ArrankaGo Consulting
← Back to home

Privacy Policy

Last updated: 2 September 2026

This Privacy Policy explains what the ArrankaGo Consulting website and online security tools (the “Service”), operated by ArrankaGo Consulting, a division of ArrankaGo LLC (Delaware, USA), do with data. It applies to the Service and forms part of our Terms of Service. The short version: we store as little as possible, we do not sell data, and we never fabricate results. For the purposes of the EU and UK GDPR, ArrankaGo LLC is the data controller for personal data processed through the Service.

1. What we collect and process

We keep data collection deliberately minimal. We process:

  • The domain, host, or address you submit. Sent to our server and to the third-party sources listed in Section 3 to build your report. Submit only Targets you are authorised to assess. Do not enter personal data in the domain field.
  • Minimal usage and technical data. Your IP address is used in memory for rate limiting (to prevent abuse) and appears in standard server logs; basic request metadata (such as timestamp and requested endpoint) may be logged for security and reliability. This data is not linked to an advertising profile and is not sold.
  • Account and billing data for Paid Plans. When you buy a subscription or Investigation, our payment processor (Stripe) provides us the minimum needed to fulfil the order, such as your email address, the product purchased, and payment status. We never receive or store your full card number; card details are handled entirely by Stripe.
  • Correspondence. If you email us or engage us for an Investigation, we process the content of that correspondence to respond and to perform the engagement.
  • A language preference. Stored locally in your browser (localStorage) so the site remembers your choice. It never leaves your device.

2. How scans are handled

When you run a free-tier scan, the domain and the results are processed to build your report and are not persisted in a database afterwards. There are no accounts and no saved scan history in the free tier. Reload the page and the scan is gone. Transient processing and standard security logs (Section 1) are the only records that may briefly exist.

3. Third parties and subprocessors

We rely on a small set of service providers and intelligence sources. Each has its own privacy practices.

  • Infrastructure and delivery. Vercel hosts and serves the Service and processes standard request data on our behalf.
  • Payments. Stripe processes payments and card data as an independent processor and, for card data, as the party that handles it directly.
  • Email. Resend is used to send transactional email (for example order and account messages) where applicable.
  • Intelligence sources queried to build a report. Depending on which integrations are configured, our server may query Have I Been Pwned, XposedOrNot, Shodan, VirusTotal, AlienVault OTX, urlscan.io, the National Vulnerability Database (NVD), abuse.ch resources, and public Certificate Transparency logs (crt.sh). The domain, and for some sources its resolved IP address, is sent to these providers so they can return signals. Where an integration is not configured, no request is made and we show an honest “connect this source” state.

We do not sell personal data and we do not share it for cross-context behavioural advertising. We do not use advertising cookies or third-party advertising trackers.

4. Legal bases for processing (GDPR)

Where the GDPR applies, we rely on: legitimate interests (to operate, secure, and improve the Service, including rate limiting and abuse prevention); performance of a contract (to provide Paid Plans and Investigations you request); consent where we ask for it; and legal obligation (for example to keep records required by law). You may object to processing based on legitimate interests as described in Section 7.

5. Sensitive-input tools

Tools that would otherwise take a file or a tenant (for example malware triage or identity tooling) run in the online Service only on our own bundled, inert sample data. We do not ask you to upload files or credentials in the online demos, and they do not transmit your files anywhere.

6. Retention

We retain data only as long as needed for the purpose it was collected. Free-tier scan inputs and results are not persisted after the report is built. Security and server logs are kept for a limited period for security and reliability and then deleted or aggregated. Billing and Investigation records are kept as long as needed to provide the Service and to meet legal, tax, and accounting obligations, after which they are deleted or anonymised.

7. Your rights

Depending on where you live, you may have rights over your personal data. Under the GDPR, these include access, rectification, erasure, restriction, portability, and objection to certain processing, as well as the right to withdraw consent and to complain to your supervisory authority. Under the California CCPA/CPRA, these include the right to know, to delete, and to correct personal information, and the right to opt out of the sale or sharing of personal information: we do not sell or share personal information, so there is nothing to opt out of, and we will not discriminate against you for exercising any right.

Because we keep so little, there is normally nothing to export or delete for a free-tier scan. For billing records or Investigation correspondence, contact us and we will verify your request and respond within the time required by applicable law. You may exercise any right by emailing us at the address in Section 12.

8. International data transfers

We operate from the United States and our providers may process data in the United States and elsewhere. If you are in the European Economic Area, the United Kingdom, or another region with data-transfer rules, your data may be transferred to countries whose laws differ from yours. Where required, such transfers rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses used by our providers. By using the Service you understand that this transfer takes place as described in our Terms of Service.

9. Security

We use reasonable technical and organisational measures appropriate to the low volume and sensitivity of the data we handle, including transport encryption (HTTPS), minimisation, and rate limiting. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, and we do not claim any security certification (such as SOC 2 or ISO 27001) for the Service.

10. Cookies and local storage

We do not use advertising or cross-site tracking cookies. We use browser local storage for a small number of functional preferences, such as your language choice, which stays on your device. Any strictly necessary cookies used to operate the site are limited to that purpose.

11. Children

The Service is a business-to-business tool intended for adults and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact us and we will delete it.

12. Contact and changes

For privacy questions or to exercise a right, contact our privacy contact (acting as our data protection point of contact) at earbona@arrankago.com. We may update this Policy; material changes will be reflected by the “last updated” date above and, where required, by additional notice.