Privacy Notice

1. Beta privacy contact

General privacy enquiries for the Pentest Navigator beta: info@pentest-navigator.com

Complete controller and address-for-service information must be added to the legal notice before public production operation.

2. Data processed

• account, email, role, workspace and permission data;
• session, security and audit data, including timestamps, events and, where applicable, IP or network data;
• project, graph, note, report, evidence and file content submitted by users;
• identity and mapping data required for configured OIDC, SAML or LDAP identity services; and
• technically necessary diagnostic and error data.

3. Purposes and legal bases

Data is processed for account and contract administration, delivery of the application, workspace collaboration, information security, abuse prevention, troubleshooting and compliance with legal obligations. Depending on the circumstances, the legal bases are Article 6(1)(b), (c) and (f) GDPR. Consent is used only where expressly requested and may be withdrawn with future effect.

4. Not approved for sensitive live data

The public beta is not approved for special categories of personal data, criminal-offence data, personnel records, health data, data about minors or production customer datasets. Anyone submitting personal data on behalf of an organisation must first clarify responsibilities and the applicable legal basis. Where processing on behalf of a controller occurs, a separate data-processing agreement is required; accepting the Beta Terms does not replace that agreement.

5. Recipients and services

Data may be disclosed as necessary to hosting, email and identity service providers. Cloudflare Turnstile may optionally be used to prevent abuse. The actual providers, storage locations and data-processing agreements must be identified in the production version before public operation. Transfers to third countries occur only on a lawful basis and with required safeguards.

6. Retention

Data is retained only for as long as required for the stated purposes, service security or statutory retention duties. Project content is generally retained until deleted by an authorised user, account deletion or the end of the beta. Personal notes may remain available across project changes; assigning a note to a project does not by itself make a private note visible to project members. Security, audit, product-event and change-history records are removed according to separate workspace-configured retention periods. Deleted node recovery bundles, including retained evidence, expire with the configured history period.

A self-service workspace departure erases the departing user's private workspace content after confirmation. An administrator-initiated offboarding first revokes access and sessions and keeps that private content for a 30-day reactivation period before the retention job performs the final erasure. Shared project records remain with the project where required to preserve authorised collaboration. Tenant deletion is a controlled operator process tied to a verified backup; referenced evidence files are placed in a retryable deletion queue so that storage failures remain traceable.

Statutory duties, incident preservation or an agreed customer retention schedule may require a different period. The actual workspace settings and any contractually agreed periods must be documented by the operator before customer data is processed.

7. Browser storage and sessions

Technically necessary cookies or comparable browser storage may be used for authentication, session management, security and local interface preferences. Advertising profiling is not part of the beta.

8. Security

Appropriate technical and organisational measures are used to protect data. A beta may nevertheless contain security and functional defects. You must therefore not submit secrets or sensitive production data. This restriction does not replace the provider's security obligations.

9. Your rights

Subject to the statutory requirements, data subjects have rights of access, rectification, erasure, restriction, data portability and objection. Consent may be withdrawn with future effect. Requests may be sent to info@pentest-navigator.com. You also have the right to lodge a complaint with a data protection supervisory authority.

10. Automated decisions and updates

No decisions producing legal or similarly significant effects are made solely by automated means. This notice will be updated when features, providers or applicable law change. The current version and effective date will be published here.