Privacy Policy

Who we are

Emerald Red Team is operated by Emerald Infinite (“we”, “us”). Contact: privacy@emeraldredteam.com, Business address pending.

What we collect

• Account data: name, email, password hash (Argon2id), two-factor settings.
• Organization and billing data: plan, invoices (card details are handled by Stripe, never by us).
• Scan configuration: target URLs, scope, verification records, authorization attestations.
• Test identity credentials you give us, encrypted with AES-256-GCM and used only during scans.
• Findings and redacted evidence produced by scans.
• Quick Check data: the scanned host, a salted hash of your IP address, and summary counts. Kept 7 days.
• Usage and security logs, including audit logs of sensitive actions.

Data we see during testing but don't keep

While testing your app we may encounter personal information about your users. We don't retain it. Data-exposure checks count records instead of downloading them, and evidence is redacted (emails, phone numbers, names, card numbers, government IDs, tokens and keys) before it is stored or sent to any AI model. Discovered secrets are stored only as a fingerprint and a masked value.

How we use data

• To run the scans you request and show results.
• To send transactional emails (verification, alerts, reports, billing).
• To prevent abuse, including scanning sites you don't control.
• To improve the product using aggregated, anonymized statistics (minimum cohort of 50 apps, no hostnames).

AI processing

We use Anthropic's API on commercial terms that prohibit training on our inputs. Only redacted evidence and check metadata are sent. See our AI Disclosure.

Sharing

We share data only with the subprocessors listed on our Subprocessors page, as needed to run the service, or when required by law. We don't sell or share personal information for cross-context behavioral advertising. Our app contains no advertising pixels.

Cookies and tracking

The app uses only strictly necessary cookies (session, security). Our marketing site loads analytics or advertising tags only after you opt in, and honors Global Privacy Control. See our Cookie Policy.

Retention

• Account data: life of the account plus 30 days.
• Findings and evidence: per plan (30 days Free, 1 year Builder/Pro, 2 years Agency).
• Scan logs: 90 days. Quick Check runs: 7 days. Audit logs: 1 year.
• Billing records: 7 years. Consent records: 7 years.
• Repository contents: never stored; cloned into temporary storage and wiped when the scan job ends.

Security

Tenant data is isolated by database row-level security, credentials are envelope-encrypted, and two-factor authentication is required for owners and admins. No system is perfectly secure; we will notify affected customers within 72 hours of a confirmed breach of credentials or tokens.

Your rights

Depending on where you live, you can access, correct, delete or export your data, and opt out of certain processing. Use the Privacy Requests page or email us. We won't discriminate against you for exercising your rights. EU/UK customers: we act as a processor for your app data and offer a Data Processing Agreement.

Children

Emerald Red Team is for people 18 and older. We don't knowingly collect data from children.

Changes

We'll post changes here with a new effective date and email account holders about material changes.