Privacy Policy

We collect personal and technical information necessary to respond to your inquiries, schedule discovery consultations, and deliver authorized cybersecurity engagements. This includes: (a) Contact Information: Full name, business email address, personal email, and Phone Number provided via contact forms, scoping requests, or direct communications; (b) Message & Inquiry Content: Project details, architectural descriptions, scoping requirements, problem statements, and questions submitted via our contact, assessment, and WhatsApp channels; (c) Account & Credentials: User name, email, encrypted password hash, and company name when accessing our client portal; (d) Technical Engagement Data: Authorized target host IP addresses, CIDR blocks, API documentation, domain names, and cryptographic keys necessary to execute penetration tests; (e) Recruitment Data: Resumes, portfolios, contact phone numbers, and career history for job applicants. We do not sell, rent, or monetize personal data or telemetry.

We utilize collected phone numbers, email addresses, and message contents to: (a) Directly communicate with you regarding your inquiry, quote request, or security concerns; (b) Verify organizational authorization before initiating intrusive security assessments; (c) Coordinate findings debriefs, executive presentations, and re-testing schedules; (d) Deliver critical security alerts and incident notifications; (e) Comply with legal obligations under applicable cybersecurity and data protection legislation.

As an elite cybersecurity firm, we hold ourselves to rigorous defense-in-depth standards. All web traffic, form transmissions, and telemetry are secured via TLS 1.3 encryption in transit. Data at rest (including contact inquiries, reports, and database records) is protected with AES-256 encryption. Access to customer contact details and assessment artifacts is restricted via Zero-Trust least-privilege role-based access control (RBAC).

We practice strict data minimization and enforce automated lifecycle retention periods: (a) Contact Inquiries & Leads (Name, Phone, Email, Message): Retained for up to 2 years from last contact for active business relationship management, after which they are permanently deleted; (b) Assessment Raw Telemetry & Proof-of-Concept Exploits: Securely wiped within 30 days of the final re-test verification window; (c) Final Executive Audit Reports: Retained for 3 years to support client compliance and warranty audits, accessible only to designated client admins; (d) Career Applications: Purged after 12 months unless applicant consents to future pool consideration.

Aritaro does not outsource penetration testing executions to unvetted third parties. We utilize vetted, contractually bound cloud infrastructure and service vendors (including AWS, Vercel, MongoDB Atlas, and transactional email providers) operating under signed Data Processing Agreements (DPAs) with strict confidentiality and security clauses. We never disclose findings or client records to regulatory bodies or external parties without explicit, written customer directive, except where strictly mandated by statutory cyber law (such as CERT-In incident reporting frameworks).

Under India’s Digital Personal Data Protection Act (DPDPA 2023), GDPR, and applicable privacy regulations, you possess full rights to: (a) Access: Request a copy of all personal data (including phone, email, and messages) we hold about you; (b) Correction: Request updates to inaccurate or incomplete contact records; (c) Erasure ("Right to be Forgotten"): Request permanent deletion of your phone number, messages, and contact records from our active databases; (d) Grievance Redressal: Lodge an inquiry with our designated Data Protection Officer. All requests are processed within 15 business days free of charge.

Our platform uses strictly necessary HttpOnly, Secure, and SameSite session tokens to authenticate clients and protect against cross-site scripting (XSS) and cross-site request forgery (CSRF). We do not deploy third-party advertising tracking pixels or commercial marketing trackers.

For data privacy queries, data subject access requests (DSAR), or compliance verification, contact our Data Protection and Grievance Officer directly at privacy@aritaro.com or via postal correspondence to Aritaro, Corporate Security & Legal Compliance Division.