# 🔒 Privacy Policy

Effective Date: October 16, 2025

## 1. Introduction

Corporation of Light DBA TheGAVL ("we," "our," or "us") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use TheGAVL Red Team Security Tools.

## 2. Information We Collect

### Account Information

- Email address
- Name (if provided)
- Password (encrypted)
- Account creation date
- Multi-factor authentication settings

### Usage Data

- Tool usage logs and timestamps
- IP addresses and geolocation data
- Browser type and operating system
- Session duration and activity patterns
- Error logs and debugging information

### Authentication Data

- Login attempts (successful and failed)
- OAuth provider data (if using Google/GitHub/etc.)
- Session tokens and refresh tokens
- Security events (password changes, MFA events)

## 3. How We Use Your Information

We use collected information for:

- Service Provision: To provide and maintain the Service
- Security: To detect and prevent abuse, fraud, and unauthorized access
- Compliance: To comply with legal obligations and law enforcement requests
- Improvement: To improve Service features and user experience
- Support: To respond to support requests and technical issues
- Communication: To send important Service updates and security alerts

## 4. Data Sharing and Disclosure

We do NOT sell your personal information to third parties.

We may share information in the following circumstances:

### With Service Providers

- Supabase (authentication and database hosting)
- GitHub Pages (website hosting)
- Email service providers (for account notifications)

### For Legal Compliance

- Law enforcement requests with valid legal process
- Court orders or subpoenas
- Protection of our legal rights
- Prevention of illegal activity or harm

### Business Transfers

- In connection with merger, acquisition, or sale of assets

## 5. Data Retention

We retain your data as follows:

- Account Data: Until account deletion or 2 years of inactivity
- Usage Logs: 90 days for operational logs, longer for security incidents
- Audit Logs: 7 years for compliance purposes
- Security Events: Indefinitely for serious violations or illegal activity

## 6. Data Security

We implement security measures including:

- End-to-end encryption for data in transit (HTTPS/TLS)
- Encryption at rest for sensitive data
- Password hashing with industry-standard algorithms
- Multi-factor authentication support
- Regular security audits and penetration testing
- Access controls and least-privilege principles

## 7. Your Privacy Rights

### Access and Correction

- Request access to your personal data
- Correct inaccurate information
- Update account preferences

### Data Deletion

- Request account deletion
- Export your data before deletion
- Note: Some data may be retained for legal compliance

### Opt-Out Rights

- Opt out of marketing emails (security alerts cannot be opted out)
- Disable optional data collection

### California Privacy Rights (CCPA)

California residents have additional rights:

- Right to know what personal information is collected
- Right to delete personal information
- Right to opt-out of sale (we don't sell data)
- Right to non-discrimination for exercising rights

### GDPR Rights (EU Residents)

- Right to access, rectification, erasure
- Right to data portability
- Right to object to processing
- Right to lodge a complaint with supervisory authority

## 8. Cookies and Tracking

We use the following:

- Session Cookies: To maintain your login state
- Authentication Tokens: For secure API access
- Local Storage: For user preferences and settings

We do NOT use:

- Third-party advertising cookies
- Cross-site tracking
- Fingerprinting techniques

## 9. International Data Transfers

Your data may be stored and processed in the United States. By using the Service, you consent to the transfer of your data to the U.S.

## 10. Children's Privacy

This Service is not intended for users under 18 years of age. We do not knowingly collect information from children. If you believe a child has provided information, contact us immediately.

## 11. Changes to This Policy

We may update this Privacy Policy. Material changes will be notified via email or prominent notice on the Service. Continued use constitutes acceptance of changes.

## 12. Contact Us

For privacy-related questions or to exercise your rights:

- Email: privacy@thegavl.com
- Legal: legal@thegavl.com
- Support: support@thegavl.com

Last Updated: October 16, 2025

← Back to Home