Privacy Policy
How we handle personal data — yours, not your clients'. Engagement-specific data handling is covered separately in our Engagement Terms.
We collect the minimum data needed to run the website and respond to inquiries. We never sell your data, never train AI models on it, and never share it with advertising networks. You can email us anytime to see what we have on you or to have it deleted. Our free Arsenal tools run inputs through audited infrastructure with zero retention — your prompts and documents are processed and discarded.
- IP address, browser type, operating system, pages visited, and referrer URL.
- Approximate location (country and region only) inferred from IP — the raw IP address is not stored.
- Session duration and scroll depth, collected in aggregate and anonymized.
- Cookies — session and CSRF tokens only; no advertising or tracking cookies. Details below.
- Name, email address, company name, and role.
- The content of your message or audit scoping request.
- Any documents, system prompts, or files you choose to share.
- The inputs you submit — system prompts, documents, or text.
- The results returned to your session.
- Anonymized scan metadata: timestamp, tool used, and severity score.
What we do not log from tool use:
- Your IP address alongside your inputs.
- Your inputs linked to your email address — tool use is never tied to your identity unless you are signed in and explicitly save results.
- Any data that could re-identify you from a scan result.
We use two cookies:
- Session cookie — keeps you signed in to your LogicLeak account. Expires on sign-out or after 30 days of inactivity.
- CSRF token — protects form submissions from cross-site request forgery. Not used for tracking.
No Google Analytics, Meta Pixel, advertising trackers, cross-site tracking cookies, or browser fingerprinting. You can block all cookies in your browser — the only effect is that you cannot stay signed in.
- To respond to your inquiries and deliver paid engagements.
- To run, secure, and improve the website and Arsenal tools.
- To send the Threat Briefing newsletter — only if you subscribed. Every email includes a one-click unsubscribe.
- To meet legal obligations: tax records, compliance requirements, or valid court orders.
- We do not sell or rent your data to any third party, ever.
- We do not train AI models on client data, user inputs, or engagement materials — ever.
- We do not run advertising networks or share data with ad partners.
- We do not enrich your data using third-party data brokers.
- We do not build behavioural profiles or use your data for retargeting.
- Right to access — request a copy of any personal data we hold about you.
- Right to correction — ask us to fix anything inaccurate or incomplete.
- Right to deletion — request that we remove your data (limited exceptions apply for legal retention obligations).
- Right to portability — receive your data in a structured, machine-readable format.
- Right to object — to specific uses of your data, including direct communications.
- Right to withdraw consent — for anything you opted into: newsletter, optional analytics.
If you are in the EU or UK, the General Data Protection Regulation gives you the additional right to lodge a complaint with your national supervisory authority. Our legal bases for processing personal data are:
- Contract performance — processing necessary to deliver an engagement you requested.
- Legitimate interest — site analytics, security monitoring, and improving the Arsenal tools.
- Consent — newsletter subscription and optional analytics cookies.
- Legal obligation — tax records and compliance requirements.
- Right to know what personal information we collect, use, and disclose.
- Right to opt out of the sale of personal information — we do not sell data, so there is nothing to opt out of.
- Right to non-discrimination for exercising any of your privacy rights.
Email privacy@logicleak.io with your name and the right you wish to exercise. We respond within 30 days. For GDPR requests, we may ask you to verify your identity before disclosing any data.
Engagement materials retention is governed by our Engagement Terms.
Our primary infrastructure runs in the EU (Supabase Frankfurt; Vercel's primary region). Some requests are served by Vercel's global edge network, which may result in transient processing outside the EEA. We do not intentionally route EU personal data to non-EEA regions for storage or processing.
// TRANSFER MECHANISMS- EU Standard Contractual Clauses (SCCs) are in place with all subprocessors that may process EU personal data.
- UK International Data Transfer Agreements (IDTAs) cover UK-origin data where applicable.
- All subprocessor regions are listed in the table above.
For any privacy question, right request, or concern, email privacy@logicleak.io. Include your name and the nature of your request so we can locate the relevant data efficiently. We respond within 30 days; formal data subject requests under GDPR or CCPA receive a response within the applicable statutory period.
// DATA CONTROLLERLogicLeak (trading name). For GDPR purposes, LogicLeak is the data controller for personal data collected via this website.
// DATA PROTECTION CONTACTWe do not have a formally designated Data Protection Officer — our processing volume does not trigger the GDPR Article 37 DPO requirement. All privacy queries are handled at privacy@logicleak.io.
We track substantive changes below. Minor edits — typos, formatting — are not logged.