1. Who we are
Papaya Privacy Co. ("Papaya", "we", "us") is the data controller for personal data processed through The Privacy Pentest. This notice explains what we collect, why, and the rights you have. If you have questions, contact us at ram+privacy-pentest@papayacomply.ai.
2. Personal data we collect
- Assessment data: the website address you submit and the testing configuration (journeys, jurisdictions, consent scenarios) you choose.
- Contact data: your email address, if you provide one, so we can identify your assessment and follow up about it.
- Test evidence: screenshots, network requests, and analysis of the website you submit. This is website data rather than your personal data, but it can incidentally include personal data (for example, a test journey's account details).
- Usage and device data: IP address, browser type, and basic telemetry about how the service is used, collected for security and reliability.
- Support and billing context: messages you send us, and billing metadata. Payment card details are collected and processed by Paddle, our Merchant of Record, and are not stored by us.
3. Why we use your data, and our legal bases
- To provide the service — run tests, generate reports, and let you view them (contract performance).
- To process payments and manage subscriptions — handled by Paddle as Merchant of Record; we record the resulting status (contract performance).
- To provide support — respond to your questions and help with refunds (contract performance, or legitimate interests).
- To secure and improve the service — prevent abuse, debug failures, and improve test quality (legitimate interests).
- To communicate service updates — notify you when a run completes or a report is ready (contract performance; marketing, where used, only with consent).
- To comply with law — keep records and respond to lawful requests (legal obligation).
4. Who we share data with
- Service providers (subprocessors): hosting and database providers, AI providers used to analyse test results, and support tooling, each bound by contracts limiting use to our instructions.
- Paddle.com: our online reseller and Merchant of Record. Paddle handles the sale of the product, subscription management, payments, tax compliance, and invoicing. Paddle's privacy notice explains how Paddle uses your payment data.
- Professional advisers: lawyers and accountants, where needed.
- Authorities: where required by law or to protect our rights.
5. International transfers
Our service providers may process data outside the UK and EEA. Where that happens, we rely on appropriate safeguards such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision.
6. How long we keep data
Assessment reports and test evidence are kept while they remain useful to you and for a reasonable period afterwards for record-keeping; billing records are kept as long as tax law requires. Data that is no longer needed is deleted or anonymised. You can ask us to delete your assessment data sooner — see "Your rights" below.
7. Your rights
Depending on where you live, you have some or all of the following rights: access to your data, rectification, erasure, restriction of processing, data portability, objection to processing, withdrawal of consent, and the right not to be subject to purely automated decisions. Residents of California have additional rights under the CCPA/CPRA, including the right to know what personal information we collect, to delete it, to correct it, and to opt out of its sale or sharing — we do not sell or share personal information for cross-context behavioural advertising.
To exercise any right, email ram+privacy-pentest@papayacomply.ai. We respond within one month (and as required under California law). You also have the right to complain to your local supervisory authority — in the UK, the Information Commissioner's Office; in France, the CNIL; in California, the California Privacy Protection Agency or Attorney General.
8. Security
We apply appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and keeping report access limited to unguessable links.
9. Cookies
The Privacy Pentest website uses only essential cookies and equivalent storage needed to make the site work (for example, keeping a report open while you view it). We do not use advertising or third-party analytics cookies. You can clear or block these through your browser settings.
10. Changes to this notice
We may update this notice from time to time. The current version is always available on this page.