Privacy Policy

The controller for the processing described in this Privacy Policy is BLUE SKY SOFTWARE LTD, Archiepiskopou Makariou III, 59, Mouyias Tower, 6017 Larnaca, Cyprus.

For any question about data protection, and to exercise your rights, contact us at legal@superhack.app.

When a customer uses superhack to test its own systems, we process the data within the scope of that testing, such as targets, scan results and findings, together with any personal data they contain. We do this on behalf of and under the instructions of that customer. For this data the customer is the controller and we act as its processor under our Data Processing Agreement (DPA). If your personal data is contained in such data, please contact the customer concerned. This Privacy Policy covers the processing for which superhack itself is the controller.

When you open superhack.app, our hosting provider Vercel processes the technical data that your browser sends with every request, so that the website can be delivered and protected against misuse: your IP address, the date and time of the request, the page requested, the referring page, and your browser and operating system.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to deliver the website reliably and securely.

To understand how the website is used, we use the web analytics of PostHog in its EU cloud, in cookieless mode. With each page view PostHog receives the page, the referring page, your IP address and your browser details, and counts visits with a privacy-preserving identifier that it derives on its servers. Nothing is stored in your browser for this, and the PostHog script and its requests run through our own domain.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to understand how visitors use the website and to improve it.

The public website does not set cookies and does not use advertising tools. Fonts and all other resources are delivered from our own servers. The website stores one display preference in your browser's local storage, the view you chose on the Threat Landscape page; this value stays on your device. How the platform uses cookies is described in our Cookie Notice.

If you have an account on the platform, we process your name, email address, organisation and role, your sign-in and session data, information about how you use the platform (usage events, browser and device information, IP address), and the messages we send you, such as invitations and notifications.

• Providing the platform and your account. Art. 6(1)(b) GDPR where you have a contract with us. Where the contract is with your employer, Art. 6(1)(f) GDPR: our legitimate interest is to provide the service your employer has subscribed to.
• Security of the platform. Access logs and the detection of misuse. Art. 6(1)(f) GDPR, our legitimate interest in protecting the platform and the data in it.
• Product analytics and error monitoring. To understand how the platform is used and to find and fix problems, we use PostHog in its EU cloud. Art. 6(1)(f) GDPR, our legitimate interest in improving the platform.
• Service emails. Invitations, notifications and account messages, sent through our email provider Resend. Art. 6(1)(b) or (f) GDPR, as above.

When you write to us, for example to support@, sales@, security@ or legal@superhack.app, we process your email address, your name and the content of your message to answer you and to handle your request.

Legal basis: Art. 6(1)(b) GDPR where your message concerns a contract or steps before one; otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering the messages we receive.

If you report a vulnerability, we use your report and your contact details to investigate and fix the issue and to coordinate any disclosure with you. Art. 6(1)(f) GDPR, our legitimate interest in the security of our platform.

For contact persons at our customers, prospective customers and partners, we process names, business contact details, roles, correspondence, and contract and billing information. We receive this data from you or from the company you work for.

Legal basis: Art. 6(1)(b) GDPR to conclude and perform contracts, or Art. 6(1)(f) GDPR where the contract is with your company; Art. 6(1)(c) GDPR to meet our obligations under commercial and tax law.

We share personal data only where this is necessary for the purposes above:

• with service providers that process data on our behalf under data processing agreements, for example for hosting, the database, email and product analytics; they are listed in our Subprocessor List;
• with authorities, courts and our professional advisers, where we are legally required to or where this is necessary to establish, exercise or defend legal claims.

We do not sell personal data.

Some of our service providers process personal data outside the European Economic Area, in particular in the United States. Where there is no adequacy decision of the European Commission for the recipient, we use the Standard Contractual Clauses adopted by the Commission (Art. 46(2)(c) GDPR). How we assess these transfers is described in our Transfer Impact Assessment Overview. You can request a copy of the safeguards at legal@superhack.app.

We keep personal data only as long as it is needed for the purpose for which we collected it:

• Technical data from visits to the website: for a short period set by our hosting provider, unless it is needed to investigate a security incident.
• Account data: as long as your account exists. After the account is closed or the contract ends, we delete or anonymise it, unless we are required to keep it longer.
• Messages and vulnerability reports: as long as needed to handle the matter and any follow-up.
• Contract and billing records: for the retention periods required by commercial and tax law.

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• have the processing restricted (Art. 18);
• receive your data in a structured, machine-readable format (Art. 20);
• withdraw any consent you have given, with effect for the future (Art. 7(3)).

Right to object. Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

To exercise your rights, write to legal@superhack.app.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you live, where you work or where the alleged infringement took place (Art. 77 GDPR). The authority responsible for us is the Commissioner for Personal Data Protection in Cyprus (www.dataprotection.gov.cy).

You can visit the website without providing any personal data beyond what your browser sends. To create and use an account, we need at least your name and email address; without them we cannot provide the platform. Everything else you share with us is voluntary.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

We update this Privacy Policy when our processing or the law changes. The current version is always published on this page, with the date of the last update at the top.