Privacy notice

How VendorPulse handles your data. Written to align with India's Digital Personal Data Protection Act, 2023.

Who we are

VendorPulse ("we", "us") provides cybersecurity assessment services to organisations in India. For questions about your data, contact privacy@vendorpulse.co.in.

What we collect

Account data — your work email, name and company, provided when you register.
Verification data — a one-time token sent to your email, and any DNS records you add to prove control of a domain.
Scan data — the domains you ask us to assess, and the results of passive, non-intrusive checks against publicly available information about those domains.
Technical data — your IP address and basic request logs, kept to protect the service from abuse.

How we use it

To verify that you are authorised to assess a domain before any scan runs.
To generate your assessment reports and keep them available to you.
To maintain an audit log of who scanned what and when, which is a security and accountability requirement.
To protect the service through rate limiting and abuse prevention.

We do not sell your data, and we do not use it for advertising.

What we assess, and what we don't

VendorPulse performs passive, non-intrusive assessment. We read publicly available information — certificate transparency logs, DNS records, and what a server openly presents. We do not log in to your systems, attempt to exploit anything, or disrupt your services. You may only scan a domain whose control you have verified, either through an email at that domain or a DNS ownership token.

Where your data lives

Your data is stored on servers located in India. We keep the amount of personal data we hold to the minimum needed to run the service.

How long we keep it

We keep account and scan data while your account is active. You can ask us to delete your account and associated data at any time by emailing privacy@vendorpulse.co.in; we retain only what the law requires us to.

Your rights

Under the DPDP Act you may ask to access, correct, or erase your personal data, and withdraw consent. To exercise any of these, email us and we will respond within a reasonable time.

Security

We protect your data with encryption in transit, access controls, and audit logging. If a breach ever affects your data, we will notify you and the Data Protection Board as required.

This notice may be updated as the service grows and as the DPDP Rules are finalised. We'll post changes here and, for material changes, notify registered members by email. This is our current notice and not legal advice.