Skip to content
THAVIQ

Legal / 01

Privacy policy

Last updated 29 September 2026

If you choose Google sign-in, we receive your Google account identifier, name, email address and available profile image to create or access your account. We request basic identity scopes, not access to Gmail or Google Drive. Google handles authentication under its own privacy terms.

Who controls your data

THAVIQ SOFTWARE VENTURES PRIVATE LIMITED (THAVIQ) is the controller for account, billing and service communications data. When we scan a customer domain and store findings at that customer's instruction, the customer is the controller and THAVIQ acts as processor. Contact privacy@thaviq.com for privacy requests or questions.

Data we use and why

  • Account email, organisation membership and session data to authenticate users.
  • Domains, scan results, findings and remediation notes to deliver the service.
  • Billing records and transaction identifiers to administer purchases and taxation.
  • IP address, request metadata and security logs to prevent abuse and investigate incidents.

We process these data to perform our contract, protect the service, meet legal duties and, where required, act on consent. We do not sell personal data or use customer scan data for advertising.

Website analytics (thaviq.com)

If you accept analytics cookies on thaviq.com, we use Google Analytics to measure visits, pages viewed and how visitors reached the site. Our legal basis is your consent, which you can withdraw at any time with “Cookie settings” at the bottom of each page. Google may process this data outside the EU under its published transfer safeguards. See our cookie notice.

Sharing, location and retention

Our current providers are listed on the sub-processor page. Primary scan and evidence data are stored in Frankfurt. Providers used for payments, email, edge security and error reporting may process limited data under their published transfer safeguards.

Account and operational data are kept while the service is active. Remediation records are append-only and currently have no automatic deletion schedule. We review retention and erasure requests against the purpose of processing and applicable duties; a five-year period is not a blanket requirement for all personal data. Security logs are kept only as long as reasonably needed for investigation.

Public scan pilot

Submitted pages are public, but their HTML can still contain personal data. We store page addresses, selectors and short code excerpts, not a complete archive of the website. Do not submit private links, credentials or sensitive information. Report links contain an access token: only share them with people you want to give access. Paid checkout and transactional email are not open during the pilot.

Your rights

Depending on the applicable law, you may request access, correction, erasure, restriction, portability or object to processing, and complain to your supervisory authority. Contract and statutory records may remain where erasure is legally restricted. See GDPR Articles 13–22 in the official text.