Privacy Policy

Last Updated: July 3, 2026

Mangudai ("we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, process, store, and protect your data when you use our website and services. This policy complies with the EU General Data Protection Regulation (GDPR) and the Law on Protection of Personal Data No. 6698 (KVKK).

1. Data We Collect

In order to provide our services, we collect the following types of information:

• Account Information: E-mail address, full name, company name, and password hash used for authentication.
• Scan Targets: Hostnames, IP addresses, and subdomains you explicitly register for security assessments.
• Scan Findings & Reports: Vulnerabilities, open ports, SSL certificates, and metadata discovered during the automated scout process.
• AI Analysis Data: Prior to forwarding findings to the Gemini API for executive summary generation, personal data (PII) such as emails, IPs, and phone numbers are automatically masked.

2. How We Use Your Data

We process your data for the following purposes:

• To execute, manage, and present security scanning reports,
• To authenticate accounts, manage billing, and process subscription plans,
• To deliver email and Slack alert notifications about critical findings and certificate expirations,
• To maintain and secure the platform against abuse.

3. Data Retention & Deletion Policy

Your personal data and scan results are retained only as long as necessary for their business purposes:

• Scan results and logs for Free (Scout) tier users are stored for 90 days, after which they are automatically pruned.
• Scan history and findings for paid tier subscriptions are stored for up to 1 year (365 days).
• Upon account deletion, all user profile info and scan results are permanently and irreversibly purged from our servers.

4. User Rights (GDPR & KVKK Compliance)

Under applicable data protection laws, you possess the right to:

• Access your data and request a copy of your records,
• Rectify inaccurate or incomplete information,
• Request the permanent erasure of your data (right to be forgotten),
• Object to or restrict the processing of your data.