Privacy Policy

1. Controller

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:
VİRİLE PEAK TAKVİYE GIDA TİC. LTD. ŞTİ., represented by its Managing Director Sefa Tunç, Bahçelievler Mah. Koca Yusuf Sok. H. Tunç Apt. No:2 İç Kapı No: 4, Merkez / Burdur, Türkiye. Email: info@breachsweep.com

2. Self-Hosted AI Analysis

Scan analysis runs on private, self-hosted AI models on our own dedicated hardware. We do not send your endpoints, application data, or findings to third-party AI APIs (e.g. OpenAI, Anthropic, Google), and your data is never used to train public models. Order data and reports are stored with the hosting providers listed in section 5.

3. Data We Process

• Target domain / URL and domain ownership verification data
• Contact email address for report delivery and status updates
• Optional scope notes and test-account credentials you provide
• Technical data generated during authorized testing (status codes, headers, PoC evidence)
• Payment and order data processed by our payment provider (see section 5)
• Server log data when you visit this website (IP address, time, requested URL, user agent)

4. Purposes and Legal Bases

• Performing the security assessment you ordered and delivering the report: Art. 6(1)(b) GDPR (contract)
• Payment processing, accounting, and statutory retention: Art. 6(1)(c) GDPR (legal obligation)
• Operating, securing, and preventing abuse of this website and of our scanning service (e.g. ownership verification, server logs): Art. 6(1)(f) GDPR (legitimate interests)
• Answering your enquiries: Art. 6(1)(b) or (f) GDPR

5. Processors and International Transfers

• Vercel Inc. (USA): website hosting and serverless functions
• Neon Inc. (USA): database hosting for orders and reports
• Whop Inc. (USA): checkout and payment processing

These providers process data on our behalf under data processing agreements. Transfers to the USA are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where the provider is certified, the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

6. Retention

Reports, scan data, and test credentials are deleted automatically 30 days after delivery, or earlier on request. Data we must keep for tax and commercial law reasons (e.g. invoices) is retained for the statutory periods and then deleted.

7. Your Rights

Under the GDPR you have the right to:

• access your personal data (Art. 15)
• rectification (Art. 16) and erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• object to processing based on legitimate interests (Art. 21)
• lodge a complaint with a data protection supervisory authority (Art. 77)

8. Contact

For any privacy request, email info@breachsweep.com.