Privacy Policy

This Privacy Policy explains what information Torlyx ("Torlyx", "we", "us") collects, why we collect it, and how we handle it when you use our website and services. By using Torlyx, you agree to the practices described here.

We keep this simple on purpose: we collect what we need to run the service, and nothing we do not. We do not sell your personal information.

Torlyx is a website-security platform that scans, monitors, fixes and helps protect websites. For any privacy question, or to exercise your rights, you can reach us at hello@torlyx.com. For security-vulnerability reports, use security@torlyx.com.

For personal data of users in the EEA, the UK and similar regions, Torlyx acts as the data controller for account data, and as a processor for the site data you ask us to scan and monitor on your behalf.

We collect information in the following categories:

• Account details you provide — such as name, email, password (stored only as a secure hash) and workspace settings.
• Billing information — handled by our payment processor; we store only limited records such as plan, invoices and the last four digits of a card, not full card numbers.
• The site URLs, repositories and other sources you ask us to scan, monitor or connect.
• Scan results, findings, reports and monitoring data generated for the sites you own or are authorized to test.
• Content you send us — messages, fix requests and file attachments.
• Usage, log and device data (such as IP address, browser type and actions in the product) needed to operate, secure and improve the service.
• Cookies and similar technologies — see the Cookies section below and our Cookie Policy.

We use the information we collect to:

• Provide the service — run scans, deliver reports, monitor your sites and apply or coordinate fixes.
• Operate your account, process payments and provide customer support.
• Secure the platform, prevent abuse and enforce our terms.
• Communicate with you about the service, including important notices.
• Improve and develop features, using aggregated or de-identified data where possible.

We do not sell your personal information, and we do not use your scan data to train models that we sell or license to third parties.

Where the law requires a legal basis (for example under the GDPR), we rely on: performance of our contract with you; our legitimate interests in operating and securing the service; your consent (which you can withdraw); and compliance with legal obligations.

You may only scan, test or connect sites, endpoints, repositories and hosts that you own or are explicitly authorized to test. You are responsible for having the right to grant Torlyx access to any source you connect.

Active testing (DAST) runs only against targets whose ownership you have verified with us. You are solely responsible for any target you submit.

We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the product is used so we can improve it. You can control non-essential cookies through your browser and, where offered, our cookie controls.

For details, see our Cookie Policy at /cookies.

We share information only in these limited cases:

• Service providers (sub-processors) who help us run Torlyx — such as cloud hosting, payment processing and email delivery — bound by contract to protect your data and use it only to provide their service to us.
• When you connect a third-party service (for example your Cloudflare account or a GitHub repository), with that provider, as needed to deliver the feature you enabled.
• If required by law, regulation or valid legal process, or to protect the rights, safety and security of our users, the public or Torlyx.
• In connection with a merger, acquisition or sale of assets, in which case we will continue to protect your information and notify you of any change in control.

We never sell your personal information and never share it for cross-context behavioral advertising.

Torlyx and our service providers may process data in countries other than yours. Where we transfer personal data internationally, we use appropriate safeguards (such as standard contractual clauses) to protect it in line with applicable law.

We retain your data for as long as your account is active, and for a limited period afterward as needed for legal, billing, security and operational purposes. When data is no longer needed, we delete or anonymize it.

You can request deletion of your account data at any time, subject to records we are required to keep by law.

We encrypt data in transit and at rest, follow least-privilege access, store connected tokens encrypted, and isolate scanning workloads. No system is perfectly secure, but we take the strict path by default — as a security company should. See our Security page for more.

Depending on where you live, you may have the right to access, correct, export, delete, restrict or object to the processing of your personal information, and to withdraw consent. If you are in California, you have the right to know, delete and correct your information, and to opt out of sale or sharing — which we do not do — without discrimination.

To exercise any of these rights, contact us at hello@torlyx.com. We will verify your request and respond within the timeframe required by law. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

Torlyx is not intended for children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

We may update this policy from time to time. If we make material changes, we will update the date below and, where appropriate, notify you. Continued use of Torlyx after changes take effect means you accept the updated policy.

Questions about this policy or your data can be sent to hello@torlyx.com. We are happy to help.