Privacy Policy

This Privacy Policy explains how Techfunder World AG ("KENSAI", "we", "us", or "our") collects, uses, stores, and protects your personal data when you use our website at kensai.app, our security scanning platform, APIs, and related services (collectively, the "Services").

This policy applies to all personal data processed through:

• The KENSAI website (kensai.app)
• The KENSAI security scanning platform and dashboard
• Our REST API and integrations
• Automated and on-demand security scans
• Email communications and support channels

It does not apply to third-party websites linked from our Services. We encourage you to review the privacy policies of any third-party services you interact with.

We process your personal data based on the following legal grounds:

We use the data we collect to:

• Provide, operate, and maintain our security scanning services
• Generate vulnerability reports and remediation recommendations
• Process transactions and send billing-related communications
• Improve and optimize the platform based on usage patterns
• Conduct anonymized security research to improve detection capabilities
• Send service-related notifications (scan completions, critical findings, scheduled maintenance)
• Send marketing communications (only with your explicit consent)
• Respond to support requests and inquiries
• Detect, prevent, and address technical issues and abuse

We do not sell your personal data. We share data only with the following categories of recipients, and only as necessary:

We may disclose personal data if required by law, court order, or to protect the rights, property, or safety of KENSAI, our users, or the public.

🇪🇺 Our primary infrastructure is hosted in Frankfurt, Germany (EU). Your data is processed and stored within the European Economic Area (EEA) whenever possible.

Where data transfers outside the EEA are necessary (e.g., Stripe for payment processing, certain AI providers), we ensure adequate protection through:

• EU adequacy decisions (e.g., Switzerland, EU-U.S. Data Privacy Framework)
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data processing agreements with all sub-processors

We retain your data for the following periods:

• Account data — Duration of your account plus 30 days after deletion
• Scan results — 90 days by default; configurable per plan (up to 1 year for enterprise)
• Usage logs — 12 months, then anonymized
• Payment records — As required by applicable tax law (typically 7–10 years)
• Support correspondence — 24 months after resolution

You may request earlier deletion of your data at any time (see Section 9).

Under the General Data Protection Regulation, you have the right to:

• Access — Request a copy of the personal data we hold about you
• Rectification — Correct inaccurate or incomplete data
• Erasure — Request deletion of your personal data ("right to be forgotten")
• Restriction — Request restriction of processing under certain conditions
• Portability — Receive your data in a structured, machine-readable format
• Objection — Object to processing based on legitimate interest
• Withdraw consent — At any time, without affecting prior lawful processing

To exercise any of these rights, contact us at Contact us. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC).

We implement industry-standard technical and organizational measures to protect your data, including:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest
• Logical tenant isolation — scan data is separated per customer
• Role-based access controls and audit logging
• Regular security assessments of our own infrastructure
• SOC 2 Type II–aligned security practices

No system is 100% secure. If we become aware of a data breach affecting your personal data, we will notify you and the relevant supervisory authority in accordance with GDPR Article 33/34.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on our website at least 30 days before they take effect. The "Last updated" date at the top reflects the most recent revision.

Continued use of the Services after the effective date constitutes acceptance of the updated policy.

For any privacy-related questions or requests: