Privacy Policy

1. Who We Are

Zanshic Security ("Zanshic", "we", "us") provides offensive security testing services. Our website is zanshic.com. For privacy inquiries, contact us at contact@zanshic.com.

2. Information We Collect

We collect only what is necessary to deliver our service:

• Account information: company name, corporate email address, and the domain(s) you authorize us to test.
• Billing information: payment is processed by Paddle (our merchant of record). Zanshic never sees or stores your card details.
• Usage data: pages visited, browser type, and IP address, collected through standard server logs. We do not use third-party analytics trackers.
• Testing artifacts: HTTP requests, responses, and screenshots captured during authorized security testing engagements. These relate to your systems, not your personal data.

3. How We Use Your Information

We use your information exclusively to:

• Deliver and improve the security testing service you subscribed to.
• Send you engagement reports, weekly summaries, and service notifications.
• Process billing and subscription management through Paddle.
• Comply with applicable legal obligations.

We do not sell, rent, or share your personal information with third parties for marketing purposes.

4. Data Retention

Account information is retained for the duration of your subscription and for 90 days after cancellation, after which it is deleted. Testing evidence (screenshots, HTTP artifacts) collected during an engagement is retained for 30 days after the final report is delivered, then permanently deleted. Billing records are retained as required by Moroccan accounting law (5 years).

5. Cookies

Zanshic's website uses only session cookies necessary for authentication (Supabase Auth). We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies. You can disable cookies in your browser settings; however, the client dashboard will not function without session cookies.

6. Third-Party Services

We use the following sub-processors:

• Supabase — authentication and database (EU region). Supabase Privacy Policy.
• Paddle — payment processing and subscription management (merchant of record). Paddle Privacy Policy.

Each sub-processor is bound by data processing agreements and handles your data only as necessary to provide their service.

7. Your Rights

You have the right to access, correct, or request deletion of your personal data at any time. To exercise these rights, email contact@zanshic.com. We will respond within 30 days. If you believe your privacy rights have been violated, you may lodge a complaint with the relevant data protection authority in your jurisdiction.

8. Security

We apply appropriate technical and organizational measures to protect your information, including encrypted connections (HTTPS), access controls, and limited data retention. As a security company, protecting client data is core to our business — not an afterthought.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to active clients by email before taking effect. The "Last updated" date at the top of this page reflects the most recent revision.

10. Contact

For any privacy-related questions: contact@zanshic.com