How we collect, use, and protect your personal data.
Last updated: 2026-03-18
Black Cat Security, a Individual registered at RCS Paris 123 456 789, with its registered office at 123 Rue Example, 75001 Paris, France, is the data controller for the processing of personal data described in this Privacy Policy. Black Cat Security is established in the European Union.
For any questions regarding data protection, you may contact our Data Protection Officer at dpo@blackcatsecurity.fr.
We collect and process the following categories of personal data in connection with the provision of our services:
We process your personal data for the following purposes, each associated with a specific legal basis under the GDPR:
| Purpose | Data Categories | Legal Basis |
|---|---|---|
| Account management | Account data | Performance of contract (Art. 6(1)(b)) |
| Service delivery | Account data, Usage data, Technical data | Performance of contract (Art. 6(1)(b)) |
| Security monitoring | Technical data, Usage data | Legitimate interest (Art. 6(1)(f)) |
| Customer support | Account data, Usage data | Performance of contract (Art. 6(1)(b)) |
| Analytics and improvement | Usage data, Technical data | Legitimate interest (Art. 6(1)(f)) |
| Marketing communications | Account data | Consent (Art. 6(1)(a)) |
| Billing and invoicing | Account data, Payment data | Performance of contract via Paddle (Art. 6(1)(b)) |
Where we rely on legitimate interest, we have conducted a balancing test to ensure that our interests do not override your fundamental rights and freedoms.
We share personal data with a limited number of trusted third-party service providers who assist us in operating our platform. Each sub-processor is bound by contractual obligations to protect your data and to process it only in accordance with our instructions.
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | CDN, hosting, and DDoS protection | USA / EU |
| Paddle.com Market Ltd | Merchant of Record — billing, payments, invoicing, VAT | United Kingdom |
Paddle acts as our Merchant of Record and independently controls payment data for billing and tax compliance purposes. We do not sell your personal data to third parties.
When your personal data is transferred outside the European Economic Area (EEA), we ensure that adequate safeguards are in place. These include transfers to countries benefiting from an adequacy decision by the European Commission, or the use of Standard Contractual Clauses (SCCs) approved by the European Commission under Article 46(2)(c) of the GDPR.
You may request a copy of the applicable safeguards by contacting us at dpo@blackcatsecurity.fr.
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:
At the end of the applicable retention period, your data is securely deleted or anonymized.
Under the GDPR and applicable French data protection legislation, you have the following rights with respect to your personal data:
If you believe that your rights have not been respected, you have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés) at www.cnil.fr.
You may exercise any of the rights described above by contacting our Data Protection Officer at dpo@blackcatsecurity.fr. Please include sufficient information to identify yourself and specify the right(s) you wish to exercise.
We will respond to your request within 30 days of receipt. In exceptional circumstances, this period may be extended by a further two months, in which case we will inform you within the initial 30-day period.
Our service performs automated security risk scoring of SaaS configurations. This scoring prioritizes remediation recommendations but does not produce legal effects or similarly significant effects on individuals. The automated assessments are designed to assist security teams in identifying and addressing potential vulnerabilities in their SaaS environments.
Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have inadvertently collected personal data from a child under 16, we will take steps to delete that data as soon as reasonably possible. If you believe that a child under 16 has provided us with personal data, please contact us at dpo@blackcatsecurity.fr.
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or regulatory guidance. Material changes will be notified to you by email at least 30 days in advance of taking effect. We encourage you to review this page periodically for the latest information on our privacy practices.