LEGAL

Privacy Policy

Last updated: November 8, 2026

This policy explains what GK Data LLC ("misconfig.ai", "we") collects when you use the hosted platform at app.misconfig.ai and its API (the "Service"), why, and the choices you have.

1. What we collect

Account data. Your email address, display name and avatar as provided by the sign-in method you choose (passkey, GitHub, Google or an emailed magic link), the identifier of that linked account, and the workspaces you belong to. We do not store passwords; passkey public keys and two-factor secrets are stored to verify sign-ins.

Usage and security data. Session records (time, IP address, user agent), API-key usage, rate-limit counters, and server logs that include request paths, status codes and IP addresses. We use these to run the Service, prevent abuse and investigate incidents.

Scan data. The targets you submit, the hosts and services discovered for them, the checks run, the findings and their observation history, redacted request and response evidence, and your confirmation at scan time that you are authorized to scan the target. Evidence is redacted before storage to remove credentials, tokens, cookies and similar secrets; the raw responses are not kept.

Billing data. Payments are handled by Stripe. We receive your Stripe customer and subscription identifiers, the plan or top-up bought, amounts and payment status. We never see or store full card numbers.

Support. Anything you send to our support or security addresses.

We do not use third-party advertising or analytics trackers.

2. How we use it

• to provide the Service: sign you in, run scans, store history, show your map and exports;
• to bill paid plans and top-ups;
• to send transactional email: magic links, and alerts you turn on;
• to keep the Service secure and prevent misuse, including enforcing scan authorization, allowances and target blocklists;
• to answer support requests and respond to reports from operators of scanned systems;
• to measure and improve the Service in aggregate.

Where EU or UK law applies, our legal bases are performance of our contract with you, our legitimate interests in running a secure service, compliance with legal obligations, and your consent where we ask for it.

3. Automated analysis

Finding status is decided by reproducible checks, never by a model. We use a language model, run on our hosting provider's infrastructure, to choose which checks fit a host's observed technology and to write plain-language explanations and remediation steps for confirmed findings. The model receives host names, technology fingerprints and redacted evidence; it does not receive your account data, and prompts are not used to train models.

4. Who we share it with

We share personal data only with providers that process it for us under contract:

• Cloudflare, Inc.: hosting, storage, compute, email delivery and the model inference described above. All Service data is stored and processed on Cloudflare's platform.
• Stripe, Inc.: payments and subscription management.
• GitHub, Inc. and Google LLC: only if you sign in with them, to confirm your identity and receive your profile. Google user data obtained through Google Sign-In is used solely to create and sign you in to your account and is never shared with, sold to, or used by anyone else.

We may disclose data when required by law or to protect the rights, safety or property of misconfig.ai, our users or the operators of scanned systems. If we are acquired or merge, data may transfer to the successor under this policy. We do not sell personal data.

5. Public discovery pages

When public pages are enabled, a page for a scanned domain may show asset metadata: host names, whether they are live, and technology fingerprints. These pages never show findings, evidence, or who scanned the domain. Operators of a domain can ask us to remove its page or to stop scanning it at security@misconfig.ai.

6. Retention

• Scan history is kept for the retention period of your plan (for example 7 days on Free, 90 days on Pro) and then deleted or rolled up into counts.
• Account data is kept while your account exists and deleted within 30 days of a deletion request, except records we must keep for tax, billing or legal reasons.
• Server logs and rate-limit counters are kept for up to 30 days.
• Billing records are kept for as long as tax law requires.

7. Security

Traffic is encrypted in transit. Data is stored encrypted at rest by our hosting provider. Sign-in uses passkeys, OAuth or single-use emailed links; there are no passwords to leak. API keys are stored hashed. Evidence is redacted before it is stored. Access to production data is limited to the people who operate the Service. Report security issues to security@misconfig.ai.

8. Your rights

You can see and export your workspace's data in the Service. You can ask us to correct, delete or give you a copy of your personal data, to restrict or object to processing, or to withdraw consent, by emailing support@misconfig.ai. If you are in the EEA, UK or Switzerland you may also complain to your data-protection authority. California residents have the rights described in the CCPA; we do not sell or "share" personal information as those terms are defined there.

9. International transfers

We are based in the United States and our providers operate globally. Where data moves out of the EEA, UK or Switzerland we rely on our providers' standard contractual clauses and equivalent safeguards.

10. Cookies

We set only strictly necessary cookies: a session cookie and short-lived cookies that complete a sign-in. They are marked Secure, HttpOnly and SameSite. No advertising or cross-site tracking cookies are used.

11. Children

The Service is for professionals and is not directed at children under 16. We do not knowingly collect their data; contact us if you believe we have.

12. Changes

We will post any changes here and update the date above. For material changes we will also notify you in the Service or by email before they take effect.

13. Contact

GK Data LLC, operating misconfig.ai. Privacy questions and requests: support@misconfig.ai. Security and abuse: security@misconfig.ai.