Google but does not delete your HackGrade account, so if you also want that deleted, delete your account or write to us.

Limited Use. HackGrade's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Other providers. Sign-in with GitHub works the same way: we keep only your GitHub user ID and your verified primary email address, and we use them only to create your account and sign you in. GitHub's sign-in permissions ("read:user" and "user:email") also show us your public profile, but we don't store it. If we add another sign-in provider, we will list it here first.

4. Why we use it and our legal basis

• To provide the Service you asked for: accounts and sign-in, scans, reports, monitoring and alerts (performance of our contract with you).
• To make sure only authorized people scan a site, to keep evidence of authorization and to prevent fraud and abuse (our legitimate interest in operating lawfully and safely, and our legal obligations).
• To bill you and keep accounting records (contract and legal obligation).
• To send service emails such as sign-in codes and links, verification, security alerts, scan results and renewal reminders (contract). We send marketing emails only if you opt in, and you can unsubscribe at any time.
• To keep the Service and your account secure, using sign-in records and server logs (legitimate interest).
• To improve the Service using anonymous, aggregated statistics (legitimate interest).
• To answer your support questions in the chat and by email (contract, or our legitimate interest in helping visitors), and to send security tips and offers only if you opted in (consent, which you can withdraw at any time with the unsubscribe link or in Account settings).
• To run the newsletter you asked for (consent) and to issue, check and honour discount codes, including preventing their misuse such as guessing or reusing codes (performance of our contract with you and our legitimate interest in preventing fraud).

When you create an account we ask you to confirm that you have read this policy. That confirmation records that we informed you; it is not consent to processing. We rely on the legal basis given for each purpose above, and where that basis is consent (marketing emails) we ask for it separately, with its own unticked box. Where Israeli law requires consent for one of the purposes above, you give it by using the Service after being informed by this policy, and you may withdraw it at any time by deleting your account. We do not sell your personal data, we do not "share" it for cross-context behavioral advertising, we do not use it to train AI models, and we do not use it for automated decisions that have legal effects on you.

5. Who receives your data

We use a small number of service providers ("processors") who act only on our instructions and under contracts that protect your data:

• Hosting: Contabo, which hosts our servers, database and scanning infrastructure.
• Email delivery: Resend, which delivers our account, sign-in and alert emails.
• Incoming email: Cloudflare, which receives the emails you send to support@hackgrade.com and forwards them to our support team.
• AI assistant: OpenAI, which generates Grady's answers in the support chat. It receives your chat messages and, if you are signed in, the account details listed in section 2 (your plan, renewal date, sites, grades and top findings, but not your email address), only to produce the reply. Please don't share passwords or card numbers in the chat.
• Payments: when you buy a paid plan, our payment providers Grow (Meshulam) and Paddle. Paddle acts as reseller and is an independent controller for the payment data it collects.

If you sign in with Google or GitHub, that provider confirms your identity to us under its own privacy policy; we send it nothing about your use of HackGrade.

We may also disclose data when the law requires it, to protect people or our Service from harm, or to the owner or hosting provider of a website that was scanned without authorization. If our business is sold or merged, your data may move to the new owner under this policy.

6. International transfers

We are based in Israel, which the European Commission recognizes as providing adequate protection. Our servers are in the EU, and our providers may process data in the EU, the United States or other countries. Where data leaves Israel, the EU or the UK, we rely on adequacy decisions or standard contractual clauses and on our providers' safeguards.

7. How long we keep data

• Account, sign-in identities (Google or GitHub), sites, scan history and reports: while your account is open. When you delete your account, we delete them from our live systems immediately; backups are overwritten within 30 days.
• Scan authorization records: while your account is open. When you delete your account we remove the IP address and browser from them and keep the rest (site, date and time, text version and fingerprint) for up to 7 years as evidence that the scans were authorized, then delete them. Legal basis: our legitimate interest in establishing and defending legal claims.
• Test-account credentials: up to 90 days after last use, or until you remove them.
• Free scan results: up to 12 months.
• Sessions: up to 14 days. Unfinished sign-ins: 30 minutes. Rate-limit and sign-in counters: up to 30 days.
• Web server access logs: up to 14 days.
• Copies of e-mails we send you: up to 90 days.
• Waitlist sign-ups: until we have told you about the launch, or earlier if you ask us to remove you.
• Payment and invoice records: as long as tax and accounting law requires (in Israel, generally 7 years).
• Refund and payment-dispute evidence (checkout acceptances, full-report confirmations and the confirmation e-mail ID, full-report view and PDF download times, with IP address and browser): at least 18 months, even if you delete your account, then deleted. Legal basis: our legitimate interest in handling refunds and chargebacks.
• Support chat conversations: deleted automatically 180 days after the last message. You can delete a conversation sooner in Account settings, and your linked conversations are deleted when you delete your account.
• Marketing consent: while you are subscribed. After you unsubscribe we keep only your email, the consent record and the date you unsubscribed, to prove consent and to make sure we never send you marketing again. Plan and checkout follow-up notes: up to 90 days.
• Newsletter sign-ups that are never confirmed: deleted after 7 days. Discount codes: a welcome code expires 90 days after it is sent; the hashed code and its redemption records are kept with the payment records they belong to (see above), or, if never used, deleted when you delete your account or data.

8. Security

We protect data with encryption in transit (TLS 1.2+), encryption of test-account credentials at rest, hashed passwords and IP addresses, a database that only our own systems and authorized staff can reach, strict access controls, a strict Content Security Policy and regular security testing of our own platform. If a security incident affecting your personal data occurs, we will notify you and the competent authorities as the law requires.

9. Your rights

Depending on where you live, you can ask us to: see the data we hold about you and get a copy; correct it; delete it; restrict or object to some uses; receive it in a portable format; and withdraw consent. California residents may also request to know and to delete, and will not be discriminated against for using their rights. You can delete your account yourself in Account settings. If you have no account (for example you only used the support chat, the waitlist or our emails), you can delete that data on our Delete my data page. For any other request write to support@hackgrade.com. We answer within one month and may need to confirm your identity. You may also complain to Israel's Privacy Protection Authority or, in the EU or UK, to your local data-protection authority.

10. Cookies

We use only cookies that are strictly necessary for the Service: a sign-in session cookie and a security (CSRF) cookie, both valid for up to 14 days; short-lived cookies that protect a sign-in while it is in progress (up to 30 minutes); and, after you confirm a sign-in code, a security cookie that marks this browser as one where you have proved access to your email address, for 30 days. It does not keep you signed in: it is part of our sign-in security, which asks for a code on browsers it doesn't recognize, so it is strictly necessary. If you delete it, we simply ask for a code at your next sign-in. If you use the support chat, we also set a strictly necessary chat cookie so you can continue your conversation; it expires after at most 180 days. Your language choice is kept in your browser's local storage. We do not use advertising or analytics cookies and we do not load third-party trackers or fonts. See our Cookie Notice. If you close or answer the newsletter prompt, your browser's local storage remembers that ("hg_nl", for up to 180 days) so the prompt doesn't come back; it is not sent to us.

11. Children

HackGrade is not intended for anyone under 18 and we do not knowingly collect their data. If you believe a child has given us personal data, write to support@hackgrade.com and we will delete it.

12. Changes

We will post any change here with a new version and date and, if it is significant, tell you by email before it takes effect.

13. Contact

For any question about this policy or your data, or to exercise your rights, write to support@hackgrade.com.