Information we collect
- Account information: your email address, sign-in details, workspace membership and preferences.
- Scan information: the names and addresses of applications you ask us to test, your instructions, schedules, findings and reports. Information collected during a test can include personal information about the application’s users.
- Billing information: subscription status, purchases, scan credits and payment records. Our payment provider collects your payment details.
- Device and usage information: your internet address, browser and device information, pages visited, actions taken and problems encountered. We may link usage information to your account.
- Communications: information you send when you contact us, including support and privacy requests.
We receive information directly from you, automatically when you use the service, from providers that help manage accounts and payments, and from applications customers ask us to test. Account and application information is necessary to provide the corresponding features; without it we cannot create an account or run a scan.
How we use information
We use information to manage access to accounts, operate workspaces, run requested and scheduled security tests, produce reports, process payments, manage scan credits, send account and finding notifications, respond to requests, prevent abuse, resolve problems and improve CAPRICORN. We also use records where needed to meet legal obligations and resolve disputes.
Information used in security tests
To perform security tests, we may share your instructions and information collected from the tested application with service providers, including AI services. This information can include personal or confidential information found during a test.
How long these providers keep information and whether they use it to improve their services depends on the provider and the terms that apply. Contact us before submitting information if you require specific limits on its use, storage or retention.
Only submit applications you are authorized to test. Use test accounts and sample data where practical, and avoid providing unnecessary personal or confidential information.
When a customer asks us to test an application, we use information collected during that test to provide the service for that customer. If your information appears in a customer’s application or report, you may also need to contact that customer to exercise your rights.
Who receives information
We use service providers for the following functions. The information each receives depends on the feature you use:
- Operating our website, managing accounts and storing information.
- Processing payments and managing subscriptions.
- Understanding how the service is used and resolving problems.
- Delivering account and service emails.
- Performing security tests and analyzing results, including through AI services.
Workspace members with access can view the workspace’s scan information and reports. We may also disclose information when required by law, to protect rights and investigate abuse, to professional advisers where necessary, or in connection with a merger, acquisition or business transfer subject to applicable safeguards.
Storage and retention
Information may be processed in the United States and other countries where our providers operate. Those countries may have different privacy laws from your own. Contact us before using CAPRICORN if your organization requires a particular storage location or international transfer arrangement.
How long information is kept depends on its type and purpose: account records support access and workspace administration; scan records support reports and scan history; payment records support accounting, tax and dispute handling; and usage records support security and resolving problems. Service providers and backup copies may have different retention periods.
The workspace does not currently offer a self-service account deletion tool or a fixed automatic expiry period for scan history. To request deletion, email [email protected]. We will assess the request and explain any records that must be retained for legal, security or other permitted reasons. Deleting an account does not necessarily remove required billing records or copies already exported by a customer.
Your choices and rights
You can change workspace preferences and finding email notifications in Settings. Essential account, security and billing messages may still be sent.
Depending on where you live and which laws apply, you may have rights to access, correct, delete or obtain a copy of your personal information; restrict or object to processing; withdraw consent where processing relies on it; or opt out of certain uses. Some laws also provide a right to appeal a denied request or complain to a regulator.
Send requests or appeals to [email protected]. We may ask for information needed to verify your identity and authority, and will respond within the period required by applicable law. An authorized agent may contact us with evidence of authority. We will not discriminate against you for exercising rights protected by applicable law.
Security
We use safeguards to limit access to account and scan information to authorized users. No service can guarantee absolute security. Do not email passwords, payment card details or sensitive details of security findings when making a privacy request; contact us first to arrange an appropriate way to share them.
Children
CAPRICORN is intended for business and professional security testing, not for children under 13. If you believe a child has provided us personal information, contact us so we can investigate and address it.
Changes to this policy
We may update this policy as the service or our practices change. We will update the date on this page and provide additional notice of material changes where required by law.
Contact
Aitel Research LLC
United States
[email protected]
Contact us with questions about this policy or how CAPRICORN handles personal information.