Privacy Policy
1. Scope
This Privacy Policy explains how information is handled when you visit or use the DastPilot API security service. In this policy, “DastPilot”, “we”, “us” and “our” refer to the operator of the Service.
This policy applies to the DastPilot website, account features, API security scanning service and communications sent to DastPilot.
2. Information We Handle
Depending on how you use the Service, DastPilot may handle:
- Account information: your name, email address and an organization name if you choose to provide one.
- Scan inputs and configuration: OpenAPI or Swagger documents, target URLs, authentication configuration and credentials, role mappings and scan configuration.
- Scan activity and results: HTTP requests and responses generated or captured during a scan, vulnerability findings, supporting evidence and remediation information.
- Technical information: IP address, browser and device information, server logs, diagnostic events and information about how the website and Service are used.
- Communications: messages and contact details you submit through the contact form or by email.
- Billing information: limited customer, subscription, invoice and transaction identifiers received from Dodo Payments. Dodo Payments processes purchase, billing and transaction information as the Merchant of Record under its own privacy terms. DastPilot does not receive complete payment-card details.
- Analytics information: website visit and interaction data where analytics is enabled.
3. How We Use Information
DastPilot uses information to create and maintain accounts; import API definitions; configure and run requested scans; generate findings and remediation guidance; provide account, subscription and support functions; secure, troubleshoot and improve the Service; communicate about service operation or a request; understand website use; prevent abuse and fraud; resolve disputes; and meet applicable legal obligations.
DastPilot may send product or marketing messages where permitted. You may withdraw consent to those messages at any time by using the unsubscribe method provided or contacting DastPilot.
4. Scan Data and Customer Responsibilities
API specifications, target details, authentication credentials, generated requests, captured responses and scan findings may contain confidential, personal or otherwise sensitive information. Only submit information you are authorized to provide and test.
Use dedicated test credentials with only the permissions needed for the scan and use non-production systems and test data where practical. Review specifications and responses for unnecessary secrets or personal information before submitting them.
5. Service Providers and Disclosures
DastPilot shares information with service providers only as reasonably needed for them to provide their services, and may disclose information when required by applicable law, to respond to lawful requests, to protect the Service and its users, or with your direction or consent.
- Google Analytics helps measure visits to and interactions with the public website. Google may receive browser, device, IP-derived, referral, page-view and interaction information. See Google’s Privacy Policy.
- Google Fonts supplies website fonts. A visitor’s browser may connect to Google and disclose ordinary network-request information. See Google’s Privacy Policy.
- Cloudflare helps deliver and protect the public website and may process network and security-log information. See Cloudflare’s Privacy Policy.
- Web3Forms processes submissions from the website contact form. See Web3Forms’ Privacy Policy.
- Dodo Payments provides checkout, subscription, invoicing and related billing services as the Merchant of Record. See Dodo Payments’ Privacy Policy.
7. Retention and Deletion
Information is retained only for as long as reasonably required to operate the Service, provide requested functionality, maintain security, resolve disputes and meet applicable legal obligations. Users may request account-data deletion by contacting DastPilot. Some limited records may be retained where reasonably necessary for security, fraud prevention, billing disputes or legal compliance.
8. Your Choices and Rights
You may ask to access, correct or delete account information, withdraw consent to marketing messages, raise a privacy question or make a complaint. The rights available to you can depend on applicable law. Send requests to [email protected]. DastPilot may request information needed to verify the request and protect the account.
9. Security
No internet service can guarantee absolute security. Protect your account credentials, limit the secrets and personal information included in scan inputs, use least-privilege test credentials and notify DastPilot if you suspect unauthorized account access.
10. Changes to This Policy
DastPilot may update this policy as the Service or its information practices change. The updated version will be posted on this page. Where appropriate, DastPilot may also provide notice through the Service or by email.
11. Contact
For privacy questions, requests or complaints, contact [email protected]. Avoid including passwords, authentication tokens or other sensitive credentials in email.