Privacy Policy

This Privacy Policy explains how TigerStrike ("TigerStrike", "we", "us", "our") collects, uses, shares, and protects information when you use the tigerstrike.io website, the hosted application, APIs, and related services (collectively, the "Services"). It also sets out the rights individuals have in respect of their personal data under applicable law, including the EU/UK GDPR, India's DPDP Act, the California Consumer Privacy Act (CCPA/CPRA), and other state and national privacy laws.

1. Roles: Controller and Processor

TigerStrike acts as a controller for the personal data we collect directly from you (for example, when you create an account, submit a demo form, or communicate with our team). For personal data our customers process through the Services (for example, user information or data uncovered during authorised security testing), TigerStrike acts as a processor on behalf of the customer, subject to the customer's Data Processing Agreement with TigerStrike.

Where TigerStrike acts as processor, customers remain responsible for their lawful basis for processing, for providing required notices to data subjects, and for responding to data-subject requests. TigerStrike will assist as described in the DPA.

2. Information We Collect

We collect information in the following categories:

• Account information — name, work email, company, phone number, company size, job title, and (if provided) password hash.
• Billing and transaction information — billing address, VAT/GSTIN where applicable, order history, and payment-processor references (we do not store full card numbers; those are handled by our payment processor).
• Service configuration data — targets you register for testing, authentication material you supply for authenticated scans, scope definitions, scanner settings, and integration credentials.
• Scan results and reports — vulnerability findings, proof-of-concept artefacts, remediation status, and audit evidence generated by the Services.
• Usage data — log data about product use including IP address, device identifiers, browser type, pages visited, timestamps, referral source, and interactions with features.
• Communications — messages you send through contact forms, support tickets, and emails.
• Cookies and similar technologies — see "Cookies and Tracking" below.

We may also receive information from third parties, including (a) business-contact enrichment providers for sales qualification, (b) analytics and anti-abuse services, and (c) authentication providers if you sign in via single sign-on.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Services, including delivering scan results and compliance reports.
• Process transactions, send invoices, and handle refunds.
• Send transactional notices, security alerts, and service-related announcements.
• Respond to inquiries and provide customer support.
• Analyse usage patterns to understand feature adoption and improve the Services (aggregated or de-identified where feasible).
• Detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms.
• Comply with legal obligations, respond to lawful requests, and enforce our rights.
• Send marketing communications, where permitted by law or with your consent (you can opt out at any time).

4. Legal Bases for Processing (EEA/UK)

Where GDPR applies, we rely on the following legal bases:

• Contract — to provide the Services you have requested and to fulfil our contractual obligations.
• Legitimate interests — to operate, secure, and improve the Services; to communicate with existing customers; and to pursue our business purposes in a manner that does not override your rights and freedoms.
• Consent — for marketing emails to new prospects where required, and for certain cookies and analytics.
• Legal obligation — to comply with tax, accounting, and regulatory requirements.

5. Data Security

We implement administrative, technical, and physical safeguards aligned to SOC 2 Type II and ISO 27001:

• All data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
• SOC 2 Type II certified infrastructure and ISO 27001 aligned ISMS.
• Regular internal and third-party security assessments, including penetration testing of our own platform.
• Role-based access control, SSO, MFA, and principle-of-least-privilege for employee access to customer data.
• Centralised audit logging, 24/7 monitoring, and defined incident-response procedures.
• Vendor security review for sub-processors handling customer data.

6. Data Retention

We retain personal data for as long as needed to provide the Services and for the periods required by law, after which we delete or anonymise the data. Typical retention periods:

• Account data — for the duration of your subscription and up to 12 months after account closure, unless you request earlier deletion.
• Scan results and reports — 90 days by default; configurable up to the duration of the subscription or longer where required for compliance evidence (SOC 2 Type 2, CERT-In 2022 directions, HIPAA 164.316(b)(2)).
• Billing records — up to 7 years to comply with tax and accounting law.
• Support communications — up to 3 years from the last interaction.
• Marketing opt-outs — retained indefinitely to honour your preference.

7. Information Sharing

We do not sell your personal information. We share information with:

• Sub-processors — hosting, email delivery, analytics, customer support, CRM, and payment-processing vendors that act on our behalf and are contractually bound to protect personal data. A current list is available on request to [email protected].
• Professional advisors — lawyers, accountants, and auditors under duties of confidentiality.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to confidentiality obligations.
• Legal and regulatory — where required by law, court order, or valid regulatory request, including CERT-In reporting obligations where applicable.
• With your consent — for any other sharing not described above.

8. International Data Transfers

TigerStrike operates globally and may transfer personal data outside your country of residence. Where personal data is transferred out of the EEA, UK, or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (SCCs), UK IDTAs, or equivalent safeguards. Where personal data is transferred into or out of India, we comply with the DPDP Act's cross-border transfer rules.

You can request a copy of applicable transfer mechanisms by writing to [email protected].

9. Cookies and Tracking

We use cookies and similar technologies for essential site functionality, authentication, security, and analytics. Essential cookies cannot be disabled without affecting site functionality. Analytics and marketing cookies are only set with your consent where required by law.

You can manage your cookie preferences through our cookie banner on first visit and through your browser settings at any time.

10. Your Rights

Depending on your jurisdiction, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your personal data (subject to legal exceptions, including retention required for compliance evidence).
• Export your data in a portable, machine-readable format.
• Restrict or object to processing, including profiling and marketing.
• Withdraw consent where we rely on consent to process data.
• Opt out of marketing communications at any time using the unsubscribe link in each email or by writing to us.
• Lodge a complaint with your local data-protection authority or supervisory authority.

To exercise any of these rights, email [email protected]. We will respond within the timeframe required by applicable law (typically 30 days under GDPR, 45 days under CCPA/CPRA, and the timelines set out in the DPDP Act).

11. Children's Privacy

The Services are not directed to children under 18 and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact [email protected] and we will delete it.

12. Automated Decision-Making

The Services use AI agents to classify, prioritise, and validate vulnerabilities. These outcomes affect scan results and findings, not individual legal rights. We do not make decisions that produce legal or similarly significant effects on individuals solely by automated means.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or in-product notice at least 30 days before taking effect. We will update the "Last updated" date at the top of this page whenever changes are published.

14. Contact Us

For privacy-related inquiries, data-subject requests, or to reach our Data Protection Officer, please contact:

Email: [email protected]

Security concerns: [email protected]