Vornin
Start free

Privacy Policy

Updated · 2026.10.02 · Revision 1.2

1. Information we collect

We collect information you provide when creating an account (email address, display name), scan targets you configure, and vulnerability data discovered during scans. We also collect usage data such as login times, IP addresses, and feature usage for security and analytics purposes.

2. How we use your information

We use your information to:

  • Provide and maintain the vulnerability management service
  • Send scan results, alerts, and notifications you've configured
  • Improve our scanning engines and platform features
  • Ensure platform security and prevent abuse

3. Data storage & security

All data is stored in PostgreSQL databases. Sensitive fields (API tokens, credentials) are encrypted at rest using AES-256-GCM. All connections use TLS 1.2+. We keep an audit log of security-relevant actions, and finding history is tamper-evident (hash-chained, verified daily).

4. Multi-tenancy & isolation

Each customer's data is isolated at the database level using row-level tenant filtering. No customer can access another customer's scan results, vulnerability data, or configuration.

5. Data retention

Scan results and resolved vulnerabilities use retention assigned by your plan: Free 30 days, Team 90 days, Business 365 days and Scale 2,555 days. Retention is not customer-configurable. A reduction has a 30-day grace period before older eligible records are removed. Selected redacted source excerpts remain as finding evidence under this policy; working repository checkouts are removed after scanning.

6. Your rights (GDPR)

You have the right to:

  • Access: Export all your data at any time via the platform
  • Rectification: Update your profile information
  • Erasure: Request complete account and data deletion
  • Portability: Export data in machine-readable JSON format

7. Cookies

7a. Inside the authenticated application (app.vornin.com)

Strictly-necessary cookies only: authentication, session continuity, and CSRF protection. No tracking, no advertising, no analytics that identify individual users.

7b. On the public marketing site (vornin.com)

The marketing site uses the following third-party services, all listed on /sub-processors:

  • Cookiebot (Cybot A/S, DK): Consent management platform. Stores an anonymous consent identifier in browser local storage to remember your choices on this site. Setting required to comply with ePrivacy / TTDSG, and the consent captured here is also the GDPR Art. 6(1)(a) legal basis for the analytics/advertising processors listed below.
  • Google Analytics 4 (Google LLC, US, SCCs): We use GA4 for aggregate visitor analytics on this marketing site only, never inside the app. It starts with analytics and advertising storage switched off under Google Consent Mode v2, and analytics storage only turns on once you accept statistics cookies. Even before that, Google can still send cookieless measurement pings. GA4's requests run through our own EU-hosted tagging server, and we never pass on your name, email, or anything else that identifies you directly.
  • Google Ads (Google LLC, US, SCCs): We use Google Ads for retargeting and conversion measurement, again on this marketing site only and never inside the app. Advertising storage stays off until you accept marketing cookies, under the same Consent Mode v2 setup. Before consent, Google may still send cookieless requests, some of them straight to Google rather than through us. Conversions also pass server-to-server from our EU-hosted tagging server, and as with analytics, we never share your name, email, or other directly identifying details.
  • LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company / Microsoft, IE): Retargeting and conversion measurement on the public marketing site only, never on the authenticated app. Loads only after you accept marketing cookies, enforced by Google Consent Mode v2. We never share your name, email, or other directly identifying details; conversion events are additionally relayed server-to-server from our own EU-hosted tagging server.
  • Reddit Pixel (Reddit, Inc., US, SCCs): Retargeting and conversion measurement on the public marketing site only, never on the authenticated app. Loads only after you accept marketing cookies, enforced by Google Consent Mode v2. We never share your name, email, or other directly identifying details; conversion events are additionally relayed server-to-server from our own EU-hosted tagging server.
  • Cloudflare Turnstile (Cloudflare, US, SCCs): Bot-detection challenge on the contact form. Sets a short-lived challenge cookie scoped to the contact submission.

Full per-cookie details (purpose, retention, type) are published via the Cookie Declaration accessible from the consent banner.

8. Data Protection contact

Vornin has not formally appointed a Data Protection Officer (we fall below the GDPR threshold for mandatory appointment: no systematic monitoring of data subjects on a large scale, and core activities do not consist of large-scale processing of special categories of data). However, all data-protection matters go to a single accountable person:

  • Mathias Gatz: Founder and Data Protection contact
  • Email: privacy@vornin.com
  • Postal: Denmark (full address available on written request)

For general privacy-related inquiries and data-subject requests: privacy@vornin.com.

You also have the right to lodge a complaint with the Danish Data Protection Authority (Datatilsynet).