Privacy policy

Vlnry processes account and product data only to provide, secure, bill, and support the autonomous pentesting service. We do not sell personal data or use advertising trackers.

We collect account and session data, connected-repository metadata, authorized targets, run and finding records, billing records, notification preferences, audit logs, and encrypted credentials you deliberately configure for repository, target, or model access.

We use data to authenticate users, enforce account and plan limits, run authorized pentests, preserve reproducible reports, process payments, deliver transactional email, prevent abuse, and respond to support or legal requests.

Depending on your configuration, GitHub handles repository access, Polar handles payments, Resend handles email, and your selected model provider or Vercel AI Gateway handles bounded inference. Each receives only data needed for that function under its own terms.

Sensitive credentials are encrypted at rest, product data is account-scoped, administrative access requires stronger controls, and secrets plus pentest content are excluded from routine logs and telemetry. No system can guarantee absolute security.

We retain active-account product data while needed to provide the service, keep billing records as legally required, and delete or anonymize data under the account-deletion workflow unless a legal hold applies.

Depending on your location, you may request access, correction, export, deletion, restriction, or objection and may complain to a supervisory authority. Account deletion includes the documented grace period before final purge.

Use the authenticated support and data-rights controls to make a privacy request. We will publish material policy changes with a new effective date and any notice required by law.