Privacy policy
This policy explains what personal data Secrook collects, why, who sees it and what choices you have. The main point is simple: the product runs on the customer's own server, and we do not receive the customer's vulnerability data, product lists, users or emails.
Who we are
Secrook is the controller of the personal data described here for the website, the licence service and billing. When the product runs on a customer's server, the customer is the controller of the data inside it, and we do not have access to that data.
What we collect
Website and contact form
Name, company, work email, the plan you ask about and your message. We also keep the time of the request and a technical log of the visit, such as the address of the device and the browser type, for security and to stop abuse.
Customers and billing
Company name, contact names, emails and phone numbers, billing details, the plan, the licence key and its dates, payment status and the emails we exchange. Card details, if a payment provider is used, are handled by that provider and not stored by us.
The licence check
Once a day the product sends the licence key, a random installation ID, the product version and the time. Our server also sees the address the request came from. We use this to confirm that the licence is valid, to count installations against the licence and to show the customer the end date.
Hosted workspaces
If we host a workspace for a customer, we store what the customer enters there, such as products, users, teams and findings, only to run the service for that customer. We do not use it for any other purpose.
Optional AI mode
If the customer turns it on, the question and the facts needed to answer it, such as CVE text and product names, go through our server to an AI provider. Emails, passwords and credentials are never sent. We count the number of questions per month to apply the limit, and we do not keep the text of the questions beyond what is needed to answer and to find faults.
What we do not collect
- The customer's products, findings, teams, users or email content when the product runs on the customer's own server.
- Passwords of the customer's users.
- Advertising profiles. We do not sell personal data and we do not run advertising trackers.
Why we use it
- To answer your enquiries, give trials and send offers.
- To issue, check, renew and support licences, and to send the reminder before a licence ends.
- To invoice, collect payment and meet tax and accounting duties.
- To keep the website and the licence service secure and to prevent abuse.
- To improve the product, using counts and versions and not personal content.
We rely on the contract with the customer, on our legitimate interest in running and protecting the service, on legal duties, and on consent where the law asks for it, for example for marketing emails. You can withdraw consent at any time.
Who sees it
We share personal data only with providers that help us run the service, under confidentiality and security duties, and only as much as they need:
- hosting and server providers;
- email delivery providers;
- payment, invoicing and accounting providers, and our accountants;
- an AI provider, only when the customer turns on AI mode;
- professional advisers, and authorities when the law requires it.
We do not sell personal data.
Where it is stored
Our providers may be outside Israel, including in the European Economic Area. When data moves abroad we use providers and contracts that give it a level of protection suited to the law that applies to you.
Cookies and similar storage
The website sets no advertising or analytics cookies. Your browser may store one small setting on your own device, your chosen language, so that the site remembers it. The page loads fonts from Google Fonts, which means Google receives your address when the page loads. Clearing your browser data removes it.
How long we keep it
- Contact form messages: up to 24 months after the last contact, unless a customer relationship starts.
- Customer, licence and billing records: for the time of the agreement and then as long as tax and accounting law requires, which is generally seven years in Israel.
- Licence check logs and technical logs: up to 12 months.
- Hosted workspace data: until the agreement ends, and then deleted within 60 days unless the customer asks for earlier deletion or an export.
How we protect it
- The licence is signed, so its end date cannot be edited, and the licence check sends no data about the customer's environment.
- Connections use HTTPS.
- The admin area is limited to named people, uses a password with two-step sign-in, blocks repeated failed attempts and keeps an event log.
- Backups are taken regularly and stored separately.
- We keep the software and servers updated and report problems to affected customers without delay.
No system is perfectly secure. If we learn of a breach that affects your personal data, we will tell you as the law requires.
Your rights
You can ask to see the personal data we hold about you, to correct it, to delete it, to limit or object to its use, or to receive a copy. We answer within the time the law sets. We may need to confirm who you are first, and we may keep data that the law requires us to keep. If you are in the European Economic Area, you can also complain to your local data protection authority. In Israel you can contact the Privacy Protection Authority.
Your provision of data to us is voluntary. If you do not give the details we need for a trial or an invoice, we may not be able to provide the service.
Children
The service is for businesses. It is not meant for people under 18 and we do not knowingly collect their data.
Our role and the law that applies
We handle personal data in line with the Israeli Protection of Privacy Law, 5741-1981, and its regulations, and, where it applies to a person in the European Economic Area or the United Kingdom, the GDPR. For the website, the licence service and billing we are the controller. For personal data that a customer puts into a hosted workspace, the customer is the controller and we act as its processor, as the terms describe.
Where the GDPR applies, our legal bases are: performing a contract with the customer, our legitimate interest in running and securing the service and in answering enquiries, compliance with legal duties such as tax records, and consent for the few uses that need it, such as marketing messages.
Service providers and transfers abroad
Our service providers act on our instructions under written terms that cover confidentiality and security. A current list of the providers that handle personal data is available on request at support@secrook.com.
When personal data is transferred outside Israel or outside the European Economic Area, we rely on a country that the competent authority recognises as adequate, or on contract terms and measures that give the data a suitable level of protection. A hosted workspace is stored in the region that we state in the order or on request.
Messages we send you
We send service messages that you need to run the service, such as licence, billing, security and maintenance notices. We send marketing messages only if you asked for them or the law allows it, and every such message has a way to stop receiving them.
Security incidents
We keep a procedure for finding, containing and reporting security incidents. If an incident affects your personal data in a way that the law requires us to report, we will tell the people and the authorities concerned within the time that the law sets, and we will tell a customer whose workspace is affected without undue delay.
Requests from authorities
We disclose personal data to an authority only when the law requires it, for example under a court order, and only as much as is required. Where the law allows, we tell the customer concerned before we do.
Complaints
If you think we have handled your personal data wrongly, please write to support@secrook.com first so that we can try to put it right. You can also complain to the Israeli Privacy Protection Authority or, if you are in the European Economic Area or the United Kingdom, to your local data protection authority.
Changes to this policy
We will publish changes on this page with a new date, and tell customers by email about material changes.
Contact
For privacy questions or to use your rights, write to support@secrook.com. Please include the email address you used with us.