How we collect, use, and protect your personal data.
Last updated: 2026-04-18
Black Cat Security, a Individual registered at RCS Paris 123 456 789, with its registered office at 123 Rue Example, 75001 Paris, France, is the data controller for the processing of personal data described in this Privacy Policy. Black Cat Security is established in the European Union.
For any questions regarding data protection, you may contact our Data Protection Officer at privacy@blackcatsecurity.fr.
We collect and process the following categories of personal data in connection with the provision of our services:
We process your personal data for the following purposes, each associated with a specific legal basis under the GDPR:
| Purpose | Data Categories | Legal Basis |
|---|---|---|
| Account management | Account data | Performance of contract (Art. 6(1)(b)) |
| Service delivery | Account data, Usage data, Technical data | Performance of contract (Art. 6(1)(b)) |
| Security monitoring | Technical data, Usage data | Legitimate interest (Art. 6(1)(f)) |
| Customer support | Account data, Usage data | Performance of contract (Art. 6(1)(b)) |
| Analytics and improvement | Usage data, Technical data | Legitimate interest (Art. 6(1)(f)) |
| Marketing communications (B2C) | Account data | Consent (Art. 6(1)(a)) |
| B2B commercial prospection by email to a professional address relating to the recipient's professional function | Account data | Legitimate interest (Art. 6(1)(f)), per CNIL guidance on B2B prospection |
| Billing and invoicing | Account data, Payment data | Performance of contract via Paddle (Art. 6(1)(b)) |
Where we rely on legitimate interest, we have conducted a balancing test to ensure that our interests do not override your fundamental rights and freedoms.
We share personal data with a limited number of trusted third-party service providers who assist us in operating our platform. Each sub-processor is bound by contractual obligations to protect your data and to process it only in accordance with our instructions.
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | CDN, hosting, edge compute, DDoS protection | USA (DPF) + EU edge |
| Paddle.com Market Ltd | Merchant of Record — billing, payments, VAT | United Kingdom (adequacy) |
| Functional Software, Inc. (Sentry) | Error monitoring | USA (DPF) |
| Ory Corp | Identity & authentication (Kratos) | Germany (EEA) |
The complete and current list, including dates added, is published at /sub-processors.
Paddle acts as our Merchant of Record and independently controls payment data for billing and tax compliance purposes. We do not sell your personal data to third parties.
Where transfer mechanisms above reference adequacy decisions or the EU-US Data Privacy Framework, the Standard Contractual Clauses (Module 2 of Commission Implementing Decision (EU) 2021/914) apply as a fallback should those mechanisms cease to be in force.
When your personal data is transferred outside the European Economic Area (EEA), we ensure that adequate safeguards are in place. These include transfers to countries benefiting from an adequacy decision by the European Commission, or the use of Standard Contractual Clauses (SCCs) approved by the European Commission under Article 46(2)(c) of the GDPR.
You may request a copy of the applicable safeguards by contacting us at privacy@blackcatsecurity.fr.
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:
At the end of the applicable retention period, your data is securely deleted or anonymized.
Under the GDPR and applicable French data protection legislation, you have the following rights with respect to your personal data:
If you believe that your rights have not been respected, you have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés, www.cnil.fr) or with the supervisory authority of the Member State of your habitual residence, place of work, or place of the alleged infringement, in accordance with Article 77 of the GDPR.
You may exercise any of the rights described above by contacting our Data Protection Officer at privacy@blackcatsecurity.fr, or by submitting a request via our online form at /dsr. Please include sufficient information to identify yourself and specify the right(s) you wish to exercise.
We will respond to your request within 30 days of receipt. In exceptional circumstances, this period may be extended by a further two months, in which case we will inform you within the initial 30-day period.
Our service performs automated security risk scoring of SaaS configurations using deterministic policy evaluation (Open Policy Agent / Rego rules). This is not an artificial intelligence system within the meaning of Regulation (EU) 2024/1689 (the EU AI Act), as no machine-learning model is used to infer outputs from data inputs. The scoring prioritises remediation recommendations and does not produce legal effects or similarly significant effects on individuals. If we introduce AI-based features in the future, this section will be updated and the transparency obligations of Article 50 of the AI Act (applicable from 2 August 2026) will be observed.
Our services are not directed at individuals under the age of 15 (the digital age of consent applicable in France under Article 45 of the French Data Protection Act, derogating from Article 8(1) of the GDPR). We do not knowingly collect personal data from children under 15. If we become aware that we have inadvertently collected personal data from a child under 15, we will take steps to delete that data as soon as reasonably possible. If you believe that a child under 15 has provided us with personal data, please contact us at privacy@blackcatsecurity.fr.
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or regulatory guidance. Material changes will be notified to you by email at least 30 days in advance of taking effect. We encourage you to review this page periodically for the latest information on our privacy practices.