Privacy Policy

1. Data categories we collect

• Request data. Every page request reaches our host, Cloudflare, with your IP address, browser and device details (user agent), the page you asked for and the page that linked to it.
• Page-load measurements. On every page, for every visitor, a Cloudflare Web Analytics script sends Cloudflare the page address, the page that linked to it and how long the page took to load and display. It sets no cookies and writes nothing to your browser’s storage.
• Form data. What you type into the contact, demo, waitlist, newsletter and report forms: typically your name, work email address, company, role and message, plus the page you sent it from, the referring page and campaign tags (UTM). We store a one-way hash of your IP address with it, never the address itself, and your user agent.
• Session recordings and heatmaps (only with analytics consent). Microsoft Clarity records how you move through these pages: clicks, scrolling, mouse movement, the pages you view, and device and browser details.
• Chat (only with chat consent). Messages you send through the Ask Fin bar, with the visitor and session identifiers Intercom assigns, the page you are on, and device and browser details.
• Support correspondence. The contents of emails and form messages you send to our support, sales, or security teams.

2. Purposes of processing

• Operate, secure and serve this website.
• Respond to sales, support, and partnership enquiries submitted through forms, chat or direct email.
• Count page views and measure how quickly pages load, with Cloudflare Web Analytics, so we can keep the site fast and working. This is our legitimate interest; it runs for every visitor and sets no cookies.
• Understand how visitors use the site so we can improve it, through session recordings and heatmaps, only with your consent.
• Comply with legal, tax, audit, and contractual obligations owed to customers.
• Detect and defend against abuse, spam and security incidents affecting our infrastructure.

3. Lawful bases (GDPR)

• Performance of a contract — to deliver the services you or your employer have signed up for.
• Legitimate interests — to serve and secure the website, count page views and measure how quickly pages load (Cloudflare Web Analytics), block spam on our forms, and respond to the enquiries you send us.
• Consent — for Microsoft Clarity session recordings and heatmaps, the Intercom chat, and any marketing cookie (Article 6(1)(a)). We ask every visitor, wherever they are, and none of these loads until you accept. You can withdraw consent at any time in Cookies and tracking.
• Legal obligation — to meet tax, audit, and regulatory requirements.

4. Retention

• Session recordings and heatmaps: Microsoft states that Clarity keeps recordings for up to 30 days.
• Page-load measurements: Cloudflare states that Web Analytics keeps each record for 7 days, then keeps a sample of about one record in ten, and that its reports cover the previous six months.
• Contact form messages: retained until deletion is requested or the contact relationship lapses, whichever comes first.
• Your consent choice: twelve months, in the cookie described in Cookies and tracking.
• Platform data — your workspace, your pentest results, and audit records: retention is set out in the platform privacy policy and the Data Processing Addendum, which state the windows that actually apply to the deployed system rather than a window negotiated per order form.

5. Service providers and subprocessors

These are every third party this website shares personal data with, what each one receives, and where it processes it. Each is bound by a contract that limits its use of the data to providing its service to us.

This website does not use Google Analytics, Google Tag Manager, PostHog, advertising pixels (Meta, LinkedIn or X) or third-party error monitoring, and it opens no connection to them. Fonts are served from our own domain.

The list above describes this website. For the platform, the sub-processor list names every third party individually, with its location and the data it receives. It is versioned separately from the policies so that a vendor change can be notified without amending them. The Data Processing Addendum governs that processing and sets the notice period before a sub-processor is added or replaced, along with the customer’s right to object.

6. Cookies and tracking

Microsoft Clarity and Intercom load only after you choose. Until you choose, they are not loaded and no request is sent to them. The choices are:

• Essential, always on: navigation, form submission, and the cookie that remembers your choice.
• Analytics: Microsoft Clarity session recordings and heatmaps. With it on, Clarity sets its own cookies (such as _clck and _clsk).
• Chat: the Intercom Messenger behind the Ask Fin bar. With it on, Intercom sets its own cookies (such as intercom-id and intercom-session). With it off, the bar opens our contact form instead.
• Marketing: nothing today. Pentrova does not use advertising cookies; this choice covers any marketing cookie we might add.

Cloudflare Web Analytics is not one of these choices. Our host, Cloudflare, adds it to every page for every visitor, whatever you choose, to count page views and measure how quickly pages load. It sets no cookies and writes nothing to your browser’s storage; what it receives is listed in Service providers and subprocessors.

Your choice is stored in a single first-party cookie (pntr_consent_v3) for twelve months. Clearing site data removes it, and we ask again. You can change any non-essential choice below at any time, and it takes effect straight away: turning Analytics off tells Clarity to delete its cookies and stop recording, and turning Chat off ends the Intercom session. Your browser also keeps your colour theme in local storage, and a question typed into the Ask Fin bar while chat is off is held in session storage only to prefill the contact form.

7. Your rights under GDPR

• Right of access — request a copy of your personal data.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure — request deletion of your personal data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests, including direct marketing.
• Right to restrict processing — limit processing while your request is assessed.

To exercise any of these rights, email support@pentrova.ai. You can also lodge a complaint with your supervisory authority.

8. Your rights under CCPA

• Right to know. Request the categories and specific pieces of personal information we have collected about you in the preceding twelve months.
• Right to delete. Request deletion of personal information, subject to statutory exceptions.
• Right to correct. Request correction of inaccurate personal information.
• Right to opt out of sale. Pentrova does not sell personal information, and has not sold personal information in the preceding twelve months. This right therefore exists as a statutory safeguard but has no practical impact on our processing.
• Right to non-discrimination. We will not treat you differently for exercising any of the rights above.

9. US state privacy rights

Pentrova recognises the rights granted by an emerging set of US state privacy laws. Where you reside in one of these states, the rights below apply in addition to any other rights described in this policy. To exercise any right listed here, email support@pentrova.ai with the subject line "US state privacy rights". We will verify your request (which may require additional information) and respond within the statutory window.

California (CCPA / CPRA)

California residents have the rights to know, delete, correct, access, opt out of sale or sharing, limit the use of sensitive personal information, and non-discrimination. CPRA also establishes a right to data portability and extends the right to know to data older than twelve months. Submit requests through the email above.

Colorado (CPA)

Colorado residents have the rights to access, correct, delete, and opt out of (a) targeted advertising, (b) sales, and (c) profiling with legal or similarly significant effects. To opt out, email the address above or use the toggles in the Cookies and tracking section.

Virginia (VCDPA)

Virginia residents have the rights to access, correct, delete, port, and opt out of targeted advertising, sales, and profiling used for decisions producing legal or similarly significant effects. Pentrova does not engage in such automated profiling; the right is preserved as a statutory safeguard.

Connecticut (CTDPA)

Connecticut residents have the rights to access, correct, delete, port, and opt out of sales, targeted advertising, and profiling used for significant decisions. To exercise these rights, email the address above; we honour Global Privacy Control signals on the marketing site as that mechanism is added to our consent stack.

Utah (UCPA)

Utah residents have the rights to access, delete, port, and opt out of targeted advertising and sales. UCPA does not create a correction right; Pentrova still offers correction on request to every US resident as a matter of policy.

How to opt out

• Email support@pentrova.ai with the subject "Opt out" and the state you reside in.
• Use the cookie toggles in the Cookies and tracking section to disable analytics and marketing categories.
• Submit the request through an authorized agent; we require written authorization and identity verification.

10. Your rights under the India DPDPA

Pentrova is incorporated in India and acts as a Data Fiduciary for personal data of Indian residents under the Digital Personal Data Protection Act 2023 (DPDPA). Indian residents have the following rights:

• Right to access information about personal data. Confirm whether Pentrova processes your personal data and request a summary of processing activities.
• Right to correction and erasure. Request correction of inaccurate data or erasure of personal data no longer necessary for the purpose collected.
• Right to grievance redressal. Raise a grievance about Pentrova’s processing of your personal data with our named Grievance Officer. We acknowledge within 48 hours and aim to resolve within one month.
• Right to nominate. Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.

To exercise any of these rights, email support@pentrova.ai with the subject "DPDPA request". You may also lodge a complaint with the Data Protection Board of India once constituted.

11. Privacy contact and Grievance Officer

For any privacy question or request — access, correction, deletion, export, or objection — write to support@pentrova.ai. We respond within thirty days, after we have verified who you are.

If a complaint is not resolved there, or you want it escalated directly, our Grievance Officer is Anusha Dirisala, grievance@pentrova.ai. Post can be addressed to the registered office in the footer, marked for the attention of the Grievance Officer. We acknowledge a complaint within 48 hours and aim to resolve it within one month.

We have not appointed a Data Protection Officer under GDPR Article 37, and we would rather say so than imply a role we do not staff. The Grievance Officer above is the named escalation point for both this website and the platform.