Privacy Policy

This policy explains what personal data RedRound collects when you visit redround.com and use our website security testing service, why we use it, who we share it with, how long we keep it and what rights you have. We do not sell personal data, and we never use test results or evidence for advertising. Where test evidence contains personal data of your website's users, we handle that data on your behalf as your processor (see section 5).

1. Who we are

RedRound is operated by Yousea Technology Limited, a company registered in Hong Kong. Our registered address is FLAT 03, 15/F CARNIVAL COMMERCIAL BUILDING, 18 JAVA ROAD, NORTH POINT, HONG KONG.

In this policy, "RedRound", "we", "us" and "our" mean Yousea Technology Limited. "You" means a visitor to redround.com, a customer, or a member of a customer's workspace.

For the personal data described in this policy, except personal data in test evidence (section 5), we are the controller. This means we decide why and how the data is processed.

How to reach us:

• Privacy and data-protection requests: privacy@redround.com
• Account, billing, refunds and all other questions: support@redround.com

We have not appointed a data protection officer. For any question about personal data, contact privacy@redround.com.

2. Scope of this policy

This policy applies when you:

• visit redround.com, in any of its language versions;
• create or use a RedRound account or workspace;
• verify ownership of a website, approve a test plan, order a test or subscribe to a plan;
• receive reports and email from us;
• contact us, including to report test traffic you believe was not authorized.

It does not apply to websites and services run by others, even when you reach them from redround.com, such as Stripe's checkout pages or Google's sign-in pages. Their own privacy policies apply.

Your use of the service is governed by our Terms of Service. Payments and refunds are covered by our Refund Policy. Cookies and browser storage are covered by our Cookie Policy.

Personal data in test evidence. A report includes evidence for each finding, such as HTTP requests and responses and screenshots captured from the website under test. This evidence may incidentally contain personal data of the website's own users. For that data, the customer is the controller and RedRound is the processor. Section 5 explains how we handle it. A Data Processing Addendum (DPA) is available on request at privacy@redround.com.

3. Personal data we collect

Category	What it includes	Source
Account data	Name, email address, password (stored only as a hash) or Google sign-in details, workspace membership and role	You; the workspace member who invites you; Google, if you choose Google sign-in
Website and authorization data	Hostnames you add; ownership verification records (method, result and time); test plans (test window, request rate, excluded paths); your approval of each test plan, with its timestamp, your IP address and the version of our terms you accepted	You; our checks of the DNS TXT record, file or HTML meta tag you set up
Test results and evidence	Findings, severity, evidence (HTTP requests and responses, screenshots), fix steps, web reports and PDF reports	Our security testing of your website
Payment and billing data	Billing name, email address and country, payment status, last 4 digits of your card, plan, orders and invoices	You, through Stripe
Communications	Emails you send to support@redround.com or privacy@redround.com, including reports of suspected unauthorized testing traffic, and records of the service email we send you	You; anyone who writes to us
Technical and log data	IP address, browser and device type, pages and files requested, time of each request, error records, and records of who opened which report and when (audit logs)	Your browser; our service
Website usage data, only when analytics is on for you	Pages you visit, the page that referred you, time of each visit, browser, device and operating system, approximate location (country and city) derived from your IP address, and the random identifiers in the Google Analytics cookies	Your browser, through Google Analytics (see our Cookie Policy)
Cookie choices	Your choices for analytics and advertising cookies, the random consent ID in the rr_consent cookie, the policy version, the date and time, your country as determined from your IP address, and whether your browser sent a Global Privacy Control signal	Your browser; your choice in our consent banner or in Cookie settings
Browser storage	Your theme choice, kept in your browser's local storage	Your browser (see our Cookie Policy)

Please note:

• We never ask for or store login credentials for your website.
• We do not store full card numbers. You enter card details on Stripe's pages, and Stripe handles them.
• If you choose to sign in with Google, Google shares your name, email address and a Google account identifier with us. We do not receive your Google password.
• If you invite people to your workspace, you give us their email address. Please make sure they know about this policy.

What you must provide. To create an account you must give us an email address. To buy a report or subscribe, you must give billing details to Stripe. We test a website only after its ownership has been verified and you have approved a test plan. Without this information we cannot provide the service.

4. How we use personal data

The table below shows each purpose, the data we use for it and, for people in the European Economic Area (EEA), the United Kingdom and Switzerland, the legal basis under the GDPR and the UK GDPR.

Purpose	Data used	Legal basis
Provide the service: create and manage accounts and workspaces, sign you in, carry out the tests you approve, have results reviewed, and deliver web and PDF reports	Account, website and authorization, test results, technical data	Performance of our contract with you
Verify ownership and authorization: check your DNS TXT record, file or HTML meta tag; re-check ownership before every order; screen websites on shared hosting platforms; record your approval of each test plan	Website and authorization data, account data, IP address	Performance of our contract; our legitimate interest in testing only websites that the customer owns or is authorized to have tested, and in being able to show that each test was authorized
Billing: take payments, apply the rules of the free test, single report and subscription plans, issue invoices, process refunds and apply taxes	Payment and billing data, account data	Performance of our contract; legal obligation (tax and accounting)
Service email: report-ready notices, reminders before a purchase window closes, and account and billing notices	Account data, order details	Performance of our contract
Support: answer questions, handle refunds and complaints, respond to privacy requests	Communications, account data	Performance of our contract; legal obligation; our legitimate interest in responding to people who contact us
Security and abuse prevention: protect accounts and the service, enforce free-test limits, investigate reports of unauthorized testing traffic, keep audit logs of report access	Technical and log data, account data, website and authorization data	Our legitimate interest in protecting our customers, our service and third parties, and in preventing misuse of the service
Legal obligations and legal claims: comply with applicable law and lawful requests; establish, exercise or defend legal claims	The data relevant to the obligation or claim	Legal obligation; our legitimate interest in protecting our legal rights
Marketing email (section 11)	Name, email address	Consent, or our legitimate interest where the law permits email to existing customers
Website analytics: understand how visitors find and use the website, so that we can improve it (section 12)	Website usage data	Consent in the EEA, the UK and Switzerland; elsewhere, our legitimate interest in understanding how our website is used, which you can opt out of under Cookie settings
Records of cookie choices: apply your choices and be able to show what you agreed to	Cookie choices	Legal obligation to be able to demonstrate consent; our legitimate interest in applying your choices
Advertising measurement, only if we introduce it (section 12)	Cookie and device data, click identifiers, purchase events	Consent in the EEA, the UK and Switzerland; elsewhere, our legitimate interest in measuring our advertising, which you can opt out of

Where we rely on legitimate interests, you can object at any time (section 10).

What we do not do:

• We do not sell personal data.
• We do not use test results, evidence or reports for advertising, and we do not give them to advertising providers.
• We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. If our pre-screening refuses a website on a shared hosting platform, you can ask for a review by a person at support@redround.com.

5. Personal data in test evidence

When we test a website, we send test traffic to it within the test plan that the customer approved, and we record evidence for each finding. Evidence can include HTTP requests and responses and screenshots. If a page or response contains personal data of the website's users, such as a name, an email address or an order number, that data can appear in the evidence.

For this data:

• The customer is the controller. The customer decides to have its website tested and is responsible for having a legal basis for the testing and for informing its users where the law requires it.
• RedRound is the processor. We process the data only to carry out the test, prepare and review the report, and make the report available to the customer, or as the customer otherwise instructs us in writing.
• We keep the data confidential and protect it with the measures described in section 9.
• We use only the service providers listed in section 6 to process this data.
• We delete the data together with the report, according to the retention periods in section 8.
• We help the customer respond to requests from its users, and we notify the customer without undue delay if we become aware of a personal data breach affecting this data.

A Data Processing Addendum that sets out these commitments is available on request at privacy@redround.com. Where a signed DPA and this section differ, the DPA applies to this data.

If you are a user of a website that a RedRound customer has had tested and you want to exercise your rights over data in test evidence, please contact the owner of that website. If you contact us, we will pass your request to the customer when we can identify them.

6. How we share personal data

6.1 Service providers

We use the service providers below to run RedRound. They process personal data for us under contract. Security testing of your website and the review of its results are carried out by our own security testing team.

Provider	What it does for us	Location
Cloudflare	Hosting, content delivery, database and file storage for the website and the service	Data stored in the United States; requests handled at the Cloudflare location nearest to you
Stripe	Payment processing, checkout, subscription management (Stripe Customer Portal) and invoices	United States
Resend	Sending service email	United States
Google	Google sign-in, only if you choose it; Google Analytics, only when analytics is on for you	United States

Stripe and Google also use some data as independent controllers:

• Stripe uses payment data for its own purposes, such as fraud prevention and meeting its legal obligations, under the Stripe Privacy Policy.
• Google processes your Google account data under the Google Privacy Policy.
• For Google Analytics, Google processes website usage data on our behalf under the Google Ads Data Processing Terms. Google Analytics does not log or store IP addresses; it uses them only to derive approximate location. We do not use Google signals or link Google Analytics to advertising accounts.

6.2 Other recipients

We may also disclose personal data:

• within your workspace: members of a workspace can see its websites, test plans and reports according to their role;
• to professional advisors, such as lawyers, accountants and auditors, who are bound by confidentiality;
• to courts, regulators, law enforcement or other public authorities when the law requires it, or when needed to establish, exercise or defend legal claims;
• in a business transfer: if we are involved in a merger, acquisition, financing or sale of all or part of our business, personal data may be transferred to the buyer or successor, who will be bound by this policy or will tell you about any change;
• with your consent or at your direction.

We do not sell personal data, and we do not share it for cross-context behavioral advertising.

7. International transfers

Yousea Technology Limited is based in Hong Kong. The service stores data in the United States, in Cloudflare's US jurisdiction, and requests to redround.com are handled at the Cloudflare location nearest to you. The service providers in section 6 may process data in other countries. Your personal data may therefore be accessed and processed outside the country where you live, including in Hong Kong and the United States.

These countries may not offer the same level of data protection as the EEA, the UK or Switzerland. Where the law requires it, we use the Standard Contractual Clauses approved by the European Commission, together with the UK International Data Transfer Addendum for data from the UK and the amendments required for data from Switzerland.

You can ask for a copy of the relevant transfer terms at privacy@redround.com.

8. How long we keep personal data

We keep personal data only as long as we need it for the purposes in section 4.

Data	How long we keep it
Free test summary	30 days from release
Full report delivered free (a round with no finding of medium severity or higher)	30 days from release
Single-report results that were not purchased	Deleted 30 days after release (the 27-day purchase window plus 3 days)
Purchased single report	12 months from release
Subscription reports	While the subscription is active; after the subscription ends, 30 days for you to export them, then deleted
Ownership verification records and test-plan approvals (timestamp, IP address, terms version)	Kept with the order. After the report is deleted, we keep only the metadata, without findings or evidence, for 3 years, to show that testing was authorized
Account data	While your account is open; after it is closed, deleted within 30 days, except billing records
Billing records	For the period required by tax and accounting law
Communications	2 years from the last message
Technical logs and report-access audit logs	Technical logs: 30 days. Report-access audit logs: 12 months
Backups	Daily backups are kept for up to 90 days. Data deleted from the live service remains in backups until they expire; if we restore a backup, we apply the deletions again
Website usage data in Google Analytics	14 months, then deleted by Google Analytics
Cookie consent records	24 months
Advertising click identifiers (only if we use advertising measurement and it is on for you)	13 months

When a retention period ends, we delete the data or make it anonymous. We may keep data longer only when the law requires it or when it is needed for a legal claim, and only for that purpose.

9. How we protect personal data

We use technical and organizational measures appropriate to the risk, including:

• encryption in transit for connections to redround.com and our service;
• access controls that limit access to personal data to people who need it for their work;
• audit logs that record access to reports;
• multi-factor authentication for staff accounts;
• delivering reports through your account instead of attaching them to email;
• not collecting login credentials for your website or full card numbers.

No method of transmitting or storing data is free of risk, so we cannot guarantee absolute protection. If a personal data breach occurs, we will notify the relevant supervisory authority and the people affected when the law requires it.

10. Your rights

10.1 EEA, UK and Switzerland

You have the right to:

• access your personal data and receive a copy of it;
• have inaccurate or incomplete data corrected;
• have your data deleted;
• restrict our processing of your data;
• object to processing based on our legitimate interests, and object at any time to direct marketing;
• receive the data you gave us in a structured, machine-readable format and have it sent to another controller (portability);
• withdraw your consent at any time, without affecting processing carried out before you withdraw it;
• lodge a complaint with a supervisory authority, in particular in the country where you live or work or where you believe your rights were infringed. In the UK this is the Information Commissioner's Office; in Switzerland it is the Federal Data Protection and Information Commissioner.

We respond within one month of receiving your request. If a request is complex or we receive many requests, we may extend this by up to two further months, and we will tell you why within the first month. Requests are free of charge unless they are manifestly unfounded or excessive.

Some rights have limits. For example, we may keep authorization records and billing records after a deletion request when we need them to meet a legal obligation or to establish, exercise or defend legal claims. We will explain this in our reply.

10.2 United States

Depending on the state where you live, such as California, you may have the right to:

• know what personal information we collect, use and disclose, and get a copy of it;
• delete your personal information;
• correct inaccurate personal information;
• opt out of the sale of personal information, its sharing for cross-context behavioral advertising, and targeted advertising;
• not be treated differently for exercising these rights.

RedRound does not sell personal information and does not share it for cross-context behavioral advertising. If we start using advertising cookies (see our Cookie Policy), we will honor the Global Privacy Control (GPC) signal sent by your browser as a request to opt out of that sharing, and we will update this policy before we start.

We collect the following categories of personal information, from the sources in section 3, for the purposes in section 4. We disclose them for business purposes only to the service providers in section 6, and we keep them for the periods in section 8.

• Identifiers: name, email address, IP address, account identifiers and Google account identifier.
• Commercial information: plans, orders, payment status and invoices.
• Internet or other electronic network activity: technical and log data.
• Sensitive personal information: account login details (your email address and password, with the password stored as a hash), used only to let you sign in.

You can use an authorized agent to make a request. We may ask the agent for proof of authority and ask you to verify your identity. If we decline your request, you can appeal by replying to our decision. If you disagree with the outcome of the appeal, you can contact the attorney general of your state.

10.3 How to make a request

Email privacy@redround.com from the email address linked to your account, or tell us which account the request concerns. We may ask for more information to verify your identity before we act on a request. Wherever you live, you can ask us for access to, or correction of, your personal data.

For personal data in test evidence, see section 5.

11. Email from us

Service email. While you have an account or an open order, we send email needed to provide the service, such as report-ready notices, reminders before a purchase window closes, and account and billing notices. Our emails link to the report in your account; we do not attach reports or PDFs to email.

Marketing email. We send marketing email, such as product news, only if you have agreed to receive it or, where the law permits, to existing customers about similar RedRound services. Every marketing email includes an unsubscribe link. You can also unsubscribe by writing to privacy@redround.com. Unsubscribing does not stop service email.

12. Cookies and local storage

redround.com sets one strictly necessary cookie, rr_consent, which remembers your cookie choices. When analytics is on for you, Google Analytics sets its own cookies (_ga and _ga_H0YRJWE1ZW) to count visits and understand how the website is used. In the EEA, the UK and Switzerland, analytics stays off, and Google Analytics is not loaded, until you switch it on in our own consent banner. Elsewhere, analytics is on by default, and you can switch it off at any time under Cookie settings in the footer. We do not use advertising tools today.

If you choose a theme, your choice is kept in your browser's local storage under the key rr-theme and is never sent to our servers. The language version is chosen by the web address (for example /fr or /ja), not by a cookie.

When accounts launch, we will use a strictly necessary session cookie to keep you signed in, and Stripe will set its own cookies on its checkout pages. Details are in our Cookie Policy.

13. Children

RedRound is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact privacy@redround.com and we will delete it.

14. Changes to this policy

We may update this policy when our service or the law changes, and we will change the "Last updated" date at the top. If a change materially affects how we use your personal data, we will tell you by email or in your account before the change takes effect.

This policy may be translated into other languages for convenience. If a translation differs from the English version, the English version prevails.

15. Contact us

• Privacy and data-protection requests: privacy@redround.com
• All other questions: support@redround.com
• Post: Yousea Technology Limited, FLAT 03, 15/F CARNIVAL COMMERCIAL BUILDING, 18 JAVA ROAD, NORTH POINT, HONG KONG