Back to login

Privacy policy and personal data protection

This Privacy and Personal Data Protection Policy explains how Crinos Cybersecurity collects, uses, stores, shares, and protects personal data when the automated penetration-testing platform IronBOT ("platform", "we") is used. It applies to registered users, members of organizations, and visitors to the website.

We drafted this policy in accordance with Law No. 13,709/2018 (LGPD, the Brazilian General Data Protection Law), with the Brazilian Civil Rights Framework for the Internet (Law No. 12,965/2014) and, where applicable, with Regulation (EU) 2016/679 (GDPR). This policy may be updated — see "Changes to this policy".

Our principles

We process personal data lawfully and transparently; only for specific, explicit, and legitimate purposes; limited to what is necessary for those purposes; kept accurate, retained only for as long as necessary, and protected by technical and organizational measures appropriate to the risk.

What data we collect

  • Registration and profile: name, email, phone number, preferred language, password (stored in a non-recoverable form) and, where applicable, the secret and recovery codes for two-factor authentication.
  • Organization: organization name and slug, the user's role (owner, member, viewer), and the links between users and organizations.
  • Targets and pentests: hostname, repository URL, chosen verification method, submitted authorization documents (including their content, which may contain personal data of third-party signatories), test scope, scan results, vulnerability findings, and generated reports.
  • Payment: processed directly by the online payment institution (Stripe) or outside the platform in private records (in the case of issuing a boleto). We do not store card numbers, only customer/subscription identifiers provided by the payment method, where applicable.
  • Technical: IP address, browser and device type, access logs, and usage metadata, for security, fraud prevention, and diagnostics.
  • Support: content of tickets, messages, and attachments (PDFs, images).

We do not seek to collect sensitive personal data (racial or ethnic origin, religious or philosophical beliefs, political opinion, trade-union membership, genetic data, biometric data, health data, sex life, or criminal convictions), as set out in art. 11 of the LGPD and art. 9 of the GDPR. If an authorization document you send contains this type of data, it will be processed only for the purpose of verifying the legitimacy of the test, with no use for any other purpose.

Legal basis for processing

We process personal data based on one or more of the grounds in art. 7 of the LGPD and art. 6 of the GDPR:

  • Performance of a contract or of preliminary procedures: to create and maintain your account, run pentests, generate reports, and process payments;
  • Compliance with a legal or regulatory obligation: retention of records and responding to competent authorities;
  • Legitimate interest: platform security, fraud prevention, misuse analysis, and continuous improvement of the service;
  • Regular exercise of rights: including for the defense in disputes over the legitimacy of a test;
  • Consent: when required, and always revocable (for example, optional cookies).

Roles in processing

  • Controller: Crinos Cybersecurity is the controller of registration, organization, and platform-usage data.
  • Processor: as for the data contained in the authorization documents, scopes, and pentest results provided by the client, we act as a processor, processing them according to the client's instructions (the client being the controller of that data).
  • Data Protection Officer (DPO): Angelo Tiéres Gomes Calde (see how to contact us in "Your rights"), under art. 41 of the LGPD and arts. 37 to 39 of the GDPR.

How we use your data

  • Service delivery: creating and managing your account, running the requested pentests, generating reports, processing payments, sending operational notifications, and providing support.
  • Security and fraud prevention: verifying legitimate authorization over tested targets, detecting misuse of the platform, and protecting our systems and those of third parties.
  • Service improvement: understanding how the platform is used in order to fix issues and develop features.
  • Compliance with legal obligations: retaining records when required by law or to respond to requests from competent authorities, including where misuse against a target without legitimate authorization is suspected.

Sharing with third parties and international transfers

We share personal data only with providers strictly necessary for the operation, under a contractual obligation of confidentiality and security:

  • Online payment institution (Stripe) — billing and subscription identification;
  • S3-compatible object storage — authorization documents, reports, and attachments;
  • Email provider (SMTP) — transactional notifications;
  • Artificial intelligence provider (LLM) — technical pentest data, for analysis and report generation;
  • Cloud infrastructure — isolated execution of the test agents.

International transfer: some of these providers are located outside Brazil, including in the United States and the European Union. In these cases, the transfer takes place under arts. 33 et seq. of the LGPD and arts. 44 et seq. of the GDPR, based on contractual guarantees and the applicable legal grounds.

We do not sell or license your personal data for third-party marketing purposes. We may disclose data when required by law, court order, or a request from a competent authority.

Data retention

We keep your data for as long as necessary for the purposes of this policy or to meet legal and contractual obligations, including the retention period for target authorization evidence, necessary for accountability in case of a dispute over the legitimacy of a pentest.

Once processing ends, data may be kept in the cases set out in art. 16 of the LGPD and art. 17(3) of the GDPR: compliance with a legal or regulatory obligation; transfer to a third party within the limits of the law; and our exclusive use, with anonymized data and no third-party access.

Information security

We adopt technical and administrative measures appropriate to the risk, including encryption of passwords and sensitive secrets, network isolation when running the pentest agents, and role-based access control. No system is absolutely secure. In the event of a relevant security incident that may pose a risk to data subjects, we will notify the affected users and the Brazilian National Data Protection Authority (ANPD) within an appropriate timeframe, in accordance with art. 48 of the LGPD and arts. 33 and 34 of the GDPR.

Data of children and adolescents

IronBOT is not intended for minors and does not knowingly collect data from children and adolescents through the platform. If we identify this type of data, it will be immediately removed from our records.

We may, however, collect such data for the purpose of granting benefits to employees and complying with labor obligations, in accordance with Brazilian law.

Cookies

Cookies are small files sent by the website to your device. We use:

  • Strictly necessary (mandatory): language preference and authentication session. Without them, the service does not work properly.
  • Optional (subject to your consent): analytics cookies — for example, Google Analytics — and usage-preference cookies. You choose in the cookie banner and can change your mind at any time.

Your choice is recorded locally in your browser. Our analytics cookies are optional and may share data with access-analysis tools (e.g., Google Analytics). We do not use third-party advertising tracking cookies on the platform.

You can manage or delete cookies in your browser settings. Disabling optional cookies does not reduce service availability; disabling strictly necessary cookies may affect functionality. Instructions for the most used browsers:

Your rights

You may, in relation to your personal data: confirm the existence of processing; access it; correct incomplete, inaccurate, or outdated data; anonymize, block, or delete unnecessary, excessive, or non-compliant data; request portability; delete data processed with consent; obtain information about sharing; and withdraw consent at any time, as set out in art. 18 of the LGPD and arts. 15 to 22 of the GDPR.

To exercise them, write to contato@ironbot.io stating: (a) your full name or company name and CPF/CNPJ, with a contact email; (b) which right you wish to exercise; (c) the date of the request; and (d) documents proving ownership or justifying the request. We may request identity verification before responding in order to protect access to your personal data. We will respond within the timeframes provided by the LGPD or the GDPR, in accordance with your location, except in cases of mandatory retention provided by law or necessary for the defense of rights in disputes over the legitimacy of a pentest.

Complaint to a supervisory authority

Without prejudice to other administrative or judicial remedies, you have the right to lodge a complaint with a supervisory authority.

  • In Brazil: Brazilian National Data Protection Authority (ANPD) — https://www.gov.br/anpd/pt-br
  • In other countries: the authority of your country of residence, place of work, or where the infringement is alleged to have occurred, in accordance with the GDPR where the location is part of the European Union.

Duty not to provide third-party data

When you send authorization documents, scopes, or any material containing third-party personal data, you declare that you have the legal basis and authorization to share it with us, under the LGPD or the GDPR. In relation to that data, we act as processors, processing it only according to your instructions and for the purposes of the contracted test — without our own use for other purposes.

Changes to this policy

We may update this policy periodically. Material changes will be communicated by email or a notice on the platform before they take effect. By continuing to use the service after the changes, you show your agreement with the version in force; if you disagree, we ask that you stop using the service and contact us.

Governing law and jurisdiction

This policy is governed by Brazilian law. The Court of the District ("Comarca") of Rio de Janeiro/RJ is elected to settle any disputes relating to this policy.

How to contact us

Questions, requests, or complaints about the processing of personal data may be sent to the Data Protection Officer of Crinos Cybersecurity:

Data Protection Officer: Angelo Tiéres Gomes Calde

  • Email: contato@ironbot.io
  • Mail: Rua Santa Luzia, 651, 25th floor, Centro — Rio de Janeiro/RJ