Privacy Policy

This policy explains how personal data is handled on surfacescan.dev (the "website"). SurfaceScan is a product of WhiteFish Security, based in Belgium ("we", "us"). We act as the data controller for the data described below.

Contact

Questions about this policy or requests about your data: info@surfacescan.dev.

What we collect and why

Contact form

When you use the contact form we receive your name, email address, optional company and subject, and your message. We use this only to reply to your request. Legal basis: our legitimate interest in answering enquiries, or steps taken at your request before entering into a contract.

Email sign-up

If you subscribe for product updates, we store your email address to send you announcements about SurfaceScan. Legal basis: your consent. You can unsubscribe at any time by replying to any message or emailing us, and we will remove you.

Server logs

Our web server and reverse proxy automatically log technical data such as IP address, requested URL, user agent and timestamp. We use these logs for security, abuse prevention and troubleshooting. Legal basis: our legitimate interest in keeping the website secure and available.

Cookies and tracking

This website does not set cookies and does not use analytics, advertising or third-party tracking scripts. Fonts are hosted on our own server.

Retention

Contact messages are kept for as long as needed to handle your request and any follow-up, then deleted. Subscriber addresses are kept until you unsubscribe. Server logs are kept for a limited period for security purposes and then rotated out.

Sharing

We do not sell personal data. Data is processed on infrastructure we operate and by service providers that host or deliver our systems and email, under appropriate data processing terms. We disclose data to authorities only where the law requires it.

Your rights

Under the GDPR you may request access to, correction of, or deletion of your personal data, restrict or object to its processing, and request a portable copy. Email us to exercise these rights. You also have the right to lodge a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be) or your local supervisory authority.

Customer accounts

This policy covers the marketing website. Data processed inside the SurfaceScan platform for paying customers (for example, scan targets and findings) is governed by the agreement and data processing terms provided at sign-up.

Changes

We may update this policy. The date at the top shows the latest revision.