Privacy policy
Controller
Mohamed Ait el hadj, publisher of Kynscope, is the controller of the personal data processed by the service. Contact: contact@kynscope.com.
Data processed and why
Account: your email address and sign-in data, managed by Amazon Cognito, to create and secure your account (performance of the contract).
Workspace: the names you choose, the websites you register, ownership proofs, scan results, the software components and versions detected on your sites, evidence summaries and your decisions on findings, to provide the service and its security alerts (performance of the contract).
Messages you send to contact@kynscope.com, security@kynscope.com or our other role addresses: to answer you (legitimate interest).
Beta waitlist: the email address you leave on the home page, your language and the date, only to send you one email when Kynscope opens (your consent, which you may withdraw at any time).
Security logs: technical request logs, to protect the service against abuse (legitimate interest).
Kynscope does not sell data, does not use advertising or third-party analytics, and does not use generative AI on your data.
Where the data is stored and who processes it
The service runs on Amazon Web Services in the Europe (Stockholm, eu-north-1) Region. Messages sent to our addresses are received there, then forwarded to the publisher's mailbox, hosted by Google. If you link a GitHub installation, GitHub processes the repository access you grant.
Google and GitHub may process data outside the European Union, under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
How long it is kept
Raw scan evidence: 7 days. Reviewed reports: 30 days. Technical logs: 7 to 30 days. Database backups: 7 to 14 days. Messages received: 30 days on AWS, and in the publisher's mailbox for as long as needed to handle your request, at most 3 years after the last exchange. Waitlist addresses: until 6 months after the beta opens, or until you ask for their deletion. Account and workspace data: until the account is closed, then deleted within the backup period.
Cookies and browser storage
No tracking or advertising cookie is used. The browser stores your language and appearance choices, and keeps temporary sign-in data for the current session only. Access tokens stay in memory.
Your rights
You may access, correct, export or delete your data, and object to or restrict its processing, by writing to contact@kynscope.com. You receive an answer within one month. You may also lodge a complaint with your data protection authority (in France: CNIL, www.cnil.fr).