Privacy Policy

Controller: Trackflaw SAS

Address: 60 rue François 1er, 75008 Paris, France

Email: contact@flawfence.com

DPO (Data Protection Officer): dpo@flawfence.com

2.1. Identification data

• Last name, first name
• Email address
• Phone number
• Company name
• Position within the company

2.2. Connection data

• IP address
• Connection logs
• Browser type
• Operating system
• Pages visited and time spent

2.3. Technical data

• Domains and subdomains analysed
• IP addresses of your infrastructure
• Security scan results
• Detected vulnerabilities
• Configuration of scanned assets
• Attestation log of the public tools (wp2shell scanner and passive home-page preview): timestamp, target domain, nature of the read and a salted cryptographic fingerprint of the caller’s IP address (never the address itself), kept as evidence of the authorization attestation

Your data is collected for the following purposes:

• Provision of the service: Security analysis, vulnerability detection, report generation
• Customer account management: Creation and management of your user account
• Billing: Issuing invoices and managing payments
• Customer support: Responding to your requests and technical assistance
• Service improvement: Usage analysis and platform optimisation
• Communication: Sending information about the service and security updates
• Legal obligations: Compliance with accounting and tax obligations

The processing of your data is based on:

• Performance of the contract: For the provision of the Flawfence service
• Consent: For newsletters and marketing communications (revocable at any time)
• Legitimate interest: For improving the service and securing the platform
• Legal obligations: For the retention of billing data

Your data may be shared with:

• Authorised staff of Trackflaw SAS: Technical, support and sales teams
• Cloudflare, Inc. (processor): Hosting of the site's application relays, of the anti-abuse counters and of the public tools' attestation log
• Amazon Web Services (processor): Hosting of the website (S3 storage in the eu-west-3 region, Paris) and delivery through the CloudFront CDN
• Google LLC (processor): Recording of contact requests in a Google Sheets spreadsheet, through its API
• Legal authorities: Upon legal or judicial request

5.1. Public services queried from your browser

When you start an analysis yourself from the site, your browser queries several public databases directly, without going through our servers. Those services therefore see the IP address of your connection and, depending on the case, the domain name you entered. No identification data (name, email address, phone number, company) is passed to them, and none of these calls happens until you have requested the analysis:

• Google Public DNS (dns.google, United States): Resolution of the public DNS records of the analysed domain
• Cloudflare DNS (cloudflare-dns.com, United States): Fallback resolver, queried only if the previous one does not respond
• Shodan InternetDB (internetdb.shodan.io, United States): Reading of a public database describing the already-observed network exposure of an IP address. This lookup triggers no scan of the target
• RDAP (rdap.org and the registry of the domain concerned): Public domain-name registration data (registrar, dates, statuses)
• Cloudflare Turnstile (challenges.cloudflare.com, United States): Anti-bot verification of the forms. The script is loaded only if suspicious behaviour is detected: an ordinary visitor never sees it

These calls are necessary to perform the feature you requested and are limited to what it requires. We have no control over any further processing by those services: their own privacy policies apply. You can avoid every such call by not using the site’s analysis tools, which browsing the pages does not depend on.

Your data is never sold to third parties.

• Account data: For the entire duration of the contract + 3 years after the end of the contract
• Billing data: 10 years (legal accounting obligation)
• Scan data and reports: For the entire duration of the contract
• Connection logs: 12 months maximum
• Attestation log of the public tools: 12 months maximum (evidence of the authorization attestation, wp2shell scanner and passive preview)
• Marketing data: 3 years from the last contact (or until consent is withdrawn)

In accordance with the GDPR, you have the following rights over your data:

• Right of access: Obtain a copy of your personal data
• Right to rectification: Correct inaccurate or incomplete data
• Right to erasure: Request the deletion of your data
• Right to restriction: Restrict the processing of your data
• Right to portability: Retrieve your data in a structured format
• Right to object: Object to the processing of your data
• Right to withdraw your consent: At any time for processing based on consent

Trackflaw SAS implements appropriate technical and organisational measures to protect your data:

• Encryption of data in transit (HTTPS/TLS) and at rest
• Strong authentication and access management
• Intrusion monitoring and detection
• Regular backups and disaster recovery plan
• Regular security audits
• Staff training in security best practices

We may amend this privacy policy at any time. Any significant change will be notified to you by email or via a notification on the platform.