1. Introduction
Welcome to Exfol ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our data exfiltration testing platform.
Effective Date: This Privacy Policy is effective as of September 02, 2025 and will remain in effect except with respect to any changes in its provisions in the future.
2. Information We Collect
2.1 Personal Information
We may collect the following types of personal information:
- Account Information: Name, email address, organization details, and login credentials
- Profile Information: Job title, department, and contact preferences
- Usage Data: Information about how you use our platform, including scan configurations and results
- Technical Data: IP addresses, browser type, device information, and usage analytics
2.2 Scan and Test Data
As a data exfiltration testing platform, we collect:
- Scan Configurations: Test parameters, target systems, and exfiltration techniques
- Test Results: Success/failure data, performance metrics, and security findings
- System Information: Hostnames, IP addresses, and system configurations of tested environments
- Evidence Data: Screenshots, logs, and other evidence collected during testing
3. How We Use Your Information
We use the collected information for the following purposes:
- Service Provision: To provide and maintain our data exfiltration testing services
- Account Management: To create and manage your account, process payments, and provide customer support
- Platform Improvement: To analyze usage patterns and improve our platform's functionality and security
- Communication: To send important updates, security notifications, and service announcements
- Compliance: To comply with legal obligations and enforce our terms of service
- Research and Development: To develop new features and enhance security testing capabilities
4. Data Security
We implement comprehensive security measures to protect your information:
- Encryption: All data is encrypted in transit and at rest using industry-standard protocols
- Access Controls: Strict access controls and authentication mechanisms
- Regular Audits: Regular security assessments and penetration testing
- Data Minimization: We only collect and retain data necessary for service provision
- Secure Infrastructure: Cloud infrastructure with enterprise-grade security
Important: While we implement robust security measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your information.
5. Data Sharing and Disclosure
We do not sell, trade, or rent your personal information to third parties. We may share your information in the following circumstances:
- Service Providers: With trusted third-party service providers who assist in operating our platform
- Legal Requirements: When required by law, court order, or government request
- Business Transfers: In connection with a merger, acquisition, or sale of assets
- Consent: With your explicit consent for specific purposes
6. Data Retention
We retain your information for as long as necessary to:
- Provide our services and maintain your account
- Comply with legal obligations
- Resolve disputes and enforce agreements
- Improve our services and develop new features
You may request deletion of your account and associated data at any time through your account settings or by contacting us.
7. Your Rights and Choices
You have the following rights regarding your personal information:
- Access: Request access to your personal information
- Correction: Request correction of inaccurate or incomplete information
- Deletion: Request deletion of your personal information
- Portability: Request a copy of your data in a portable format
- Objection: Object to certain processing of your information
- Withdrawal: Withdraw consent for data processing where applicable
8. Cookies and Tracking Technologies
We use cookies and similar tracking technologies to:
- Remember your preferences and settings
- Analyze platform usage and performance
- Provide personalized content and features
- Ensure platform security and prevent fraud
You can control cookie settings through your browser preferences, though disabling certain cookies may affect platform functionality.
9. International Data Transfers
Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your information in accordance with this Privacy Policy and applicable data protection laws.
10. Children's Privacy
Our platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you believe we have collected information from a child under 18, please contact us immediately.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by:
- Posting the updated policy on our platform
- Sending email notifications to registered users
- Displaying prominent notices on our website
Your continued use of our platform after any changes constitutes acceptance of the updated Privacy Policy.