Privacy Policy

1. Who is responsible for your data?

Bounty Security S.L., Spain, tax identification number (NIF) ESB10736189, is the controller for the customer, website, licensing and business-contact data described in this policy. Contact us at contact@bountysecurity.ai.

Registered office:  Calle Gayano lluch, 28, 0 Valencia, 46028, Spain

For assessment data processed in your own scanning environment, your organization, client or other responsible party determines the relevant purposes and responsibilities. Purchasing our software does not automatically appoint us as the processor of everything you scan. If support or another agreed service requires us to process personal data on your behalf, the appropriate data-processing terms must be established for that service.

2. Information we collect and its sources

• Contact and business details: name, email, organization, billing address, tax details and telephone number where provided. We receive these from you, your organization's purchaser or representative, and our commerce services.
• Order and subscription records: products, plans, purchases, renewals, cancellations, invoices, payment status and references, refunds, license delivery and download activity. Payment services process payment credentials; we receive transaction information and limited payment-method details where supplied.
• License and device information: license identifiers, product entitlement, activation records, device or hardware identifiers, IP address and technical information associated with validation and updates.
• Website activity: IP address, browser and device information, referring pages, pages viewed, cookie or similar identifiers, interactions and approximate location derived from technical information. Analytics, session replay and advertising features collect additional usage information as described below.
• Communications and preferences: enquiries, support correspondence, feedback, consent records, marketing preferences and email interaction information where the relevant tracking is enabled lawfully.
• Material you submit for support: screenshots, logs, configuration, profiles or traffic samples. These can contain personal data, credentials or confidential client information. Remove information that is not needed for the support request.

We also receive relevant status and interaction information from payment, licensing, delivery, marketing and advertising providers. We do not need you to submit special-category personal data for an ordinary purchase or support request. Avoid sending such information unless a specific, appropriate arrangement has been made.

3. Purposes and legal bases

Where the GDPR or equivalent rules apply, the legal basis depends on the particular activity:

Orders, subscriptions, delivery and requested assistance

We use contact, purchase and communication information to respond to your requests, provide purchases, handle renewals and deliver support. The basis is performing a contract with you or taking requested steps before a contract. For employees and representatives of an organizational customer, our legitimate interest is managing that business relationship.

Licensing, access and updates

We process entitlement and device information to activate and validate licensed access and deliver eligible updates. The basis is contract performance, or our legitimate interest in providing the organization's purchased service. Preventing license misuse and investigating suspicious activity also serve our legitimate interests in protecting the service.

Accounting and legal obligations

We process invoices, payment and related records to meet applicable tax, accounting and other legal obligations. Protecting legal rights and handling disputes may also rely on our legitimate interests.

Service security and reliability

Relevant technical records and support information help us investigate errors, prevent fraud and protect accounts and services. Our legitimate interests are maintaining a reliable service and preventing misuse, balanced against your rights.

Optional analytics, advertising and marketing

Consent is the basis where required for optional tracking, session replay, personalized advertising and marketing communications. Where the limited existing-customer exception in section 8 applies, the basis is our legitimate interest in informing customers about our own similar products and services, subject to their right to object.

Privacy choices and requests

We process preference records and necessary request information to respect your choices and comply with data-protection obligations.

Information marked as required during checkout or activation is needed to provide the requested service or meet legal obligations. Without it, we may be unable to complete the purchase or activation. Optional marketing consent is not a condition of purchasing a license.

4. License validation and software updates

Pro and Server use LicenseSpring for license management. Activation, validation and related operations transmit license and product identifiers and a device or hardware identifier. The licensing service also receives connection information such as an IP address. Technical metadata can include application version, platform and device information according to the operation and integration.

These records help associate activations with entitlements, enforce activation limits, resolve activation issues and deliver updates. Hardware identifiers are not necessarily anonymous: they may be linked to a license holder. Update and download services can also receive information such as the selected release, platform, channel and download activity.

License checks are distinct from vulnerability results. Normal license validation does not require uploading the contents of your scan requests, responses or findings. An automated entitlement check can restrict licensed functionality; contact support if you believe a restriction is incorrect.

5. Scanning, local storage and optional AI

Burp Bounty Pro

Local scanning processes traffic in your Burp environment. Connecting Pro to Server sends assessment data to the server you configure. Pro can retain preferences, license information, server connections and optional AI settings outside the JAR so they survive updates. Protect that storage and your Burp projects, especially where they contain credentials or API keys.

Burp Bounty Server

Server processes requests, profiles, responses and findings on your chosen computer, server or VPS. Authorized REST and MCP clients can retrieve results. Logs and retained findings may contain personal data and secrets. Storage depends on request options, retention settings and capacity limits; it is not a permanent archive of every request.

AI providers and agents

Optional AI features and connected agents can send selected traffic, findings, prompts and other context to the provider or endpoint configured in that workflow. This can include cookies, tokens, personal data and confidential information within the selected content. Review what is shared and the provider's terms, retention, training-use settings and processing locations. Connecting an AI service does not make it a Bounty Security-operated service.

Targets, callbacks and support

Scans necessarily send traffic to the selected targets. Profiles and integrations can also contact configured callback, blind-detection or other external endpoints. Bounty Security receives assessment material if you choose to send it to us, for example for support. Only submit material you are authorized to disclose.

You or your organization manage access, retention, backups and deletion in these environments. A request to delete your store account does not delete files on your computers, your Server instances or your chosen AI provider. For personal data controlled by your employer or a client, contact that controller.

6. Providers and other recipients

We use the following providers or categories of providers for the functions described. Access depends on the service involved; not every provider receives every category of information.

• Shopify: store hosting, checkout, customer and order management, and related commerce services. Shopify processes some data on our behalf and may act as a separate controller for its own services. See Shopify's consumer privacy policy.
• Shopify Payments, Stripe and PayPal: payment processing, payment status, fraud prevention and related financial obligations, according to the payment method used. See Stripe's privacy policy and PayPal's privacy statement.
• Subscription and digital-delivery services: managing recurring orders, supplying download access, delivering license information and sending service notifications. These providers receive the customer and order information needed for their role.
• LicenseSpring: licensing and activation management, operated by Cense Data Inc. See the LicenseSpring privacy policy.
• ActiveCampaign: managing marketing contacts, preferences and communications, including interaction measurement where enabled lawfully. See the ActiveCampaign privacy policy.
• Google Analytics and Google Ads: website measurement, campaign performance and advertising. See Google's privacy policy.
• Microsoft Clarity and Microsoft Advertising: website interaction analysis, heatmaps, session replay, campaign measurement and advertising. See the Microsoft privacy statement.
• Meta and X: advertising audiences, campaign delivery and measurement through the integrations used on our website and campaigns. See Meta's privacy policy and X's privacy policy.
• Consent-management, email and business-support providers: recording privacy choices, handling correspondence, maintaining services and supporting accounting or legal work.

Some providers act on our instructions; others process certain information for their own purposes under their notices. A provider's notice does not replace our responsibility for our own processing. We may also disclose relevant information to advisers or competent authorities where required by law or necessary to establish, exercise or defend legal claims.

If our business is reorganized or transferred, relevant records may be disclosed subject to confidentiality, appropriate safeguards and the requirements of applicable law. We will provide any notice required for a change in controller or purpose.

7. Cookies, analytics and advertising

Our website uses cookies, pixels and similar technologies for essential commerce and security functions, remembering preferences, analytics and advertising. Session replay can capture how visitors navigate pages, click and scroll. Google Analytics helps measure website use; Clarity helps understand interactions and usability; advertising integrations help measure campaigns and reach relevant audiences.

Depending on the enabled integration and your choices, providers may receive identifiers, device and browser information, pages and events viewed, referral information and purchase or conversion events. They may associate this information with other data they hold. Clarity and Microsoft Advertising use interaction data for site improvement, measurement and advertising under Microsoft's privacy statement.

Where prior consent is required, optional tracking must remain disabled until you consent. Necessary technologies used to provide a service you request can be exempt. Merely visiting the website, continuing to browse or accepting purchase terms is not consent to optional tracking.

You can use the site's privacy or cookie controls to make or change your choices. Browser settings provide additional controls but do not replace the site's consent mechanism. Withdrawing consent does not affect processing that was lawful before withdrawal, and rejecting optional tracking does not prevent ordinary shopping. Please contact us if the controls are unavailable or do not reflect your choices.

Our Cookie Policy provides the accompanying cookie information. Consent to website tracking is separate from configuring an AI provider or sending traffic through a scanner.

8. Service messages and marketing choices

We send necessary messages about purchases, license delivery, renewals, security, support and access to purchased downloads. Unsubscribing from promotional email does not stop essential messages about a service you have purchased.

Promotional email requires consent where applicable. Where local law permits the existing-customer exception, we may use contact details obtained during a sale to promote our own similar products or services, with a clear opportunity to opt out when collected and in each message. This exception does not authorize unrelated marketing or optional tracking without any required consent.

You can unsubscribe using the link in a marketing email or contact us. We may keep a minimal suppression record to respect your choice. Marketing messages may use engagement measurement, such as link clicks or tracking pixels, where enabled and permitted; applicable consent requirements also apply to that measurement.

9. How long we keep information

Retention depends on the purpose, the service and applicable legal requirements. The criteria are:

• Orders, invoices and payment records: for the customer relationship and the applicable tax, accounting, dispute and legal-retention periods.
• Licenses and activations: while needed to administer the entitlement, handle renewals and activation issues, prevent misuse and meet applicable legal or claims-related requirements.
• Support enquiries and submitted samples: while needed to resolve the matter and retain a proportionate record of assistance or related claims. Unnecessary credentials and assessment material should not be retained with routine support records.
• Marketing information: while the relevant permission or other lawful basis remains valid, followed where necessary by a limited record of withdrawal or objection.
• Analytics, replay, advertising and technical records: according to the service's configured retention period and the time reasonably needed for its stated purpose. Cookie expiry is not necessarily the same as deletion of data already received by a provider.
• Privacy-request and consent records: as needed to handle requests, demonstrate compliance and respect choices.

Information may need to be retained longer for a specific legal obligation or dispute, with use limited accordingly. Data held by payment or other providers as separate controllers follows their own retention obligations. Locally stored scanner data and customer-operated Server history follow your configuration and administration rather than our store retention.

10. International processing and transfers

Our providers and their authorized service providers operate internationally. Depending on the service, data may be processed outside your country, including in the United States, Canada and other locations described in provider documentation.

Transfers of personal data from the EEA or another protected jurisdiction must have an applicable legal mechanism. Depending on the recipient and transfer, this can be a relevant adequacy decision or appropriate contractual safeguards, such as the European Commission's Standard Contractual Clauses, together with additional measures where necessary. UK transfers require the relevant UK arrangements.

Accepting this policy is not a substitute for a lawful transfer mechanism. Contact us for information about the safeguards applicable to a particular transfer and how to obtain a copy, subject to necessary protection of confidential information. The processing locations of AI services you configure must be assessed separately for that workflow.

11. Security

We use organizational and technical measures appropriate to the information and risks involved. No online service or storage system can be guaranteed completely secure. Contact us promptly if you believe information associated with your account or license has been exposed.

Protect license keys, server access, target credentials, API keys, local configuration and backups. Using a locally installed scanner does not itself encrypt all saved information or make a publicly reachable server private. Do not include unnecessary secrets in support messages, URLs, screenshots or AI prompts.

12. Your rights and how to exercise them

Subject to applicable law and its conditions, you may request access to your personal data, correction, erasure, restriction of processing and portability. You may object to processing based on legitimate interests, and you have an unconditional right to object to direct marketing, including related profiling.

Where processing depends on consent, you can withdraw it without affecting earlier lawful processing. Applicable protections for solely automated decisions producing legal or similarly significant effects also remain available.

Send requests to contact@bountysecurity.ai. We may request proportionate information to establish your identity or authority where necessary. Do not send identity documents or sensitive data unless requested through an appropriate channel. A representative may act on your behalf subject to applicable requirements.

Under the GDPR, we respond without undue delay and within one month. Where permitted because of complexity or the number of requests, this can be extended by two additional months, with notice and reasons within the initial month. Requests are generally free; statutory exceptions and lawful retention requirements can apply.

You may complain to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority, including the authority in your place of habitual residence, work or alleged infringement. You do not have to contact us before complaining to an authority.

13. California residents

Where the CCPA applies, eligible California residents have rights to know, delete and correct personal information, opt out of sale or sharing, limit qualifying uses of sensitive information, and receive non-discriminatory treatment for exercising their rights.

Advertising disclosures can constitute "sharing" for cross-context behavioral advertising, even without payment. Sections 2, 3 and 6 describe information, sources, purposes and recipients. Contact contact@bountysecurity.ai to exercise rights, including through an authorized agent. Sale or sharing opt-outs do not require creating an account or verifying identity, although limited information may be needed to identify the relevant data.

Covered requests to know, delete or correct generally receive a response within 45 days, with a notified extension where permitted. Sale or sharing opt-outs must be handled as soon as feasible and within 15 business days. Applicable businesses must also honor qualifying opt-out preference signals, including Global Privacy Control.

14. Children

Our commercial products and subscriptions are intended for adults conducting professional or authorized security work. They are not directed at children. If you believe a child has supplied personal information to us, contact us so we can assess the situation and remove information where required.

15. Other services and changes to this policy

Third-party websites, payment services, social platforms, infrastructure and AI providers have their own notices and responsibilities. Links to them do not make all their processing part of our service.

We may update this policy to reflect changes in our services or legal obligations. We will update the date and provide additional notice where required. A change of policy does not retroactively supply consent for a new purpose; we will obtain consent or establish another appropriate basis where required.

16. Contact us

For privacy questions, requests or concerns, contact Bounty Security S.L. at contact@bountysecurity.ai. Include enough information to identify the relevant interaction, order or service, but avoid sending full license keys, passwords or assessment evidence unless needed and specifically requested.