Privacy Policy

1. Data Controller

All Seeing Eye ("ASE", "we", "us", "our") is the data controller responsible for your personal data. You can contact us at:

2. Scope

This Privacy Policy applies to all personal data collected through our website (ase.run), our contact and demo request forms, and any communications with us. It covers our obligations under the following regulations:

  • GDPR (General Data Protection Regulation, EU/EEA)
  • LGPD (Lei Geral de Proteção de Dados, Brazil)
  • LOPDGDD (Ley Orgánica de Protección de Datos y Garantía de los Derechos Digitales, Spain)
  • Ley 25.326 (Protección de los Datos Personales, Argentina)
  • CCPA/CPRA (California Consumer Privacy Act / California Privacy Rights Act, USA)

3. Data We Collect

We collect and process the following categories of personal data:

3.1 Data you provide directly

  • Contact/Demo form: Name, email address, company name.
  • Form metadata: When you submit a form, we also log your IP address, User-Agent string, and a timestamp of your GDPR consent for compliance record-keeping.
  • Communications: Any information you share when contacting us via email or other channels.

3.2 Data collected automatically

  • Technical data: IP address, browser type and version, operating system, referring URL, pages visited, time and date of access.
  • Cookies: See our Cookie Policy for detailed information on cookies used.

3.3 Data we do NOT collect through this website

  • We do not collect special categories of personal data (racial or ethnic origin, political opinions, religious beliefs, health data, etc.).
  • We do not collect payment or financial information through the website.
  • We do not knowingly collect data from individuals under 16 years of age.
  • We do not collect, store, or process assessment findings, vulnerability reports, target credentials, or any data generated during penetration testing engagements through this website. Assessment data is governed exclusively by the terms of each client's engagement agreement and our Data Processing Agreement.

4. Legal Basis for Processing

We process your personal data under the following legal bases:

Purpose Legal Basis (GDPR Art. 6) Details
Responding to demo requests Consent (Art. 6(1)(a)) You explicitly consent when submitting the form
Pre-contractual communications Legitimate interest (Art. 6(1)(f)) Processing necessary to discuss potential engagement
Website security and fraud prevention Legitimate interest (Art. 6(1)(f)) Protecting our website and services
Legal compliance Legal obligation (Art. 6(1)(c)) Complying with applicable laws and regulations

5. How We Use Your Data

We use your personal data exclusively for the following purposes:

  • Processing and responding to demo requests and inquiries.
  • Communicating with you about our services.
  • Scheduling and coordinating penetration testing engagements.
  • Improving our website and services.
  • Ensuring the security of our website.
  • Complying with legal obligations.

We do not sell, rent, or trade your personal data to third parties. We do not use your data for automated decision-making or profiling.

6. Data Sharing and Third Parties

We may share your data with the following categories of third-party service providers, solely for the purposes described above:

  • Google reCAPTCHA (spam prevention): Protects our forms from automated abuse. reCAPTCHA tokens are verified server-side. Google Privacy Policy.
  • Hosting provider: Our website hosting infrastructure provider, which may process technical data (IP addresses, access logs).

All third-party processors are bound by data processing agreements that require them to protect your data in accordance with applicable privacy laws.

7. International Data Transfers

Some of our service providers may process data outside of your country of residence, including in the United States. When transferring data internationally, we ensure appropriate safeguards are in place:

  • Standard Contractual Clauses (SCCs) approved by the European Commission.
  • Adequacy decisions where applicable.
  • Other lawful transfer mechanisms recognized under applicable privacy laws.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

  • Demo requests: 12 months from submission, or until the engagement concludes, whichever is later.
  • Communications: 24 months from last contact.
  • Technical/access logs: 90 days.
  • Contractual records: Duration of the contract plus the applicable statutory limitation period.

After these periods, data is securely deleted or anonymized.

9. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

9.1 Under GDPR / LOPDGDD (EU/EEA/Spain)

  • Access: Request a copy of the data we hold about you.
  • Rectification: Correct inaccurate or incomplete data.
  • Erasure: Request deletion of your data ("right to be forgotten").
  • Restriction: Request that we limit processing of your data.
  • Portability: Receive your data in a structured, machine-readable format.
  • Objection: Object to processing based on legitimate interest.
  • Withdraw consent: Withdraw previously given consent at any time. You can withdraw cookie consent by clicking "Reject" on the cookie banner, or by clearing your browser cookies for ase.run (the banner will reappear). To withdraw consent for data processing related to a form submission, contact us at privacy@ase.run.
  • Lodge a complaint: File a complaint with your local Data Protection Authority.

9.2 Under LGPD (Brazil)

  • Confirmation of the existence of data processing.
  • Access, correction, anonymization, blocking or deletion of unnecessary data.
  • Portability to another service provider.
  • Information about shared data with third parties.
  • Revocation of consent.

9.3 Under Ley 25.326 (Argentina)

  • Access to your personal data held in databases.
  • Rectification, update, or deletion of your data.
  • Right to know the purpose of data collection.
  • Right to file a complaint with the AAIP (Agencia de Acceso a la Información Pública).

9.4 Under CCPA/CPRA (California, USA)

  • Right to Know: What personal information we collect, use, disclose, and sell.
  • Right to Delete: Request deletion of your personal information.
  • Right to Opt-Out: Opt out of the sale or sharing of personal information (we do not sell your data).
  • Right to Correct: Correct inaccurate personal information.
  • Non-Discrimination: We will not discriminate against you for exercising your rights.

To exercise any of these rights, contact us at privacy@ase.run. We will respond within 30 days (or within the period required by applicable law).

10. Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

  • TLS/HTTPS encryption for all data in transit.
  • Access controls and authentication for data systems.
  • Regular security assessments of our own infrastructure.
  • Data minimization: we only collect what is necessary.

11. Children's Privacy

Our services are not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a minor, please contact us immediately at privacy@ase.run and we will delete such data promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page and we encourage you to review it periodically. Significant changes will be communicated through a notice on our website.

13. Contact

For any questions, concerns, or requests related to this Privacy Policy or your personal data, contact us: