Legal
Privacy Notice
Last updated: 4 November 2026
Who we are
FlawStrike is operated by FlawStrike, Dublin, Ireland, and we are the data controller for the personal data described here. Contact us through our contact page or on +353871316382.
What we collect, and why
| Data | Why we use it | Legal basis (GDPR) |
|---|---|---|
| Email, hashed password and verification status | To provide your account | Contract, Art. 6(1)(b) |
| Scan targets, settings and results | To run scans and produce your reports | Contract, Art. 6(1)(b) |
| IP addresses, browser details, and the times you sign up, log in or start a scan | To keep the service secure and investigate misuse | Legitimate interests, Art. 6(1)(f) |
| Records of the declarations you accept and your scan authorization confirmations | To show that terms were accepted and to handle complaints or legal claims | Legitimate interests, Art. 6(1)(f) |
| Credit requests and contact messages | To reply to you and manage your request | Contract or legitimate interests |
Our legitimate interests are protecting our service, the systems scanned through it, and our legal position. You can object to this processing, and we will consider your objection, as explained under Your rights.
Login details you enter for a login-protected scan are used to run that scan and are removed from the scan record once it finishes.
Scanned systems
Scans can collect limited personal data that a target system exposes. You are responsible for having a lawful basis to test that system, and for how you use the results.
Who we share data with
We use these service providers, under agreements that limit how they use your data:
- Tencent Cloud hosts the service on servers in Frankfurt, Germany.
- Brevo sends our emails.
Where a provider or its group transfers data outside the European Economic Area, we rely on a lawful transfer mechanism, such as Standard Contractual Clauses.
When we may disclose your data
We do not sell your data. We may disclose your account details, IP addresses and scan records only where the law allows and it is necessary, for example:
- to comply with a valid legal request from police, a court or a regulator;
- to establish, exercise or defend legal claims; or
- to the owner of a scanned system, or their legal representative, where we receive a credible complaint of unauthorized scanning.
We review each request first, and share only what is needed. We will tell you unless the law or an investigation prevents it.
How long we keep data
- IP and activity logs: 12 months, then deleted automatically.
- Account, scan and declaration records: for the life of your account, and afterwards only where needed for legal claims or obligations.
- Contact messages and credit requests: for as long as needed to deal with them and any follow-up.
Cookies
We use one essential session cookie to keep you logged in and protect forms. We don't use advertising or analytics cookies, so there's no cookie banner. Our fonts are hosted on our own server.
Your rights
You can ask to access, correct, delete or move your data, or to restrict or object to how we use it. Some data may be kept where the law requires it or for legal claims. To make a request, use our contact page. You can also complain to a data protection authority, such as the Data Protection Commission in Ireland or the authority where you live.
Changes
We will post updates here, and ask you to review material changes.