Privacy Policy

1. Who we are

This Privacy Policy explains how Wardizon Technologies & Services Ltda, CNPJ 54.808.567/0001-18, São Paulo, SP, Brazil ("Wardizon", "we", "us") processes personal data. It covers (a) visitors to wardizon.com and people who fill in its forms, (b) users of the Wardizon platform at app.wardizon.com, who work for the managed service providers (MSPs) that subscribe to it, and (c) representatives of the MSPs' clients who review and sign Rules of Engagement (RoE), the online authorization every test requires.

It explains your rights under the Brazilian General Data Protection Law (LGPD, Lei nº 13.709/2018) and, where it applies, the EU General Data Protection Regulation (GDPR).

2. Data we collect

What we process depends on how you interact with us:

• Website visitors: page views, counted without cookies by Vercel Web Analytics, and the campaign that first brought you to the site (such as UTM parameters), kept in your browser's local storage. The website host also receives your IP address and browser information when it serves a page.
• Website forms: name, work email, company, role, phone, country, the plan or reason you contacted us, how many clients you manage, your other answers to the form, the campaign that brought you and your browser information.
• Platform users (MSP staff): name, email, role and company; billing data such as the company's tax ID (payments are processed by Stripe); and technical and security records such as IP address, browser information and actions taken in the console.
• RoE signers: name, title and email, the date and time of signature, IP address and browser information, and the scope that was approved.
• Engagement data: the targets in scope, credentials the MSP's client supplies for authenticated testing (stored encrypted), and the findings and evidence each test produces. Tested systems may hold personal data, which can end up in the evidence of a finding.

3. How we use data, and the legal basis

• To provide the platform and perform our contract with the MSP, including AI-assisted analysis of findings (performance of a contract).
• To record each client authorization and keep audit records of every test (regular exercise of rights and legitimate interest).
• To keep the platform secure and prevent fraud and abuse (legitimate interest).
• To answer website forms, set up trial accounts and follow up on sales conversations (preliminary steps to a contract, at your request, and legitimate interest).
• To send marketing email (consent, where we ask for it; you can withdraw it at any time by unsubscribing).
• To keep tax and billing records (legal obligation).

4. Cookies and browser storage

The website does not use advertising cookies. It uses Vercel Web Analytics, which counts page views without cookies, and stores the campaign that first brought you to the site in your browser's local storage so it can be attached to a form you submit. You can clear it in your browser settings. The platform uses a strictly necessary cookie to keep you signed in.

5. Who processes data for us

These providers process personal data on our behalf:

• Hostinger (Brazil): hosting of the platform.
• Acronis (Brazil): platform backups, taken on business days.
• Anthropic, maker of Claude (United States): AI-assisted analysis of findings. It receives finding details such as the target, evidence excerpts and the client's name.
• Cloudflare (global network): DNS and proxy in front of the platform.
• Microsoft 365: email, including account and RoE signing emails.
• Stripe: payment processing.
• Splunk (United States): infrastructure and application monitoring.
• Vercel (United States): hosting and analytics for wardizon.com.
• Supabase (Brazil): storage of website form submissions.
• HubSpot (United States): customer relationship management (CRM).
• Customer.io (United States): email platform for messages to website contacts.

We may also disclose personal data to public authorities when the law requires it.

6. International transfers

The platform stores its data in Brazil. Some of the providers above process data outside Brazil: Anthropic, Splunk, Vercel, HubSpot and Customer.io in the United States, and Cloudflare on its global network; Microsoft 365 and Stripe may also process data outside Brazil. Using the website, the platform or the RoE signing page therefore involves an international transfer of personal data. To ask about the safeguards that apply to a given transfer, write to contato@wardizon.com.

7. Retention and deletion

We keep personal data while it is needed for the purposes above. You can ask us to delete your data at any time by writing to contato@wardizon.com, and we will delete it unless we must keep it to meet a legal obligation or to exercise our rights, as with signed authorizations, audit records and billing records. When you unsubscribe from marketing email we stop sending it, and you can also ask us to delete your contact record.

8. Security

Traffic to the platform uses HTTPS. The database keeps each tenant's data apart with row-level security. Credentials supplied for authenticated testing are stored encrypted, under a key kept outside the database. Backups are taken on business days and stored in Brazil. No test runs until the client has signed an RoE.

9. Your rights

Under article 18 of the LGPD you have the right to:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the LGPD;
• portability of your data to another provider;
• deletion of data processed with your consent;
• information about the public and private entities we share your data with;
• information about the possibility of not giving consent, and what follows from it;
• withdrawal of consent.

You can also object to processing, and ask for a review of decisions taken solely on the basis of automated processing. If the GDPR applies to you, you have the equivalent rights of access, rectification, erasure, restriction, portability and objection.

To exercise any of them, write to contato@wardizon.com. We respond within 15 days under the LGPD and within one month under the GDPR. You can also petition the Brazilian National Data Protection Authority (ANPD) or, in the EU, your data protection supervisory authority.

When we process data on behalf of an MSP, such as data about the MSP's clients and their systems, the MSP is responsible for it as controller, and we may refer your request to it.

10. Changes

We post material changes to this policy at wardizon.com/privacy and notify account owners by email at least 30 days in advance.

11. Contact

Controller: Wardizon Technologies & Services Ltda, CNPJ 54.808.567/0001-18, São Paulo, SP, Brazil · Data protection officer (encarregado): contato@wardizon.com