R
Research.
Data Privacy

Privacy Policy

At Research., we believe transparency is the foundation of security. This policy outlines exactly what we collect, how we protect it, and your rights over your data.

Last updated: September 6, 2026

1. What We Collect

  • Account data: name, email, password (hashed), organization.
  • Usage data: pages visited, features used, API calls, scan targets.
  • Technical data: IP address, browser, device type, session tokens.
  • Payment data: handled by our PCI-compliant processor; we never store raw card numbers.

2. How We Use It

  • Deliver, maintain, and improve our platform and services.
  • Authenticate users, manage subscriptions, and process payments.
  • Generate anonymized threat intelligence and security research.
  • Detect fraud, abuse, and unauthorized access.

3. Who We Share With

  • Service providers (Cloudflare, AWS, payment processors) — bound by DPAs.
  • Security community: anonymized/aggregated vulnerability data only.
  • Enterprise admins: usage data within their organization scope.
  • We do not sell your personal data — ever.

4. Your Rights

  • Access, correct, or delete your personal data at any time.
  • Export your data in a machine-readable format (portability).
  • Withdraw consent for marketing or optional analytics.
  • Lodge a complaint with your local data protection authority (EEA/UK).

5. Security Measures

  • TLS 1.3 in transit · AES-256 at rest.
  • Zero-trust network with mTLS, RBAC, and least-privilege access.
  • Continuous monitoring via our own eBPF telemetry stack.
  • SOC 2 Type II compliance program.

6. Data Retention

  • Account data retained for account lifetime + 3 years after closure.
  • Logs retained for 90 days; anonymized research data may be kept longer.
  • International transfers (EEA→US) covered by Standard Contractual Clauses.

7. Children & Changes

  • Services not directed to users under 16. We delete such data on discovery.
  • Material policy changes notified by email at least 14 days in advance.
  • Continued use after changes implies acceptance.

8. Contact Us

  • Privacy inquiries: privacy@rsch.io
  • Data Protection Officer · Research. Security, Inc.
  • We respond to all requests within 30 days.