Privacy Policy

Vulnara Security (Pty) Ltd("Vulnara", "we", "us", or "our") operates the Vulnara automated security testing platform at vulnara.io. We are the responsible party (controller) for personal information we collect about you, as defined under the Protection of Personal Information Act 4 of 2013 (POPIA).

Account information: your name, email address, and password (stored as a one-way hash) when you register.

Billing information: payment card details are processed and stored exclusively by our payment provider (Stripe). We store only a masked card number and last-4 for display.

Scan data: target URLs, scan configuration, captured API endpoints, and security findings generated when you run scans.

Usage data: pages visited, features used, timestamps, and browser/device type for analytics and debugging.

Communications: messages you send us (support, feedback).

• Provide, operate, and improve the Vulnara platform
• Process payments and manage your subscription
• Send you transactional emails (scan complete, account alerts)
• Detect and prevent abuse, fraud, and unauthorized scanning
• Respond to support requests and feedback
• Comply with legal obligations

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

We share personal information only with:

• Payment processors (Stripe) - to process subscription payments
• Cloud infrastructure providers - servers that host and store your data
• Analytics providers - aggregated, anonymised usage data only
• Law enforcement - when required by a valid legal order

All third-party service providers are bound by data processing agreements that restrict their use of your information to delivering the specific service.

We keep your personal information for as long as your account is active.

• Scan data is retained for the duration of your subscription and deleted 30 days after account closure
• Billing records are retained for 7 years as required by South African tax law
• Support communications are retained for 2 years
• Anonymised usage analytics may be retained indefinitely

Under POPIA, you have the right to:

• Access - request a copy of the personal information we hold about you
• Correction - request correction of inaccurate information
• Deletion - request deletion of your personal information, subject to legal retention requirements
• Objection - object to processing of your personal information
• Complaint - lodge a complaint with the South African Information Regulator at inforegulator.org.za

To exercise any of these rights, email us at privacy@vulnara.io. We will respond within 30 days.

Vulnara applies security controls appropriate to the sensitivity of the information we process:

• All data in transit is encrypted via TLS 1.2+
• Passwords are hashed using bcrypt
• Sensitive configuration values (API tokens) are encrypted at rest using AES-256
• Access to production systems is restricted by role and requires multi-factor authentication

No method of transmission or storage is 100% secure. If you discover a vulnerability in our platform, please report it via our responsible disclosure process.

We use essential cookies for session management and authentication. We do not use third-party advertising or tracking cookies. Analytics cookies, if used, are anonymised and you may opt out through your browser settings.

The Service is not directed at children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us at privacy@vulnara.io and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the platform. Continued use of the Service after changes constitutes acceptance of the updated policy.

For privacy questions or to exercise your rights: