Privacy Policy

The data controller for personal data processed through this service is:

Oksa Security
Helsinki, Finland
Email: oksasecurity@gmail.com

We collect the following categories of personal data:

• Account data: email address, password (stored as a one-way hash).
• Scan configuration: domain names you register for monitoring.
• Scan results: technical findings from publicly visible sources related to your registered domains.
• Usage data: login timestamps, feature usage, session activity.
• Payment data: payments are processed by Paytrail Oyj. We receive only a payment confirmation reference; we do not store card numbers or bank credentials.
• Technical data: IP address, browser type, and device information collected for security and fraud prevention.

• Contract performance (GDPR Art. 6(1)(b)): processing your account data and scan results to deliver the service you have subscribed to.
• Legitimate interests (GDPR Art. 6(1)(f)): security monitoring, fraud prevention, service improvement.
• Legal obligation (GDPR Art. 6(1)(c)): retaining transaction records as required by Finnish accounting law.
• Consent (GDPR Art. 6(1)(a)): analytics cookies placed only after your explicit consent.

• Delivering and operating the attack surface monitoring service.
• Sending alerts about new findings related to your registered domains.
• Generating PDF and CSV reports on your request.
• Processing subscription payments and sending invoices.
• Responding to support enquiries.
• Improving the service through aggregated, anonymised analytics.

• Account and scan data: retained for the duration of your subscription, and deleted within 30 days of account closure.
• Payment records: retained for 6 years as required by Finnish accounting legislation.
• Server logs: retained for 90 days for security purposes.

We do not sell personal data. We share data only with the following categories of recipients:

• Infrastructure provider: Hetzner Online GmbH, Germany — EU-based servers. Covered by the EU Cloud Code of Conduct.
• Payment processor: Paytrail Oyj, Finland — processes payment transactions.
• Email delivery: used only to send service notifications; no marketing profiling.

All data is stored and processed within the European Union. No transfers to third countries take place.

You have the following rights regarding your personal data:

• Right of access (Art. 15): request a copy of the data we hold about you.
• Right to rectification (Art. 16): request correction of inaccurate data.
• Right to erasure (Art. 17): request deletion of your data, subject to legal retention obligations.
• Right to portability (Art. 20): receive your data in a machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests.
• Right to restriction (Art. 18): request restriction of processing in certain circumstances.

To exercise any right, contact us at oksasecurity@gmail.com. We will respond within 30 days.

We use cookies as described in our Cookie Policy. Analytics cookies are placed only after your explicit consent via the cookie banner.

We implement appropriate technical and organisational measures to protect your data, including TLS encryption in transit, password hashing, and role-based access controls. Access to production systems is restricted to authorised personnel.

If you believe your data rights have not been respected, you may lodge a complaint with the Finnish Data Protection Ombudsman:

Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
PO Box 800, FI-00531 Helsinki · tietosuoja.fi

We may update this policy to reflect changes in the service or applicable law. Material changes will be notified by email to registered users. The date at the top of this page shows when the policy was last revised.