Privacy Notice & Data Processing Policy

1. Data Fiduciary Identity & Grievance Contact

The Data Fiduciary responsible for personal data processed through B A C Tech Intelligence is:

2. Grounds and Specified Purposes for Processing

Under Section 4 and Section 6 of the DPDP Act 2023, we process personal data exclusively for specified, lawful purposes:

• Service Delivery: Providing authentication, session security, CSRF token validation, and scanner functionality.
• Abuse Mitigation: Preventing Server-Side Request Forgery (SSRF), distributed denial of service, automated brute-force attacks, and enforcing rolling 24-hour anonymous allowances using privacy-preserving cryptographic hashes.
• Account Recovery & Security: Sending transactional verification and single-use password reset emails.
• Optional Promotional Communications: Sending updates, hosting offers, and development announcements only where affirmative, granular consent was explicitly given.

3. Data Minimization & Retention Periods

We strictly minimize the collection and retention of personal data:

• IP Addresses: Raw IP addresses of anonymous visitors are never permanently retained; they are cryptographically salted and hashed into a 32-character string to enforce daily allowances.
• Scanned Target Data: Only publicly observable HTTP/HTML headers and metadata are extracted. Full raw HTML responses are discarded after parsing and not permanently stored.
• Session Records: Active user sessions expire automatically after 14 days of inactivity.

4. Your Rights as a Data Principal (Section 11–14)

As a Data Principal under Indian law, you are entitled to exercise the following rights:

• Right to Access Information: Request a summary of personal data being processed.
• Right to Correction & Erasure: Request the correction of inaccurate data or complete erasure of your account and associated scans.
• Right to Grievance Redressal: Submit grievances directly to our designated Grievance Officer, with response timelines adhering to statutory requirements.
• Right to Withdraw Consent: You may withdraw consent to non-essential cookies or marketing emails at any time with 1-click via your Dashboard Settings or our DPDP Rights Portal.

5. Third-Party Service Providers

We partner with vetted technical processors operating under data protection agreements:

• Google OpenID Connect: For federated sign-in (requesting only minimum scopes: openid, email, profile).
• Cloudflare: For edge network acceleration, SSL termination, and Turnstile bot mitigation.