1. Controller and contact
Hackaiz is a service operated by HACKTUALIZ Inc. For any privacy question or request, email contact@hackaiz.com.
2. Data we process
- Account data: name, email address, avatar, identifier, and sign-in information provided by Google, Gmail, or GitHub.
- Project data: authorized repositories, GitHub metadata, branches, files needed for assessment, and technical URLs or targets you add.
- Security data: findings, masked evidence, locations, coverage, fixes, build and test outcomes, retests, and monitoring results.
- Service data: credit balance and history, preferences, alerts, administrative audit records, technical metrics, errors, and estimated AI usage.
- Communications: the address and preferences needed to send requested security alerts and service messages.
3. Why we use it
- Authenticate your account and protect your workspace.
- Assess assets you are authorized to test, explain risks, and reduce false positives.
- Prepare, verify, and apply a fix only when you request it or enable an automation.
- Monitor enabled targets, send requested alerts, manage credits, and prevent abuse.
- Maintain the reliability, security, and accountability of the service.
4. GitHub and repository content
Hackaiz requests only the repository access needed for the projects you select. Content is read for assessment and remediation. A branch, commit, or pull request is created only as part of an authorized fix action. Detected secrets are masked in the interface and reports.
5. Artificial intelligence
Relevant portions of code, findings, or context may be sent to Google Gemini to explain a finding or prepare a fix. Hackaiz limits that context and masks secrets where possible. Model output is checked by rules, compilation, tests, or available CI; it is never a security guarantee.
6. Service providers
Hackaiz relies in particular on Supabase for authentication and data, GitHub for repository access and fixes, Google for sign-in and Gemini, Resend for email, and the application hosting infrastructure. With your permission, Siteviral receives a referral click and then the partner code, amount, currency and purchase reference after confirmed payment, to attribute the sale. No repository content, security finding, name or email is shared. The local code expires after 7 days; reported purchase references are retained for accounting and disputes. You can withdraw consent on the Cookies page. Each provider processes data according to its role and terms.
7. Retention
Data is kept while your account and the relevant features remain active, then for a period reasonably necessary for security, legal duties, and dispute resolution. You may request account deletion. Limited records may remain where law or security obligations require it.
The intervention log (the list of requests Hackaiz sent to your targets, without response contents) is kept for 24 months, then deleted. It proves exactly what Hackaiz did, and nothing else.
8. Security and limits
Hackaiz applies access controls, masks sensitive evidence, and separates user data. No service can guarantee absolute security. Do not provide a target, repository, or credential you are not authorized to use.
9. Your choices and rights
- Change alert and monitoring preferences in Settings.
- Revoke access through GitHub or Google and disconnect integrations.
- Request access, correction, export, objection, or deletion where applicable by contacting contact@hackaiz.com.
10. Changes
This policy may change as the service or applicable requirements evolve. The version date will be updated, with additional notice when a material change requires it.
Consented campaign measurement
Based on your optional consent, separate from affiliation, Hackaiz may associate three predefined categories with your account: source, channel and campaign. These count acquired accounts, successful analyses and confirmed purchasers by group, not browsing history. No partner code or security data enters this attribution, and SiteViral does not receive it. Local capture lasts 7 days; account attribution expires after 90 days and is removed by daily cleanup. Administrators see only aggregates; groups smaller than 5 accounts are not detailed. Refusing does not affect the service. You can withdraw permission and delete attribution for the signed-in account on the Cookies page.