Privacy Policy

Last updated: October 2026

1. Data Controller

CyberAudit is operated by TIRO-ALP Advertising S.R.L., Str. Știrbei Vodă 154, Bl. 26A, Bucharest, Romania, CUI 41754591, Trade Registry J40/13646/11.10.2019.

Privacy contact: contact@tiro-alp.com.

2. Personal Data We Process

Account information, including email addresses and account identifiers.
Registered domains, submitted targets and scan-related information.
Scan histories, findings and generated PDF reports, which may contain information relating to identifiable persons.
Activation, session and entitlement records.
Technical and security information, potentially including IP addresses, timestamps, request logs and error records.
Purchase and billing information necessary to confirm payment, provide access and meet legal obligations.
Communications sent to customer support.

Users should avoid submitting unnecessary personal data through target names, support messages or other service inputs.

3. Purposes and Legal Bases

Contract performance: account creation, activation, scans, reports and paid-plan administration, under Article 6(1)(b) GDPR where applicable.
Legitimate interests: platform security, abuse prevention, fraud detection and technical reliability, under Article 6(1)(f) GDPR.
Legal obligations: accounting, tax compliance and lawful requests, under Article 6(1)(c) GDPR.
Consent: optional analytics or other non-essential tracking, where consent is required under applicable law.

4. Hosting and Service Providers

CyberAudit uses Contabo hosting infrastructure for its technical services. Payment and order processing are handled through the TIRO-ALP purchasing environment and its configured payment providers, which may include Stripe. Transactional account emails are delivered using Brevo.

Google Analytics 4 may be used to understand website usage where the applicable consent requirements have been satisfied.

Service providers may process information on our behalf or act as independent controllers for certain operations, depending on their role and applicable terms.

5. Website Scans and Third-Party Data

Security assessments may collect externally observable technical information from submitted websites and systems. Scan outputs can incidentally contain personal data exposed by a target.

Users are responsible for having lawful authorization to initiate assessments and for ensuring that their instructions and submitted targets comply with applicable law.

Where CyberAudit processes personal data on behalf of a business customer, the applicable data protection roles and any required processing agreement must be assessed according to the actual processing relationship.

6. Storage and Security

CyberAudit stores account, entitlement and scan information on its server infrastructure. Generated reports may be retained as PDF files.

We apply technical and organizational safeguards appropriate to the risks, including access controls and operational security measures. No internet-based service can guarantee absolute security.

7. Data Retention

Paid-plan expiry does not automatically mean that account records, scan histories or PDF reports are deleted.

We retain personal data only for as long as necessary for service delivery, account administration, security, dispute handling and applicable legal obligations. Different categories of data may have different retention requirements.

Account and report deletion is not currently represented as an automatic process tied to the 30-day or 365-day paid-plan validity periods. Users may contact us to request deletion, subject to applicable legal requirements and justified retention needs.

Accounting records may need to be retained for statutory periods. Security logs and technical records may be retained as reasonably necessary for protecting the service.

8. International Transfers

Some service providers may process data outside the European Economic Area. Where required, international transfers are subject to an applicable lawful transfer mechanism and appropriate safeguards.

9. Cookies and Analytics

Essential technical storage may be used for authentication, security and service functionality. Optional analytics technologies, including Google Analytics 4 where enabled, are subject to applicable consent requirements.

Users may manage optional cookie preferences through the controls provided on the website, where available. Further cookie information should be supplied through the relevant website consent notice.

10. Your Data Protection Rights

Subject to the GDPR and applicable limitations, you may request access, rectification, erasure, restriction, portability or object to certain processing. Where processing relies on consent, you may withdraw that consent without affecting prior lawful processing.

To submit a request, email contact@tiro-alp.com. We may request reasonable information to verify identity and will respond within applicable legal time limits.

11. Complaints

You may lodge a complaint with a competent data protection supervisory authority. In Romania, the supervisory authority is ANSPDCP.

12. Children

CyberAudit is intended for professional and adult users and is not directed at children. We do not knowingly solicit account registrations from children.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our processing activities, service providers or legal requirements. The updated version will display its revision date.