Privacy Policy

Effective 27 August 2026.

This policy covers the personal data we hold about you across Default RED™ — your account, anything you buy from us, the email we send you, and our public websites.

It is written to be read. Where something is unflattering — a place we keep data longer than you might expect, a control we have not built yet — it says so.

1. Who we are

Defaultred Systems (OPC) Pvt. Ltd. is the data fiduciary under India’s Digital Personal Data Protection Act, 2023, and the data controller under the EU and UK GDPR, for everything described here.

legal@defaultred.com is the address for every question, request and complaint about your personal data, and it is our grievance contact under section 13 of the DPDP Act. How to use it is on Making a privacy request.

2. What this policy covers

It covers you if you hold a Default RED account, buy something from us, receive our email, advertise with us, apply to a program of ours, or simply read one of our websites.

Where an organisation is using Default RED, this policy still covers you. The organisation decides what work is done and what data goes into the product; we remain responsible for the personal data attached to your own account.

It does not cover the target systems you test. When you run our products against a system, whatever they collect from that system is yours, held for you under the terms of that product. We are not the controller of it, and this policy is not the document that governs it.

It does not cover other people’s websites, including the ones our pages link to and the ones our advertisers send you to.

3. What we collect, and why

What you give us

To have an account. Your email address and a password. The password is stored only as a cryptographic hash by our authentication provider; nobody at Default RED can read it.

Your profile, most of which is optional. Full name, display name, avatar image, date of birth, gender and pronouns, a recovery email address, a phone number, your country, region, city and postal code, and your preferred language, timezone and display currency. Only the country matters to anything outside your own experience of the product — it decides what we can lawfully sell you and what tax applies.

To bill an organisation. Billing name, billing email, billing address, and — in India — GSTIN, PAN and place of supply. We need these to issue a valid tax invoice.

Where a product requires you to prove who you are. Identity documents and the details on them, and for an organisation, registration details and supporting documents. Only some products ask for this, and only when the product’s own terms say why.

If you nominate someone. Under section 14 of the DPDP Act you may nominate a person to exercise your rights if you die or become incapable of exercising them yourself. If you do, we hold their name and their email address or phone number.

When you contact us. Whatever is in your message, and the address it came from.

Whatever you put into the products. Your configurations, your scopes, your findings, your uploads. That is your content, and section 11 of the Terms says what we may do with it.

What using Default RED produces

Sign-in and security events. Each sign-in, sign-out, password change, and failed attempt: when it happened, whether it succeeded, the IP address, the browser and device it came from, the sign-in method used, and an approximate location worked out from the IP address. We use this to show you your own account activity, to alert you to something you did not do, and to stop people breaking into accounts.

Your devices. For each device that has signed in: a name, the device type, operating system, browser, app version, when it was first and last seen, and its last IP address and approximate location. This is what lets you look at the list and sign out something you do not recognise.

A record of what you consented to. For each purpose: whether you granted or withdrew it, when, how you were asked, which version of this policy was current at the time, and the IP address and browser you did it from. Those last two are there because a consent record that cannot be tied to an event is not evidence of anything, and the point of the record is to be able to show you what you agreed to.

A record of each service you signed up to. Which service, which version of that service’s agreement, a cryptographic digest of the exact wording you were shown, and when you accepted it. This record is append-only: it can be added to and marked withdrawn, and it cannot be edited or deleted while your account exists. See section 5.

What you bought. Subscriptions, invoices and their line items, payment references, and the tax details that were used to raise the invoice.

Advertising signals, where you have turned personalisation on: the topics associated with your account, the advertisers you have blocked, and your ad settings. Your ad settings themselves are stored whether or not personalisation is on, because “off” is a setting we have to remember.

What we do not collect

Your card number. Payments go to our payment provider and the card details go with them. What comes back to us is a reference, the amount, and whether it worked.

Analytics or advertising trackers on our websites. We do not run any third-party analytics or advertising tag on our public sites. Product analytics inside the product is a consent you have to give, and it is off unless you turn it on.

Special category data, deliberately. We do not ask for your health, religion, politics, biometrics or sexual orientation, and we do not want them. Gender and pronouns on your profile are optional and are there so we address you correctly.

Why we are allowed to

Under the GDPR, each thing above rests on one of these:

Under the DPDP Act, the processing above is on the basis of your consent, or of the legitimate uses that Act recognises — including the purpose for which you voluntarily gave us the data, and our compliance with Indian law.

Where the basis is consent, you can withdraw it, from your account or by writing to us, and withdrawing is as easy as giving it was. Withdrawing does not undo processing that already happened lawfully, and it does not affect the things we do on one of the other bases — which is why withdrawing marketing consent does not stop your invoices arriving.

4. Who we share it with

We do not sell your personal data. Not to advertisers, not to data brokers, not to anyone.

Companies that process it for us

These are processors: they act on our instructions, under contract, and they may not use your data for their own purposes.

We add to this list as we build. When a new processor starts handling personal data, this table changes with the deployment that introduces it.

Other people who may see it

Organisations you belong to. Their owners and administrators see your membership, what you did with organisation resources, and what was bought and spent. Joining an organisation is what causes this; your personal profile and your other memberships are not exposed by it.

Advertisers and partners, only if you have consented. With ad personalisation on, advertising is chosen using the topics associated with your account. Advertisers are told which slots their ads filled and how they performed. They are not told who you are.

Anyone the law requires. Courts, regulators, tax authorities and law enforcement, where a request is valid and binding on us. We check that it is, we give the minimum that answers it, and we tell you unless we are prohibited from doing so.

A buyer of the business, if we are ever acquired, merged or reorganised. If that happens, your data moves with the relationship and this policy — or one no less protective — continues to apply, and we will tell you.

Our professional advisers, where they need it: accountants, auditors and lawyers, all under a duty of confidence.

5. How long we keep things

When you close your account, we delete your profile, your devices, your activity history, your ad settings and your content, and we remove your identifying details from anything we must keep. What survives is in the table above: the financial record, and the record of what you consented to.

6. Where in the world it is

We are an Indian company, and we are subject to Indian law wherever the data sits.

Our infrastructure and database providers are United States companies and process data in their own regions, so your personal data is transferred outside India and, if you are in Europe, outside the EEA and the UK.

For transfers out of the EEA and the UK we rely on the European Commission’s Standard Contractual Clauses and the UK Addendum in our contracts with those providers. India’s DPDP Act permits transfers except to countries the Government restricts; we do not transfer to any restricted country.

You can ask us for the detail of the safeguards for any particular transfer.

7. Cookies, storage and the third parties on our pages

We are sparing with this, and there is no cookie banner because there is nothing on our public sites that needs one.

What we store in your browser.

• Your signed-in session, held in the browser storage of the site you signed in on. It is what keeps you signed in, and it is deleted when you sign out.
• Small preference values, such as your chosen country or theme.

Both are strictly necessary for the site to work as you asked it to, and neither is used to track you.

Third-party code on our pages. Three things load from somewhere other than us, and each one means the company behind it can see your IP address and which page you were on:

• the anti-bot challenge on sign-in, registration and password reset, which is what stops those forms being attacked at scale;
• the service status widget in our footers;
• web fonts on some pages.

We do not use advertising cookies or cross-site tracking, on our sites or anyone else’s. Ad personalisation, where you turn it on, uses what is on your own account — not a profile stitched together from where else you have been.

8. Your rights

These apply to you now. Some of the self-service controls in your account are still being built; where one is missing, writing to legal@defaultred.com gets you the same result, and that is a fallback for all of them rather than a queue for the ones we have not finished.

What we cannot do. We cannot delete what the law requires us to keep — the financial records in section 5, principally. An erasure request removes everything else and strips the record down to what the obligation actually needs.

9. Making a request, and complaining

Write to legal@defaultred.com. Making a privacy request sets out what to put in the message and what happens next.

We answer within 30 days. If a request is complicated enough to need longer, we will tell you inside those 30 days, why, and when to expect an answer.

We will check who you are before acting on a request, proportionately to what is being asked — a copy of your data needs more certainty than a correction to your display name. That check is not a delaying tactic, and if it feels like one, say so.

Exercising a right is free. If a request is genuinely repetitive or excessive we may charge a reasonable fee or decline it, and we will explain which and why.

If you are not satisfied with our answer, you can complain:

• In India — to the Data Protection Board of India, once it is constituted and accepting complaints. Under the DPDP Act you must raise the grievance with us first, so start at the address above.
• In the EEA — to the supervisory authority in the country you live or work in, or where the problem happened.
• In the UK — to the Information Commissioner’s Office.

We would rather you gave us the chance to fix it, but nothing here requires you to.

10. Children

Default RED is for adults. You must be 18 or older to hold an account, and we do not knowingly collect personal data from anyone younger.

If we learn that an account belongs to someone under 18, we close it and delete the data. If you believe a child has given us personal data, write to legal@defaultred.com and we will deal with it.

11. How we protect it

Access to your account is protected by a password we never see in plain text, an anti-bot challenge on the forms that accept it, and optional additional protections you can turn on. Sign-ins and devices are recorded so that you can see them and we can act on what looks wrong.

Inside our systems, access to personal data is restricted at the database itself rather than only in the applications that read it, and the operations that could rewrite a consent record or a signup record are blocked for everyone, including us.

None of this is a guarantee. No system is perfectly secure, and anyone who tells you otherwise is selling something. If a breach happens that puts you at risk, we will tell you and the relevant regulators as the law requires, and we will tell you what we actually know rather than what sounds best.

If you have found a vulnerability in our systems, we want to hear about it — our own program is the place to report it.

12. Changes to this policy

We will update this policy as what we do changes.

Where a change materially affects you, we will tell you before it takes effect — by email, or in the product — and where the change means we need consent we did not have, we will ask for it rather than assume it. Smaller changes take effect when published.

Every consent we record stores the version of this policy that was current when you gave it, so it is always possible to say which text you were shown. The date at the foot of this page is when it last changed in substance.