Privacy Policy
Notice version 2026-10 · Last updated 11 October 2026
We collect what we need to run your scan, deliver your report and support you. Nothing more.
No advertising, no tracking pixels, no data brokers. We do not sell or rent personal data.
See, correct or erase your data, withdraw consent or name a nominee at /data-request.
1. Who we are
getcodeaudit.com ("GetCodeAudit", "we", "us") is operated by Cruzetec Solutions, a partnership firm registered in India (GSTIN 03AAQFC5394M1ZW), with its registered office at Cruzetec Solutions, Mohali.
Under India's Digital Personal Data Protection Act, 2023 (DPDP Act) we are the Data Fiduciary for the personal data described here, and you are the Data Principal. For people in the EU or UK, we are the data controller under the GDPR. This policy applies to every customer, partner and visitor, wherever you are.
Questions about this policy: grievance@getcodeaudit.com. General support: support@getcodeaudit.com.
This notice is in English. If you would like it in any language listed in the Eighth Schedule to the Constitution of India, email us and we will provide it.
2. What we collect and why
Each form on this site that collects personal data shows a short notice above its submit button with a link here. Submitting the form is your consent for the purposes listed for that form. We record which version of this notice you saw and when (we store a one-way hash of your email for this record, not the address itself).
| Where | Personal data | Purpose |
|---|---|---|
| Pentest order (homepage checkout) | Email, target URL, optional recipient name for the report cover, your authorisation confirmations, IP address | Run the scan you paid for, email the report, prevent abuse, keep tax records |
| Payment | Email, amount, Razorpay order, payment and refund IDs. Card, UPI and bank details are entered in Razorpay's window and never reach us | Take payment, issue refunds and invoices |
| Manual penetration test request | Email, phone, target, scope notes, IP address | Arrange the engagement; shared with the tester assigned to it |
| Report builder (for pentesters) | Your email, client name, logo and finding text you enter | Build, deliver and let you re-download your report |
| Support ticket and help widget | Email, subject, message, optional order reference and attachment, IP address | Answer your request |
| Contact and partner (join as a pentester) forms | Name, company, email, phone, country, tax ID, website, background, IP address | Respond to you and assess partner applications |
| Partner accounts | Login email, password hash, second-factor and passkey data, billing details, payout bank account (encrypted) | Run your partner account, pay earnings, issue invoices |
| Refund and payment concerns, report recovery, data-rights requests | Email, order reference, your message, IP address | Resolve your request and verify it is really you |
| Free security and DPDP checks | The website address you enter (no personal data), and your IP address for rate limiting | Read that site's public homepage and privacy notice, and show you the result. Results are cached for 10 minutes and deleted daily |
| Nekoba, our AI assistant | The messages you type and the page you are on | Answer your question in the chat (see section 3) |
| Every visit | IP address, browser user agent, pages requested | Security logging, rate limiting, blocking attacks, choosing your currency |
We do not use your data for advertising, profiling or automated decisions that have legal or similarly significant effects on you. Marketing email is off; we would only send it if you opted in separately.
Some processing does not rely on consent, as the DPDP Act s.7 and the GDPR allow: keeping tax and accounting records the law requires, responding to lawful orders, and preventing fraud and attacks on our systems.
3. AI features
Two features send text to our AI provider, Anthropic, PBC (USA), to generate a response:
- Nekoba, the assistant in the corner of every page. Before your first message you see a short notice and choose "Accept and start". Your messages, the earlier messages in the same chat and the page you are on are sent so it can answer. We do not store the conversation on our servers; it lives only in your browser tab until you close it or press Clear. We keep a count of messages per IP address for rate limiting.
- Wording assist in the report builder. Only the field you ask it to improve is sent.
Anthropic processes this content to provide the service under its commercial terms, which do not allow it to train its models on this content. Please do not type passwords, secrets or other people's personal data into these features. AI answers can be wrong; Nekoba is not legal or security advice for your specific system.
4. Scan findings and reports
A scan produces "findings": what we tested, what we observed and how to fix it. Findings can include URLs, HTTP responses and snippets from your target, which may contain personal data if your site exposes it.
- Findings are stored in our database on a server whose database is not reachable from the internet. They are not individually encrypted inside that database.
- Your PDF report is password-protected. Today the password is sent in the same email as the PDF, so anyone who can read that email can open the report. Keep the email private, and forward only the PDF if you share it.
- Findings and the PDF are deleted 30 days after the scan completes. You can re-download the report until then at /recover.
- We do not share findings with anyone except you and, for manual testing, the tester assigned to your engagement. We do not aggregate them for research or sell them. If we believe a scan was run without authorisation, see section 5.
5. Who we share data with
We use the following processors. Each receives only what it needs for the listed purpose.
| Processor | What they receive | Why | Location |
|---|---|---|---|
| Razorpay Software Pvt. Ltd. | Email, amount, order ID; your payment details entered in its window | Payments and refunds | India |
| Hostinger | Everything stored on our server; every email we send and receive | Server hosting and email mailboxes | Hostinger data centres |
| Anthropic, PBC | Nekoba chat messages; report text you ask wording assist to improve | AI assistant and wording assist | USA |
| ipapi.co and country.is | Your IP address | Look up your country to show the right currency. We cache the answer for 24 hours under a hash of your IP | USA / EU |
| Independent pentesters (manual testing only) | Target, scope, your contact email and phone, your scan results | Carry out the manual test you ordered | Varies by tester |
We do not share data with advertisers, data brokers or other customers, and we never accept payment for it.
Legal disclosure. We may disclose data when the law requires it (a court order or a valid request from a government authority), or when it is necessary to protect people or our systems. If an order was placed for a target the customer was not authorised to test, we may share the order record and IP address with the target's owner or with law enforcement.
6. Cookies and browser storage
We use no advertising or analytics cookies and no third-party trackers.
| Name | Where | Purpose | Lasts |
|---|---|---|---|
PHPSESSID | Report recovery and report-builder pages | Keeps your session and its security token between steps. Secure, HttpOnly, SameSite=Strict | Until you close the browser |
gca_admin_sid | Staff and partner sign-in only | Keeps you signed in | Short session |
gca-consent (local storage) | Every page | Remembers your privacy choices from the consent banner | Until you clear site data or we update this notice |
gca-nekoba-consent (local storage) | Every page | Remembers that you accepted the Nekoba notice | Until you clear site data |
gca-theme (local storage) | Every page | Remembers light or dark mode. Only if you allow "Remember my preferences" | Until you clear site data |
| Session storage | Every page | Remembers that you closed an offer banner or greeting. Holds your Nekoba chat for this tab only if you allow "Assistant chat history" | Until you close the tab |
The session cookies and the consent records are strictly necessary. The optional items are off until you say yes in the consent banner, and you can change your choice any time from "Privacy preferences" in the footer. Browser storage never leaves your device.
7. How long we keep data
We erase personal data once the purpose is served, unless a law requires us to keep it. A scheduled job enforces these windows every night.
| Data | Kept for |
|---|---|
| Scan findings and PDF report | 30 days after the scan completes |
| Report-builder findings and PDF | 30 days after the report is built |
| Order record (email, target, recipient name, payment IDs) | 12 months after the order |
| Invoices and credit notes | As long as GST and income-tax law require (generally up to 8 years) |
| Manual testing request: phone, notes, IP address | Erased 24 months after the request; the email stays with the invoice record |
| Security, audit and access logs (include IP and user agent) | 90 days |
| Report-recovery attempts | 7 days |
| Support tickets, attachments and contact enquiries | 3 years |
| Partner applications that are not accepted | 12 months |
| Partner accounts | While the account is active; payment records as tax law requires |
| Data-rights requests | 3 years after the request (unconfirmed requests: 30 days) |
| Consent records (hashed email, notice version, time) | 3 years, as proof of consent |
| Rate-limit counters and currency cache | 2 days and 24 hours |
| Free security check results | 10 minutes (cache), purged daily |
| Nekoba conversations | Not stored by us |
8. How we protect data
Security is what we sell. Our controls follow the OWASP Top 10:2025 as a baseline:
- TLS on every connection, including outgoing email (plaintext SMTP is refused).
- The database is reachable only by the application, never from the internet. All queries use prepared statements.
- Manual-testing contact details and partner bank accounts are encrypted field by field with a key held outside the database.
- Staff and partner sign-in needs a second factor (authenticator code or passkey), with lockout and alerts on repeated failures.
- Signed-in actions are protected against cross-site request forgery; public forms are rate-limited and filtered for bots; security events alert a human.
- Card and bank data never touch our servers.
No system is perfectly secure. To report a vulnerability, email security@getcodeaudit.com (see our security policy). We respond within 48 hours.
9. Your rights
We honour these rights for everyone, wherever you live:
We email a confirmation link to the address you enter, so only the owner of that inbox can make the request. We need only that email address (and an order reference, if you have one). We reply within 30 days, and always within the 90 days the DPDP Rules allow. There is no charge.
Your duties. The DPDP Act (s.15) asks you not to impersonate someone else, not to withhold material information when giving us data, and not to file false or frivolous complaints.
10. Consent and withdrawal
Where we rely on consent, you can withdraw it at any time at /data-request (choose "Withdraw my consent") or by emailing grievance@getcodeaudit.com. We then stop the processing and erase the data unless a law requires us to keep it. If you withdraw consent for an order in progress, we may not be able to finish that service. You may also manage consent through a Consent Manager registered with the Data Protection Board once that service is available.
11. Grievances and complaints
Grievance Officer
Abhishek Gupta, Cruzetec Solutions
Email: grievance@getcodeaudit.com
Post: Cruzetec Solutions, Mohali
You can also raise a grievance through /data-request. We acknowledge it promptly and resolve it within 30 days, and always within 90 days.
If you are not satisfied, you may complain to the Data Protection Board of India after using our grievance process (DPDP s.13(3)). People in the EU or UK may complain to their local data protection authority (in the UK, the ICO).
12. International transfers
We operate from India. Some processors (section 5) are in the USA or elsewhere, so your data may be processed outside India or outside your own country. The DPDP Act s.16 permits this except to countries the Government of India restricts; we will stop any such transfer if a restriction applies. For EU and UK data we rely on the processor's contractual commitments, such as standard contractual clauses.
13. Data breaches
If a breach affects your personal data, we will tell you without delay, in plain language: what happened, the likely impact, what we are doing about it and what you can do. We also report it to the Data Protection Board of India and, where required, to other regulators, within the time the law sets.
14. Children
Our services are for adults. We do not knowingly collect data from anyone under 18 and we do not offer a parental-consent flow. If you believe a child has given us personal data, email us and we will delete it.
15. Changes to this policy
When we change this policy we update the version and date at the top. For material changes, we also email customers who ordered in the last 90 days. Consent records always store the version that was shown to you.
Previous version: this page before 11 October 2026 is available on request.