LEGAL
Privacy Policy
This policy explains how we process personal data when you visit scanhawk.net, use the client area at app.scanhawk.net and use our security testing services, in line with the EU General Data Protection Regulation (GDPR, in particular Articles 13 and 14) and Czech Act No. 110/2019 Coll.
1. Controller
Swarmhawk s.r.o., Company ID (IČO) 29644861, registered office Příčná 1892/4, Nové Město, 110 00 Praha 1, Czech Republic, entered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 449938. Contact: admin@swarmhawk.com.
Privacy requests are handled directly by Swarmhawk s.r.o.; please send any privacy request to the address above.
2. What we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Account data: email address, password hash (argon2; we never store your password), account status, your plan (PRO or Enterprise, billing period and test schedule), acceptance of the Terms and this policy (each version you accepted and when) | Create and run your account, log you in, contact you about the Service | Art. 6(1)(b) contract | While the account exists; after closure deleted or anonymised on request to admin@swarmhawk.com within 30 days, unless the law requires us to keep it longer; if you register but never confirm your email address, your account and its registration data are deleted automatically, usually within 8 days after your last registration attempt or the last confirmation email we sent you; accounts that are disabled or that own a domain, scan, credit or subscription are not deleted this way (registration events in the security audit log, including your email address and IP address, are kept for 180 days as described below) |
| Two-factor authentication data, if you turn it on: your authenticator secret (stored encrypted with AES-256-GCM), hashes (SHA-256) of your recovery codes and whether each was used, and short-lived login challenge records with your network address shortened to /24 (IPv4) or /48 (IPv6) | Protect your account with a second login factor | Art. 6(1)(b) contract; 6(1)(f) legitimate interest in account security | Secret and recovery code hashes while two-factor authentication is on (deleted when you turn it off or the account is deleted); login challenges expire after 5 minutes and are deleted |
| Penetration test credits: a ledger of credits granted, used, returned, revoked and expired, with time, reason, related test and plan period | Provide the plan you pay for; accounting and dispute handling | Art. 6(1)(b) contract; 6(1)(c) accounting law | The ledger is append-only and is kept after account closure for the periods required by Czech accounting and tax law (up to 10 years) |
| Domains you add, DNS verification tokens and results | Verify ownership before testing; prevent unauthorised testing | Art. 6(1)(b) contract; 6(1)(f) legitimate interest in preventing abuse | While the domain is in your account |
| Test jobs and reports (findings, evidence, scores); these may incidentally contain personal data found on the tested systems | Provide the Service | Art. 6(1)(b) contract | While the account exists; you can request deletion of reports at any time by writing to admin@swarmhawk.com; we handle requests within 30 days |
| Leaked-data findings for your domains (e.g. email addresses or credential exposure from public breach, paste and dark-web sources) | Show you exposure so you can remediate it | Art. 6(1)(f) legitimate interest (security of your organisation); as processor for you where applicable | As reports above; passwords are not displayed in clear text |
| Security and audit logs: IP address, login attempts (including attempts with email addresses that have no account), administrative actions, rate-limit events; the audit log records each security event (logins and failed logins, two-factor authentication, registration, email verification, password resets and changes, test starts, domain verification, credit use, administrative actions) with your full IP address and your email address or account; repeated rate-limited attempts from the same address are combined into one entry per hour with a count, the last IP address and only the last email address used | Secure the Service, detect abuse, investigate incidents | Art. 6(1)(f) legitimate interest; 6(1)(c) legal obligation where applicable | Server logs are rotated by size (up to 5 files of 10 MB per service; older entries are overwritten); the web server (Caddy) access log keeps client IP addresses only masked (IPv4 shortened to /24, IPv6 to /64); audit log 180 days, including login attempts for email addresses that have no account; audit log entries are kept for 180 days even after your account is closed; the 180 days are counted from an entry's last activity (repeated attempts combined into one entry keep it current), not from when it was first created; entries for floods of rate-limited or unauthenticated attempts may be removed earlier when the audit log reaches its size limit; failed sign-in attempts are also logged separately with the full IP address only (no email address or account), kept 14 days, to block attacking addresses automatically (abuse prevention) |
| Emails we send you (verification, welcome, account notices) and delivery status | Account operation | Art. 6(1)(b) contract | Delivery metadata only as long as needed to operate and troubleshoot email delivery; in our server logs recipients appear only as a keyed hash tag, not as an email address (the audit log stores the email address and full IP address, see above) |
| Billing data (company, billing contact, invoices) | Invoicing and accounting | Art. 6(1)(b) contract; 6(1)(c) accounting and tax law | For the periods required by Czech accounting and tax law (up to 10 years) |
| Messages you send us | Answer your request | Art. 6(1)(b) / 6(1)(f) | Up to 2 years after the matter is closed |
Providing account data is necessary to use the Service. We do not use your data for automated decision-making with legal or similarly significant effects, and we do not sell personal data.
Deletion: there is no self-service deletion; we handle deletion requests sent to admin@swarmhawk.com manually within 30 days. When we erase your account at your request, most of its data is deleted, with these exceptions. Entries in the security audit log (your email address and full IP address) are not erased: we keep them on the basis of our legitimate interest in investigating security incidents (Art. 6(1)(f) GDPR; erasure exception for the establishment, exercise or defence of legal claims, Art. 17(3)(e) GDPR) until their 180-day retention period ends, and then delete them. Records of administrative actions are kept without your email address, domain names or IP address (only your account number). Credit records stay in pseudonymised form (account number only; notes and names removed) for accounting and to prevent abuse (Art. 6(1)(c)/(f) GDPR). A disabled, empty account entry with your account number remains so that the number is never reused. Backups: backups of the database are encrypted, and we keep them for at most 12 months; older backups are deleted automatically. Offsite backup copies are write-protected for 90 days and are then removed automatically; under normal operation of the backup process, backups are removed within 12 months after they were made. Data deleted from the Service may remain in such backups for up to 12 months and, under normal operation of the backup process, disappears from them within 12 months after deletion. Backups and older log files are not edited to remove individual data; personal data in them is deleted when the backup or log file reaches the end of its retention period.
3. Cookies
We use only cookies that are strictly necessary for the client area: the session cookie sh_session, which keeps you logged in (expires after 24 hours, or after 60 minutes without activity, or when you log out); the anti-forgery (CSRF) cookie sh_precsrf, used on the login, registration and password-reset forms (until you close the browser, removed at login); sh_mfa, which links the two steps of a login with two-factor authentication (5 minutes, removed after the second step); sh_verify, which carries the email-verification token while you confirm your address (15 minutes, removed after verification); and sh_reset, which carries the password-reset token while you choose a new password (30 minutes, removed after the reset). In production these names carry the __Host- prefix. They are first-party, HttpOnly and Secure, and are not used for tracking. The public website scanhawk.net sets no cookies and uses no analytics or third-party scripts. Because only strictly necessary cookies are used, no consent banner is required.
4. Recipients and processors
We share personal data only with service providers that process it on our behalf under data processing agreements (Art. 28 GDPR), or where required by law.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services EMEA SARL (Amazon SES) | Sending transactional emails | EU (Frankfurt, region eu-central-1) |
| Hetzner Online GmbH (Gunzenhausen, Germany) | Hosting of the website, client area, database and logs | EU (Finland) |
| SwarmHawk scanning platform | Running the scans and automated penetration tests you start; receives the domain to test and returns results | EU/EEA, or outside it only with the safeguards described in section 5 |
Automated penetration testing may use AI models operated by sub-processors of the SwarmHawk platform; test data sent to them is limited to what is needed for the test.
5. Transfers outside the EU/EEA
We aim to keep data in the EU/EEA. Where a provider processes data outside the EU/EEA, we rely on an adequacy decision (e.g. the EU-U.S. Data Privacy Framework for certified providers) or on the European Commission's Standard Contractual Clauses with supplementary measures. You can request a copy of the relevant safeguards.
6. Security
We protect data with encryption in transit (HTTPS/HSTS), password hashing (argon2), hashed one-time tokens, strict access control and isolation between customers, rate limiting, audit logging and least-privilege access for staff. No system is perfectly secure; we will notify you and the supervisory authority of a personal data breach where the law requires.
7. Your rights
You have the right to access your data, to rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest (Articles 15–21 GDPR). Where processing is based on consent, you may withdraw it at any time. To exercise your rights, write to admin@swarmhawk.com; we will respond within one month. You may also lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz) or the authority in your EU country.
If you believe leaked-data findings shown to one of our customers concern you personally, contact us and we will help, including forwarding your request to the customer where they are the controller.
8. Children
The Service is for businesses and is not directed at children under 16.
9. Changes
We may update this policy; the version and date at the top show the current text. We will notify account holders of material changes by email or in the client area, and you will be asked to accept the new version in the client area before you continue using it.