Legal
Our commitments to your data: what we collect, why we collect it, how we protect it, and the rights you always retain.
This Privacy Policy explains how SecureCheap ("we", "us", "our") collects, uses, shares, and protects information about you when you use our Service. We designed SecureCheap with privacy as a default — we collect what we need to deliver the Service, nothing more.
We comply with GDPR (EU), CCPA/CPRA (California), UAE PDPL, and applicable data protection laws worldwide. You always retain control of your data — export, modify, or delete it anytime.
Account information you provide: name, email, company and billing address. Payments are made by bank transfer or a local payment method and are confirmed manually, so we do not process or store card numbers.
Service data: monitoring metrics, security scan results, alert configurations, infrastructure inventory you choose to add. This is your Customer Data — you own it, we process it on your behalf.
Usage data: pages visited, features used, performance metrics. Used solely to improve the Service. Aggregated and anonymised where possible.
Communications: support tickets, chat messages, feedback. Retained for service improvement and quality assurance.
To provide, operate, and maintain the Service — including running monitors, executing security scans, generating alerts, and powering AI recommendations on your behalf.
To send transactional emails: account confirmation, billing receipts, security alerts, incident notifications, password resets. You cannot opt out of these while you have an active account.
To send product updates and marketing — only if you opt in. You can unsubscribe at any time from any marketing email.
To detect, prevent, and respond to fraud, security incidents, and abuse.
To comply with legal obligations, court orders, and lawful regulatory requests.
We will never sell your personal information to third parties. Full stop.
We will never use Customer Data (metrics, security findings, infrastructure details) to train machine learning models without explicit, granular opt-in.
We will never access your Customer Data except as strictly necessary to operate the Service, respond to support you initiate, or comply with a binding legal order.
We will never enable tracking pixels or behavioural advertising on the dashboard or product UI.
The Service runs in a single hosting region in Germany, and that is where Customer Data is stored. We do not currently offer a choice of data region, and single-tenant infrastructure is not available today.
If this changes, we will update this policy and tell account owners before any data is moved.
Stored credentials and API keys are encrypted with AES-256-GCM. Traffic to our services uses TLS. Passwords are hashed with bcrypt and never stored in plain text.
Workspace data is scoped to its team, access is controlled by roles, and administrative actions are recorded in an audit log.
If we become aware of a security incident affecting your personal data, we will notify you without undue delay as required by applicable law.
Active accounts: We retain your data for as long as your account is active and for legitimate business purposes.
Closed accounts: Customer Data is deleted within 30 days of account closure. You can request immediate deletion at any time.
Billing records: We retain billing data for 7 years to comply with tax and accounting laws.
Audit logs: retained with the account record and used for security and investigation purposes.
Backups: the database is backed up daily. Copies are kept on the server for 30 days and an encrypted copy is stored off-site. Data you delete disappears from the live Service straight away, but may remain inside an off-site backup copy for longer; those copies are never shared and are used only to restore the Service after a failure.
Access: Request a copy of all personal data we hold about you, in machine-readable format.
Correction: Update or correct inaccurate personal information directly in your account settings or by emailing [email protected].
Deletion: Request deletion of your personal data. We will comply within 30 days unless legally required to retain it.
Portability: Export your data via the API or dashboard at any time, in JSON, CSV, or PDF format.
Restriction & objection: Restrict processing of your data or object to specific processing activities.
Withdraw consent: Revoke marketing consent or opt out of optional data uses anytime.
To exercise any right, email [email protected]. We respond within 30 days (often within 48 hours).
The Service is not directed to children under 18. We do not knowingly collect personal information from children. If we discover such collection, we delete it immediately.
If you believe a child has provided personal information, contact [email protected].
Customer Data is stored in Germany. Where a sub-processor necessarily processes data outside the European Union, we rely on the Standard Contractual Clauses together with encryption in transit, encryption at rest and access controls.
We may update this Privacy Policy from time to time. Material changes will be notified by email to the account owner at least 30 days before taking effect.
All historical versions of this policy are available at [email protected] on request.
Privacy and legal inquiries: [email protected]
Security disclosures: [email protected]
General support: [email protected]