Velqor Stack LLC · Version 1.0
Privacy Policy
1. Who we are and what this policy covers
This Privacy Policy explains how Velqor Stack LLC, a Montana limited liability company (Montana Secretary of State file no. 17386114), trading as Velqor Stack (“Velqor Stack”, “we”, “us”), collects, uses, shares and protects personal information when you visit velqorstack.com (the “Site”), use the Velqor Stack platform (the “Platform”), request or buy our security testing services, or communicate with us. Our mailing address is 145 W Broadway, Long Beach, CA 90802-4413, USA.
It also explains how we handle the technical data we encounter while testing your systems, because that data can include personal information belonging to your users. Where we test a system on your instructions, you are the controller (or “business”) for personal information in that system and we act as your processor (or “service provider”); Section 5 describes that relationship.
This policy does not cover websites or services we link to, including Stripe’s checkout pages, which have their own policies.
2. Information we collect
Information you give us
- Contact and account details: name, work email address, organisation, job title, phone number if you provide it, and the password or sign-in method for your account.
- Assessment requests: what you ask us to test, the systems involved, and anything else you write in the form or in email.
- Scope and authorisation records: hostnames, repository locations, IP ranges, environment details, test accounts you create for us, and the written confirmation that you own or are authorised to test the target.
- Billing details: billing name, address and tax identifiers. Card and bank details are entered directly into Stripe and are not stored by us; we receive only a payment token, the last four digits, card brand and expiry month and year.
- Support and correspondence: emails, messages and consultation notes.
Information we collect automatically
- Server and security logs: IP address, browser type, pages requested, time of request and referring page, kept by our hosting provider and by us to run and protect the Site and Platform.
- Platform activity: sign-ins, scans started and completed, reports generated and downloaded, and badge verification page views, so that we can show you your history and detect misuse.
- Analytics: we use a privacy-focused analytics service that records page views and referrers in aggregate without cookies and without storing IP addresses or any identifier that could single you out. We do not use advertising trackers.
Information we collect while testing (“Scan Data”)
- Requests to and responses from the target, including headers, parameters, error messages and content returned by the target; source code and dependency manifests you provide for code analysis; host and service information from server scans; and screenshots or extracts kept as evidence for findings.
- Scan Data can incidentally contain personal information held in your systems, for example names in a database error or test accounts in a response. We minimise what we capture and treat all Scan Data as confidential; see Section 5.
Information from others
- Stripe sends us payment status, dispute and fraud signals.
- Public sources, such as DNS, certificate transparency logs and your public website, used to confirm ownership and to scope a test.
We do not knowingly collect special categories of personal information (such as health, biometric or precise location data) and ask you not to send them to us.
3. How we use information
| Purpose | Information used | Legal basis (where one is required) |
|---|---|---|
| Respond to an assessment request and prepare a scope | Contact details, request details, public sources | Steps before a contract; legitimate interest in answering enquiries |
| Confirm you are authorised to test the target | Authorisation records, public sources | Contract; legal obligation to avoid unauthorised testing |
| Perform the scan, retest and produce reports | Scope records, Scan Data, platform activity | Contract |
| Take payment, issue invoices and refunds, handle disputes | Billing details, Stripe payment status | Contract; legal obligation (tax and accounting) |
| Run, secure and improve the Site and Platform | Logs, platform activity, aggregate analytics | Legitimate interest in keeping the service available and secure |
| Provide support and consultation | Correspondence, reports | Contract |
| Issue and verify a “Tested by” badge | Organisation name, scope, dates, open-finding counts | Contract; your written approval of what the verify page shows |
| Send service notices (scan complete, retest due, policy changes) | Contact details | Contract; legitimate interest |
| Send occasional product or research updates | Work email | Consent, which you can withdraw at any time using the link in each email |
| Meet legal obligations and respond to lawful requests | Any of the above as required | Legal obligation |
We do not sell personal information, do not share it for cross-context behavioural advertising, and do not use it to train machine-learning models.
4. Who we share information with
We share personal information only with the following, and only as needed for the purpose stated:
- Stripe, Inc. – payment processing, invoicing and fraud prevention. Stripe is an independent controller for the payment data it collects; see stripe.com/privacy.
- Hosting and infrastructure providers – Cloudflare, Inc. for hosting, DNS, DDoS protection and encrypted storage of the Site, the Platform, Scan Data and reports, under its data-processing terms.
- Email and support tools – our email provider, under a data-processing agreement, to send and receive email and service notices.
- Analytics – a cookie-free analytics service configured without personal identifiers.
- Our staff and contracted testers – bound by written confidentiality and access controls, with access limited to the engagements they work on.
- Professional advisers – lawyers, accountants and insurers, under confidentiality, where needed.
- Authorities – where required by law, court order or to protect rights, safety or the integrity of the Platform. Where lawful, we will tell you before disclosing your information.
- A successor – if we sell or transfer the business, under the same protections as this policy.
We do not share your findings, reports or scan results with any other client, partner or third party without your written consent.
5. Scan Data and findings: how we handle them
Security testing is different from ordinary web browsing: we deliberately probe your systems and keep evidence of what we find. These rules apply to all Scan Data and findings.
- You decide the scope. We only test what is in the agreed scope and only after you confirm authorisation. We do not go looking for personal information; where we encounter it, we record the minimum needed to evidence a finding (for example, that a field is exposed, not its full contents).
- We act as your processor. For personal information inside your systems, you are the controller or business and we are your processor or service provider. We process it only on your documented instructions (the scope), apply the security measures in Section 6, help you respond to data-subject requests that concern Scan Data, and delete or return it under Section 7. A data-processing agreement is available on request and forms part of the Terms of Service for clients who need one.
- Breach notification. If we become aware that Scan Data or a report has been accessed without authorisation, we will notify you without undue delay and in any case within 72 hours of confirming it, with what we know and what we are doing.
- Reports stay confidential. We do not publish findings, name clients, or use client systems in case studies without written consent. Badge verification pages show only the organisation name, service, scope description and dates you approve, plus the count of Critical and High findings open at retest.
- Vendor disclosure. If testing reveals a vulnerability in third-party software, we may report it to that vendor in a way that does not identify you or your systems.
6. How we protect information
- Encryption in transit (TLS 1.2 or higher) for the Site, Platform and all data transfers; encryption at rest for Scan Data, reports and backups.
- Access to client engagements limited to the testers and staff assigned to them, with multi-factor authentication and access logging.
- Credentials and test accounts you provide stored in a secrets manager, never in reports, tickets or email.
- Separate environments for testing tooling and for client data, with regular patching and our own periodic security testing.
- Staff and contractors bound by written confidentiality and trained on handling client data.
No method of storage or transmission is completely secure. If you believe your account or data has been compromised, contact security@velqorstack.com.
7. How long we keep information
| Information | Retention | Reason |
|---|---|---|
| Account and contact details | While your account is active, then 12 months | Service delivery; follow-up on open findings |
| Assessment requests not converted to an order | 6 months | To answer follow-up questions, then deleted |
| Scope and authorisation records | 6 years after the engagement | Evidence that testing was authorised |
| Scan Data (raw requests, responses, screenshots) | 90 days after the final report or retest, then deleted | Evidence for findings and retest; minimised thereafter |
| Reports and statements of testing | 3 years after delivery, unless you ask for earlier deletion | Your reference, retest comparison and badge verification |
| Badge verification page | 12 months after the retest date, then marked expired | Badge validity |
| Billing records and invoices | 7 years | Tax and accounting law |
| Server and security logs | 30 days | Security and troubleshooting |
| Aggregate analytics | Indefinitely | Contains no personal information |
You can ask us to delete Scan Data or reports earlier at any time; we will do so unless we must keep them to meet a legal obligation, resolve a dispute or prove that testing was authorised.
8. Cookies and similar technologies
The Site uses no advertising or third-party tracking cookies. We use:
- Strictly necessary cookies on the Platform to keep you signed in and to protect forms against cross-site request forgery. These cannot be switched off while using the Platform.
- Local storage on the Site for conveniences such as remembering a dismissed notice. Nothing in it identifies you.
- Stripe’s cookies on checkout pages, which Stripe sets for payment security and fraud prevention under its own policy.
Because we set no non-essential cookies, the Site does not show a cookie banner. If that changes, we will ask for consent before setting any optional cookie.
9. Your rights and choices
Depending on where you live, you may have the right to:
- Know and access the personal information we hold about you and receive a copy in a portable format.
- Correct inaccurate information.
- Delete your information, subject to the exceptions in Section 7.
- Object to or restrict certain processing, including marketing.
- Withdraw consent where processing is based on consent, without affecting what was done before.
- Not be discriminated against for exercising these rights.
California and other US states. Residents of California, Colorado, Connecticut, Virginia, Utah, Texas and other states with comprehensive privacy laws have the rights above to the extent those laws apply. We do not sell personal information or share it for targeted advertising, and we do not engage in profiling that produces legal or similarly significant effects. You may designate an authorised agent to act for you; we will verify the request.
European Economic Area, United Kingdom and Switzerland. If you are in these regions, the legal bases in Section 3 apply. You may lodge a complaint with your local supervisory authority. Our representative, where one is required, is not yet appointed.
To exercise any right, email privacy@velqorstack.com from the address on your account, or write to the postal address in Section 13. We respond within 30 days (45 days where state law allows and we tell you we need it). We may need to verify your identity first. There is no charge unless a request is manifestly unfounded or excessive.
If your request concerns personal information inside a client’s system that we tested, we will refer it to that client, who controls it.
10. Children
The Site and Services are for businesses and professionals. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us information, contact us and we will delete it.
11. International transfers
We are based in the United States and process information there. Our providers may process data in other countries. Where information about people in the EEA, UK or Switzerland is transferred outside those regions, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful mechanism, and apply the security measures in Section 6.
12. Changes to this policy
We may update this policy. The effective date at the top shows the current version. For material changes we will email account holders at least 14 days before they take effect and, where the law requires, ask for your consent. Earlier versions are available on request.
13. Contact
Privacy questions and requests: privacy@velqorstack.com Security incidents and vulnerability reports: security@velqorstack.com
Velqor Stack LLC, a Montana limited liability company, Montana Secretary of State file no. 17386114 Mailing address: 145 W Broadway, Long Beach, CA 90802-4413, USA Registered agent for legal notices: Zero Tax Tags LLC, 525 Railway St, Ste 206, Whitefish, MT 59937-2521