Privacy Policy

1. Data categories we collect

• Identity data. Full name provided on account creation or the contact form.
• Contact data. Work email address, company name, professional role.
• Usage analytics. Anonymous page-view events and feature interactions, recorded only after consent where required.
• Support correspondence. The contents of emails and form messages you send to our support, sales, or security teams.

2. Purposes of processing

• Operate and improve this website.
• Respond to sales, support, and partnership enquiries submitted through forms or direct email.
• Understand aggregate usage of the marketing site to improve content (consent-gated).
• Comply with legal, tax, audit, and contractual obligations owed to customers.
• Detect and defend against abuse or security incidents affecting our infrastructure.

3. Lawful bases (GDPR)

• Performance of a contract — to deliver the services you or your employer have signed up for.
• Legitimate interests — to secure our services, respond to prospect enquiries, and maintain aggregate analytics where consent is not required.
• Consent — for analytics, marketing cookies, and any other processing subject to Article 6(1)(a) where your jurisdiction requires an opt-in.
• Legal obligation — to meet tax, audit, and regulatory requirements.

4. Retention

• Analytics event data: retained for the period configured with our analytics processor (PostHog), described in Service providers and subprocessors. Analytics run only after consent where required.
• Contact form messages: retained until deletion is requested or the contact relationship lapses, whichever comes first.
• Platform data — your workspace, your pentest results, and audit records: retention is set out in the platform privacy policy and the Data Processing Addendum, which state the windows that actually apply to the deployed system rather than a window negotiated per order form.

5. Service providers and subprocessors

We share personal data with vetted third parties that help us run the website and deliver the Services. Each is bound by a contract that limits its use of the data to providing its service to us. We engage providers in the following categories:

• Hosting, CDN, and edge security — to serve the website, mitigate attacks, and store form and waitlist submissions.
• Transactional email — to send waitlist confirmations and account notifications.
• Website chat and support — to answer questions, loaded only after consent.
• Analytics and error monitoring — consent-gated product and website analytics and client-side error reporting.
• Content management and identity — to store and publish website content.

The categories above describe this website. For the platform, the sub-processor list names every third party individually, with its location and the data it receives. It is versioned separately from the policies so that a vendor change can be notified without amending them. The Data Processing Addendum governs that processing and sets the notice period before a sub-processor is added or replaced, along with the customer’s right to object.

6. Cookies and tracking

We use cookies in three categories: Essential cookies keep the site running, Analytics cookies help us understand which content is working, and Marketing cookies would support attribution if we ever run paid campaigns. Essential cookies are always on; Analytics and Marketing are opt-in where your jurisdiction requires consent.

Preferences are stored in a single first-party cookie (pntr_consent_v2) for twelve months. Clearing site data resets them to defaults (Essential on, Analytics and Marketing off). You can change any non-essential toggle below at any time; the change applies on your next page view.

7. Your rights under GDPR

• Right of access — request a copy of your personal data.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure — request deletion of your personal data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests, including direct marketing.
• Right to restrict processing — limit processing while your request is assessed.

To exercise any of these rights, email support@pentrova.ai. You can also lodge a complaint with your supervisory authority.

8. Your rights under CCPA

• Right to know. Request the categories and specific pieces of personal information we have collected about you in the preceding twelve months.
• Right to delete. Request deletion of personal information, subject to statutory exceptions.
• Right to correct. Request correction of inaccurate personal information.
• Right to opt out of sale. Pentrova does not sell personal information, and has not sold personal information in the preceding twelve months. This right therefore exists as a statutory safeguard but has no practical impact on our processing.
• Right to non-discrimination. We will not treat you differently for exercising any of the rights above.

9. US state privacy rights

Pentrova recognises the rights granted by an emerging set of US state privacy laws. Where you reside in one of these states, the rights below apply in addition to any other rights described in this policy. To exercise any right listed here, email support@pentrova.ai with the subject line "US state privacy rights". We will verify your request (which may require additional information) and respond within the statutory window.

California (CCPA / CPRA)

California residents have the rights to know, delete, correct, access, opt out of sale or sharing, limit the use of sensitive personal information, and non-discrimination. CPRA also establishes a right to data portability and extends the right to know to data older than twelve months. Submit requests through the email above.

Colorado (CPA)

Colorado residents have the rights to access, correct, delete, and opt out of (a) targeted advertising, (b) sales, and (c) profiling with legal or similarly significant effects. To opt out, email the address above or use the toggles in the Cookies and tracking section.

Virginia (VCDPA)

Virginia residents have the rights to access, correct, delete, port, and opt out of targeted advertising, sales, and profiling used for decisions producing legal or similarly significant effects. Pentrova does not engage in such automated profiling; the right is preserved as a statutory safeguard.

Connecticut (CTDPA)

Connecticut residents have the rights to access, correct, delete, port, and opt out of sales, targeted advertising, and profiling used for significant decisions. To exercise these rights, email the address above; we honour Global Privacy Control signals on the marketing site as that mechanism is added to our consent stack.

Utah (UCPA)

Utah residents have the rights to access, delete, port, and opt out of targeted advertising and sales. UCPA does not create a correction right; Pentrova still offers correction on request to every US resident as a matter of policy.

How to opt out

• Email support@pentrova.ai with the subject "Opt out" and the state you reside in.
• Use the cookie toggles in the Cookies and tracking section to disable analytics and marketing categories.
• Submit the request through an authorized agent; we require written authorization and identity verification.

10. Your rights under the India DPDPA

Pentrova is incorporated in India and acts as a Data Fiduciary for personal data of Indian residents under the Digital Personal Data Protection Act 2023 (DPDPA). Indian residents have the following rights:

• Right to access information about personal data. Confirm whether Pentrova processes your personal data and request a summary of processing activities.
• Right to correction and erasure. Request correction of inaccurate data or erasure of personal data no longer necessary for the purpose collected.
• Right to grievance redressal. Raise a grievance about Pentrova’s processing of your personal data with our named Grievance Officer. We acknowledge within 48 hours and aim to resolve within one month.
• Right to nominate. Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.

To exercise any of these rights, email support@pentrova.ai with the subject "DPDPA request". You may also lodge a complaint with the Data Protection Board of India once constituted.

11. Privacy contact and Grievance Officer

For any privacy question or request — access, correction, deletion, export, or objection — write to support@pentrova.ai. We respond within thirty days, after we have verified who you are.

If a complaint is not resolved there, or you want it escalated directly, our Grievance Officer is Anusha Dirisala, grievance@pentrova.ai. Post can be addressed to the registered office in the footer, marked for the attention of the Grievance Officer. We acknowledge a complaint within 48 hours and aim to resolve it within one month.

We have not appointed a Data Protection Officer under GDPR Article 37, and we would rather say so than imply a role we do not staff. The Grievance Officer above is the named escalation point for both this website and the platform.