Privacy Policy
Effective date: 29 October 2026
This Privacy Policy explains how Aliaksandr Tarantsei, operating as AppPerimeter (“we”, “us” or “our”), handles personal data in connection with https://appperimeter.com, business enquiries and our security assessment services.
1. Who is responsible for your data?
For website administration, enquiries, business contacts and our own billing records, the data controller is:
Aliaksandr Tarantsei, sole trader (JDG), trading as AppPerimeter
ul. Zwierzyniecka 24 lok. 501, 31-105 Kraków, Poland
NIP: 6793321936
REGON: 540842130
Email: [email protected]
You can use these contact details for privacy questions and requests about your personal data.
2. What data do we collect, and why?
| Purpose | Data involved | GDPR legal basis |
|---|---|---|
| Responding to enquiries and preparing proposals | Name, business email, company, app or website URL, requested service, deadlines and information you choose to provide | Article 6(1)(b) where you personally request steps towards a contract; Article 6(1)(f) when communicating with a business representative, for our legitimate interest in answering and managing business enquiries |
| Managing engagements and business relationships | Contact and role details, correspondence, agreed scope, authorization records, project administration and delivery records | Article 6(1)(b) for a contract with you personally; Article 6(1)(f) for our legitimate interest in managing relationships with client organizations and their representatives |
| Invoicing, accounting and legal compliance | Billing identity, business address, tax identifiers, invoice details and payment references | Article 6(1)(c), to meet applicable Polish accounting and tax obligations |
| Operating and protecting the website | IP address, request date and time, requested URL, browser/device information, error records and security events | Article 6(1)(f), for our legitimate interest in secure, reliable website operation and abuse prevention |
| Establishing, exercising or defending legal claims | Relevant contracts, correspondence and appropriately minimized evidence | Article 6(1)(f), for our legitimate interest in protecting legal rights |
Enquiries submitted through the contact form are delivered to our business email inbox at [email protected], hosted by Proton Mail. We collect data directly from you, from your organization when it names you as a project contact, and automatically through requests to our website. We may also verify business identification details using relevant public business registers.
Providing enquiry information is voluntary. Without sufficient contact and project details, we may be unable to respond or prepare a proposal. Contract and billing information may be necessary to provide a service and issue legally compliant invoices.
Please do not submit passwords, API tokens, private keys, customer exports, unredacted incident logs or other confidential assessment material through the public contact form. We agree a suitable transfer method after scoping.
3. Client data encountered during security testing
An assessment may involve access to application records, source code, logs, account identifiers and limited personal data in test requests or evidence. We prefer synthetic data and dedicated test stores and accounts.
Our role depends on the engagement. Where we process personal data solely on a client's documented instructions, we act as its processor or authorized subprocessor under a separate data processing agreement. The client or relevant merchant remains responsible for the applicable controller obligations. This Privacy Policy does not replace that agreement or provide authorization to access anyone's systems.
We limit access and evidence collection to what is needed for the authorized assessment. We redact or minimize personal data in reports where practical. Client assessment material is not used for advertising, public examples or training general-purpose AI models. Confidential code, logs, credentials or personal data are not submitted to external AI services unless the client has expressly authorized the specific use and the necessary contractual and data protection safeguards are in place.
For requests about personal data controlled by a client, contact that controller first. If we receive such a request as processor, we will refer it to the relevant client and assist as required by our agreement and applicable law.
4. Cookies and similar technologies
The website does not use advertising cookies, optional analytics cookies or session-replay technologies. Any cookies or browser storage used solely for essential functions, such as security or a requested form session, are limited to those functions. Technical request logging is described separately above.
Browser settings may allow you to block or delete cookies; blocking essential functionality may affect the website. If we introduce optional technologies that require consent, we will explain them and request consent before activation. You will be able to refuse them and withdraw consent through the relevant settings.
5. Who receives data, and where is it processed?
We disclose personal data only where needed to operate the business, provide the agreed service or meet legal duties. Recipients may include hosting and infrastructure providers, email and secure file-transfer providers, accountants, payment service providers, legal advisers and authorized assessment specialists. Authorities may receive data where disclosure is required by law.
Providers acting as processors are subject to appropriate contractual obligations. Assessment specialists receive access only as needed and under confidentiality obligations; processor/subprocessor requirements apply where relevant. We do not sell personal data or disclose it for third-party advertising.
Service provider and transfer information:
| Function | Provider and role | Processing/access locations | Transfer safeguard, if applicable |
|---|---|---|---|
| Website hosting on a dedicated server | Scaleway, infrastructure processor under the applicable agreement | Paris, France (EU); business administration/access from Poland | EEA processing for the stated hosting and access; any separate non-EEA processing is assessed under the applicable provider agreement |
| Business mailbox and enquiry correspondence | Proton AG, Switzerland (Proton Mail); processor for mailbox services under the applicable DPA, with separate responsibilities for its own service administration | Proton states that Mail storage servers are in Switzerland, Germany or Norway; separate service administration/support processing is described in its privacy policy | Switzerland: European Commission adequacy decision; Germany and Norway: EEA. Any separate onward processing must be covered by the applicable provider terms and lawful transfer safeguards |
| Website form email transmission | Website backend on Scaleway; outgoing mail through Proton Mail (Proton AG) to [email protected] | Website backend: Paris, France; email processing: Proton locations and arrangements described above | As described for Scaleway and Proton Mail; the Swiss adequacy decision applies to relevant transfers to Switzerland |
| Assessment material storage | Scaleway, infrastructure/storage processor under the applicable agreement | Paris, France (EU); authorized assessor access as agreed in the engagement and DPA | EEA storage; any additional assessor access or non-EEA processing must be authorized and covered by applicable safeguards |
Where data is transferred outside the European Economic Area, we use a mechanism permitted by the GDPR, such as an applicable European Commission adequacy decision or appropriate Standard Contractual Clauses with any necessary additional safeguards. The table identifies the arrangements actually used. You can contact us for information or a copy of relevant safeguards, subject to necessary redactions to protect confidential information.
Proton Mail uses zero-access encryption for stored message content. Ordinary messages exchanged with external email services are not automatically end-to-end encrypted. The website form and its email delivery path are separate from mailbox encryption. For confidential assessment material, we agree a suitable secure transfer method rather than relying on an ordinary enquiry email. See Proton Mail’s privacy policy and encryption explanation.
We do not automatically send assessment material to Shopify. Submission by the client, or a specifically authorized disclosure by us, is addressed in the engagement documentation.
6. How long do we keep data?
- Enquiries that do not become engagements: up to 12 months after the last substantive contact, unless a dispute or another lawful need justifies longer retention.
- Routine website and access logs: up to 30 days. Specific records relevant to a security incident may be isolated and retained as necessary to investigate or address it.
- Contract and business administration records: for the engagement and afterwards only for applicable statutory duties and relevant claim limitation periods. We review these records and remove unnecessary personal data.
- Invoices and tax records: for the statutory retention period applicable to the record. Polish tax records are generally retained until the relevant tax liability limitation period expires, usually five years from the end of the calendar year in which the tax payment deadline fell; suspension, interruption or special rules may extend that period.
- Assessment working files, raw evidence, client-provided logs and source snapshots: returned or deleted under the DPA and engagement instructions. Unless an earlier return/deletion instruction or a different lawful written arrangement applies, active working copies are deleted within 90 days after engagement closure, including completion or expiry of the agreed retest window.
- Backups: residual copies are isolated from ordinary use and expire within a further 90 days through the backup rotation. If a backup is restored, applicable deletion instructions are reapplied.
Access credentials are removed when no longer needed. We ask clients to revoke temporary accounts and rotate any supplied secrets at engagement closure. Any records retained for legal claims are minimized and restricted; that purpose does not justify keeping complete client databases or raw logs by default. Processor-held data is returned or deleted under the DPA, except where applicable law requires retention.
7. How do we protect data?
We use technical and organizational measures appropriate to the data and risks, including access restrictions, secure transfer methods, confidentiality obligations and minimization of assessment evidence. Specific measures and client requirements are agreed in the engagement and DPA. No internet transmission or storage system is completely secure.
8. Your rights
Subject to the conditions in the GDPR, you may request access to your data, correction, erasure, restriction of processing and, where applicable, data portability.
You may object to processing based on legitimate interests on grounds relating to your particular situation. If processing is for direct marketing, you may object at any time. Where processing relies on consent, you may withdraw that consent at any time without affecting processing that was lawful before withdrawal.
Contact [email protected] to exercise your rights. We may request proportionate information to verify your identity. We normally respond within one month. Where permitted, this may be extended by up to two further months because of complexity or the number of requests; we will explain the extension within the first month. Requests are normally free of charge, subject to the GDPR rules for manifestly unfounded or excessive requests.
You may complain to the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) at uodo.gov.pl, or another competent supervisory authority, particularly in the EU/EEA country of your habitual residence, workplace or the alleged infringement. You do not have to contact us before exercising that right.
We do not make decisions producing legal or similarly significant effects about you solely by automated processing, including profiling.
9. Changes and contact
We may update this Policy when our activities, providers or legal obligations change. The current version and its effective date will appear on this page. Where required, we will provide additional notice before a material change or new processing begins.
Questions: [email protected].