Privacy Policy

For account administration, billing, support and the security of our service, the data controller is:

Simal Oy · Business ID 3645303-6
Oksa Security is a service of Simal Oy.
Yhteiskouluntie 33, 31700 Urjala as, Finland
support@oksasecurity.com

When we process personal data in monitoring results on a customer organisation's documented instructions, that organisation is the controller and Simal Oy acts as processor. That processing requires a separate data processing agreement; this privacy notice does not replace it.

We collect the following categories of personal data:

• Account data: email address, password (stored as a one-way hash).
• Scan configuration: domain names you register for monitoring.
• Scan results: technical findings from publicly visible sources related to your registered domains.
• Usage data: login timestamps, feature usage, session activity.
• Payment data: payments are processed by Paytrail Oyj. We store transaction references, payment and subscription history, recurring-payment consent records, billing details and a payment token for automatic renewals. We may also store the card brand and last four digits. We do not store full card numbers, card security codes or bank credentials.
• Technical data: IP address, browser type, and device information collected for security and fraud prevention.

Account and billing information is needed to create and administer a paid account; without the required information we cannot provide that service. Domain details and authorisation are needed to begin monitoring. Do not include passwords, full card numbers or unnecessary personal data in support messages.

• Contract performance (GDPR Art. 6(1)(b)): providing the service where the individual is a party to the contract. Business contact and account administration also rely on our legitimate interest in providing the service to the customer organisation.
• Legitimate interests (GDPR Art. 6(1)(f)): security monitoring, fraud prevention, service improvement.
• Legal obligation (GDPR Art. 6(1)(c)): retaining transaction records as required by Finnish accounting law.

• Delivering and operating the attack surface monitoring service.
• Sending alerts about new findings related to your registered domains.
• Generating PDF and CSV reports on your request.
• Processing subscription payments and sending invoices.
• Responding to support enquiries, including messages sent through our public contact form.

• Account and scan data: retained while needed to provide the service and handle account administration, security incidents and disputes. Cancelling automatic renewal does not delete the account. Organization administrators can request closure in Settings → Organization. Access and future renewals stop immediately. Service-data deletion follows once pending payments and running scans are resolved. Required financial records and a closure record are retained; email-provider and support records are reviewed separately. Contact support to track a request.
• Payment and accounting records: retained for the applicable statutory accounting period. Retention depends on the record type and is calculated under the applicable accounting rules, rather than simply from the payment date.
• Email delivery and support: Resend normally retains email and delivery-log data for 30 days. We assess these records as part of an account-closure or erasure request, including whether earlier deletion is required. Support correspondence is reviewed separately: unnecessary messages are deleted, while records needed to handle an ongoing matter or legal obligation are retained for that purpose and reviewed again. We explain applicable retention exceptions in our response.
• Security logs and backups: Security-log retention is assessed for security and incident-investigation needs. Database backups rotate through seven daily and four weekly snapshots after successful backup runs. This rotation is not a fixed 30-day deletion guarantee. Backups are restricted to recovery use; restored data is checked against deletion requests before customer access is restored.

We do not sell personal data. We share data only with the following categories of recipients:

• Infrastructure provider: Hetzner Online GmbH — backend hosting; Vercel — website and frontend hosting.
• Payment processor: Paytrail Oyj, Finland — processes payment transactions.
• Email delivery: Resend, for service notifications. Resend stores message content and delivery data in the United States; selecting a European sending region does not change the storage location. Its data processing agreement includes EU Standard Contractual Clauses for international transfers. Customer support uses Resend for incoming messages and replies. Legacy correspondence may remain in the previous Google/Gmail support mailbox until it has been reviewed for deletion or justified retention. Support messages and provider records are handled separately from application data.

Hosting, support and delivery providers may process data in different locations. Contact us for information on the providers, processing locations and transfer safeguards relevant to your account.

You have the following rights regarding your personal data:

• Right of access (Art. 15): request a copy of the data we hold about you.
• Right to rectification (Art. 16): request correction of inaccurate data.
• Right to erasure (Art. 17): request deletion of your data, subject to legal retention obligations.
• Right to portability (Art. 20): receive your data in a machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests.
• Right to restriction (Art. 18): request restriction of processing in certain circumstances.

To exercise any right, contact us at support@oksasecurity.com. We will respond without undue delay and normally within one month; we will inform you if a permitted extension is needed.

We use cookies as described in our Cookie Policy. The application currently uses essential session and preference cookies; it does not load optional analytics scripts.

We implement appropriate technical and organisational measures to protect your data, including TLS encryption in transit, password hashing, and role-based access controls. Access to production systems is restricted to authorised personnel.

If you believe your data rights have not been respected, you may lodge a complaint with the Finnish Data Protection Ombudsman:

Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
PO Box 800, FI-00531 Helsinki · tietosuoja.fi

We may update this policy to reflect changes in the service or applicable law. Material changes will be notified by email to registered users. The date at the top of this page shows when the policy was last revised.