Privacy Policy
Effective 17 August 2026 Last updated 17 August 2026
1. Scope and responsible company
This Privacy Policy describes how DefenceCore Ltd. collects, uses, stores, shares, and protects personal data in connection with the Service, websites, dashboards, APIs, account communications, and support. DefenceCore Ltd., Judeide-Maker, Israel, is the controller of account, product-usage, billing, support, and business-contact data used for its own purposes.
For personal data contained in logs and other Customer Data that DefenceCore processes solely to provide the Service on a business customer’s instructions, that customer generally determines the purposes and means of processing and DefenceCore generally acts as its processor or service provider. In that situation, individuals should first direct requests to the relevant customer, and DefenceCore will support the customer as required by applicable law and contract.
2. Personal data we process
Depending on how you use the Service, DefenceCore may process:
- Account and identity data. Name, email address, Firebase user identifier, profile information, authentication-provider details, account status, and security events associated with login. DefenceCore’s backend verifies authentication tokens and does not receive your account password.
- Connected-project and authorization data. Supabase account and project identifiers, project names and metadata, enabled status, authorization scopes, OAuth connection identifiers, encrypted access and refresh tokens, token expiry information, and connection events.
- Free Scanner data. Email address; marketing preference; the accepted Terms and consent copy versions and server-recorded timestamps; keyed anti-abuse and idempotency identifiers; selected Supabase project reference, name, region, and status; encrypted OAuth credentials and scopes; database structure, configuration, roles, grants, policies, and other technical query results; scan findings; report-delivery state; and operational audit events. The Free Scanner is prohibited for projects containing Sensitive Data or PII.
- Security logs and findings. Supported log records retrieved from connected projects, including timestamps, sources, severity, messages, attributes, raw event payloads, normalized events, detection results, incident titles and summaries, evidence, status, and related project identifiers. Log contents depend on the customer’s systems and may include IP addresses, user identifiers, communications, technical events, or other personal data.
- Subscription and transaction data. Plan, trial, subscription and entitlement status, billing-customer and subscription identifiers, renewal and cancellation dates, payment status, customer-portal links, and limited card descriptors such as brand and last four digits. Full card information is processed by the commerce or payment provider, not DefenceCore.
- Device, network, and usage data. IP address, request date and time, endpoint and response information, browser or device characteristics, session and cookie data, error information, diagnostic logs, and interactions with features, to the extent generated by the Service or collected through technologies described at the time of use.
- Communications. Support requests, feedback, survey responses, account-verification and password-reset delivery records, and other communications with DefenceCore.
- Business and compliance records. Organization, role, authority, contract, consent, preference, audit, fraud-prevention, security, and legal-request records.
3. Sources of personal data
DefenceCore receives personal data directly from you or your organization; automatically when you use the Service; from connected services you authorize, including Supabase; from authentication providers, including Firebase Authentication and Google where selected; from the commerce and payment provider, currently Lemon Squeezy; from email-delivery providers, currently Resend; and from security, fraud-prevention, hosting, logging, and support providers. DefenceCore may also receive business contact information from public or lawful commercial sources.
4. Why we use personal data
- create, authenticate, secure, administer, and support accounts;
- connect authorized projects; retrieve, normalize, retain, analyze, and display supported logs; detect and present potential incidents; and provide analytics and other Service functions;
- perform a requested Free Scanner scan, present and email its report, prevent abuse and duplicate scans, maintain consent and acceptance evidence, and send marketing only where the user separately consents;
- provide trials and paid plans; process checkout and subscription events; verify entitlements; manage renewals, cancellations, failed payments, taxes, and transaction records;
- operate, maintain, troubleshoot, measure, develop, and improve the Service, including through aggregated or de-identified information;
- send service, security, verification, password-reset, billing, support, legal, and administrative communications;
- protect users, customers, DefenceCore, connected services, and the public; prevent fraud, abuse, unauthorized access, and violations; investigate and respond to security events;
- comply with law, regulatory duties, legal process, audits, tax and accounting obligations, and enforce contracts and legal rights; and
- send marketing communications where permitted and subject to required consent and opt-out rights.
Depending on the context and applicable law, DefenceCore relies on performance of a contract or requested pre-contract steps, consent, compliance with legal obligations, and legitimate interests such as providing and securing the Service, preventing fraud, supporting customers, and improving products. Where consent is the legal basis, you may withdraw it prospectively, without affecting prior lawful processing.
5. Whether providing data is mandatory
Providing personal data is generally voluntary unless law or a contract requires it. However, account identifiers, contact details, authentication information, connected-project permissions, and subscription information are necessary to create and secure an account, connect a project, provide monitoring, deliver support, and supply paid features. The Free Scanner requires an email address, the read-only Supabase authorization, and acceptance of the current Free Scanner Terms; without them DefenceCore cannot perform or deliver the scan. Marketing consent is optional, separate from terms acceptance, and may be refused or withdrawn without preventing a requested transactional scan report.
6. How we disclose personal data
DefenceCore may disclose personal data to:
- Infrastructure and service providers that host, store, secure, transmit, analyze, monitor, or support the Service, including cloud hosting, managed databases, authentication, secret management, email delivery, logging, customer support, and professional advisers.
- Connected platforms such as Supabase, when necessary to initiate or maintain an authorized connection, retrieve requested data, refresh tokens, or respond to your actions.
- Commerce and payment providers currently Lemon Squeezy, to create checkout sessions, administer subscriptions, process payments, handle taxes, and provide billing portals.
- Your organization including account owners, administrators, and other authorized users, where the Service is used for an organization.
- Authorities and protected parties when DefenceCore reasonably believes disclosure is necessary to comply with law or legal process; protect rights, safety, and security; investigate fraud or abuse; or enforce agreements.
- Transaction participants in connection with a financing, merger, acquisition, reorganization, insolvency, sale of assets, or similar transaction, subject to appropriate confidentiality protections.
- Others at your direction with your consent or when you instruct DefenceCore to share or make information available.
DefenceCore does not sell personal data for money. If DefenceCore introduces advertising, data-sale, or cross-context behavioral-advertising practices that require additional notice or choice, it will update its disclosures and provide required controls before doing so.
7. International data transfers
DefenceCore is based in Israel and may use providers or infrastructure in Israel, the United States, the European Economic Area, and other countries. Personal data may therefore be processed outside your country, where privacy laws may differ. DefenceCore uses contractual, organizational, and technical safeguards intended to support lawful transfers, including transfer mechanisms required by applicable Israeli or other data-protection law. Contact [email protected] for information about safeguards relevant to your data.
8. Retention
DefenceCore retains personal data only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Service, maintain security and business records, comply with law, resolve disputes, and enforce agreements. Retention depends on the type of data, plan, sensitivity, legal requirements, and operational need.
Security-log retention is governed by the applicable plan and Service configuration; the current DefenceCore Pro configuration described in the product materials retains security logs for seven days, subject to authorized temporary extensions for incident handling. Derived incident records and counts may remain after underlying logs are pruned so customers retain a history of what was detected. OAuth-attempt records are short-lived, while account, connection, subscription, transaction, support, security, and legal records may be kept for the life of the relationship and an appropriate period afterward. Backups and records preserved for legal or security reasons may be deleted on a delayed cycle.
For the Free Scanner, OAuth attempts and credentials are short-lived and are removed after completion or expiry under the scanner workflow. Scanner contact data, findings, report delivery records, and operational records are generally scheduled for deletion after 30 days. If a user separately consents to marketing, the marketing contact and consent evidence may be retained until consent is withdrawn or the contact is otherwise deleted, subject to legal, security, backup, and dispute-preservation needs.
Revoking a connected-service authorization stops access to the extent supported by that provider, but it may not delete information already processed. You or your organization may request account or data deletion as described below. DefenceCore may retain information where required or permitted by law and may keep aggregated or de-identified information that can no longer reasonably identify a person.
9. Security
DefenceCore maintains administrative, technical, and organizational measures designed to protect personal data against unauthorized or unlawful processing and accidental loss, destruction, alteration, or disclosure. Measures may include least-privilege access, tenant-bound record controls, encryption in transit, encryption of supported OAuth tokens at rest, secret management, environment separation, logging, incident response, vendor controls, and retention processes. Security is a shared responsibility and no system can be guaranteed completely secure.
If you believe data or an account has been compromised, contact [email protected] promptly. DefenceCore will investigate and make notifications to regulators, customers, or individuals when required by applicable law.
10. Your privacy rights
Subject to applicable law and exceptions, you may have the right to request access to personal data about you; obtain information about its processing; request correction of inaccurate, incomplete, unclear, or outdated data; request deletion or restriction; object to certain processing; withdraw consent; and receive or transfer certain data. Under Israel’s Protection of Privacy Law, individuals have rights of access and correction in qualifying circumstances. Additional rights may apply based on where you live.
To make a request, email [email protected] and describe the right you wish to exercise. DefenceCore may verify your identity and authority, ask for information needed to locate records, and respond within the period required by applicable law. If the data is controlled by a DefenceCore customer, DefenceCore may direct you to that customer or assist it in responding. You may also complain to the Israeli Privacy Protection Authority or another competent supervisory authority, subject to applicable law.
11. Marketing communications
DefenceCore will send electronic marketing only as permitted by applicable law and, where required, after obtaining consent. You can opt out using the unsubscribe link in a marketing message or by contacting [email protected]. Opting out of marketing does not stop essential service, security, billing, support, or legal communications.
13. Children
The Service is intended for adults and business users and is not directed to children under 18. DefenceCore does not knowingly collect personal data directly from children through account registration. If you believe a child has provided account data, contact [email protected]. Customer Data may include information about other individuals selected by a customer; the customer is responsible for ensuring that any such processing is lawful.
14. Changes to this Policy
DefenceCore may update this Policy to reflect changes in the Service, vendors, practices, or law. The updated Policy will state its effective date and be posted through the Service or website. DefenceCore will provide additional notice of material changes when required. Where consent is required for a new purpose, DefenceCore will seek it before that processing.
15. Contact
For privacy questions, rights requests, or complaints, contact:
DefenceCore Ltd.Attn: PrivacyJudeide-Maker, Israel[email protected]