01 Who we are
Deckard Security is a service of Tufli Software S.R.L., a company registered in the Republic of Moldova (IDNO 1024600045912), at str. Alexei Mateevici 75, MD-2009 Chișinău, Republic of Moldova. We decide how the personal data described on this page is used, which makes us the “controller” of it.
Questions about your data go to privacy@deckardsecurity.com.
We follow Moldova’s Law no. 195/2024 on personal data protection. If you are in the European Union, the European Economic Area or the United Kingdom, the GDPR or the UK GDPR also applies to how we handle your data.
02 The short version
- We collect what you give us to plan, sell and deliver a security test, and nothing optional without asking.
- Analytics, session recordings and error reports stay off until you switch them on. You can switch them off again at any time.
- We don’t sell personal data and we don’t use it for advertising profiles.
- You can ask for a copy of your data, a correction or deletion by email.
03 What we collect and why
| Data | Why we use it | Legal basis | How long we keep it |
|---|---|---|---|
| Your company website and work email, from the forms on our landing page | To prepare a test plan and a price, and to reply to you | Steps you asked for before a contract | 12 months after our last contact, if you don’t order |
| Consultation booking details: your name, work email, company website, what you want to discuss and the time you chose | To arrange and hold the consultation call you booked. We don’t record the call | Our contract with you | 12 months after the call, if you don’t order |
| Order details: your name, role, company, email, phone, billing details and the systems to test | To deliver the test, send you the report and invoice you | Our contract with you | While you are a client, then for as long as Moldovan accounting and tax law requires |
| The signed testing authorization: name, role, signature, date and the IP address it was signed from | To prove the test was authorized by someone entitled to allow it | Legal obligation and our legitimate interest in defending legal claims | For as long as a legal claim about the test could be brought |
| Messages you exchange with your tester or with support | To answer you and keep a record of what was agreed | Our contract with you | With the order they belong to |
| Payment details | To take the deposit and the final payment. Card numbers go straight to Polar, our payment provider; we never see or store them | Our contract with you | Invoices are kept as accounting law requires |
| Usage data: pages viewed, clicks, device and browser, approximate location from your IP address | To understand how the site is used and improve it | Your consent | Up to 12 months |
| Session recordings: mouse movement, clicks and scrolling on our public pages, with typed text hidden | To see where people get stuck | Your consent | Up to 30 days |
| Error reports: what broke, on which page, in which browser | To fix faults | Your consent | Up to 12 months |
| Security logs: IP address, browser and requests made to the site | To keep the site available and block attacks | Our legitimate interest in a secure service | A short period, normally no more than 30 days |
Your company website and work email, from the forms on our landing page
- Why we use it
- To prepare a test plan and a price, and to reply to you
- Legal basis
- Steps you asked for before a contract
- How long we keep it
- 12 months after our last contact, if you don’t order
Consultation booking details: your name, work email, company website, what you want to discuss and the time you chose
- Why we use it
- To arrange and hold the consultation call you booked. We don’t record the call
- Legal basis
- Our contract with you
- How long we keep it
- 12 months after the call, if you don’t order
Order details: your name, role, company, email, phone, billing details and the systems to test
- Why we use it
- To deliver the test, send you the report and invoice you
- Legal basis
- Our contract with you
- How long we keep it
- While you are a client, then for as long as Moldovan accounting and tax law requires
The signed testing authorization: name, role, signature, date and the IP address it was signed from
- Why we use it
- To prove the test was authorized by someone entitled to allow it
- Legal basis
- Legal obligation and our legitimate interest in defending legal claims
- How long we keep it
- For as long as a legal claim about the test could be brought
Messages you exchange with your tester or with support
- Why we use it
- To answer you and keep a record of what was agreed
- Legal basis
- Our contract with you
- How long we keep it
- With the order they belong to
Payment details
- Why we use it
- To take the deposit and the final payment. Card numbers go straight to Polar, our payment provider; we never see or store them
- Legal basis
- Our contract with you
- How long we keep it
- Invoices are kept as accounting law requires
Usage data: pages viewed, clicks, device and browser, approximate location from your IP address
- Why we use it
- To understand how the site is used and improve it
- Legal basis
- Your consent
- How long we keep it
- Up to 12 months
Session recordings: mouse movement, clicks and scrolling on our public pages, with typed text hidden
- Why we use it
- To see where people get stuck
- Legal basis
- Your consent
- How long we keep it
- Up to 30 days
Error reports: what broke, on which page, in which browser
- Why we use it
- To fix faults
- Legal basis
- Your consent
- How long we keep it
- Up to 12 months
Security logs: IP address, browser and requests made to the site
- Why we use it
- To keep the site available and block attacks
- Legal basis
- Our legitimate interest in a secure service
- How long we keep it
- A short period, normally no more than 30 days
The three rows that rely on your consent are described in detail in our Cookie Policy.
04 Personal data inside the systems we test
When we test a client’s systems we may come across personal data held in them, for example a customer table reached through a flaw. That data belongs to our client’s customers and staff, and our client remains responsible for it. We act only on our client’s written instructions, under a data processing agreement that is part of the contract.
- We keep only the minimum evidence needed to prove a finding, such as a screenshot with the personal details blurred or cut down to a few rows.
- Evidence is encrypted, and only the testers on that order can open it.
- We delete it when the retest window in the contract ends.
- The open-weight AI models we use run on infrastructure we control. What they see during a test is not sent to the company that made the model or to any public AI service.
If your data is held by one of our clients and you want to use your rights, contact that organization. We will help them answer you.
06 Sending data to other countries
We are based in Moldova, which is outside the European Economic Area. Data you send us is handled in Moldova and by the providers listed above. Moldova’s data protection law is modelled on the GDPR. Where the law requires an extra safeguard for a transfer, we use the European Commission’s standard contractual clauses or an equivalent approved safeguard. You can ask us for a copy.
07 Your rights
You can ask us to:
- give you a copy of the personal data we hold about you;
- correct data that is wrong or out of date;
- delete your data, where we have no legal reason to keep it;
- stop or limit a use of your data that you object to;
- hand your data to you or to another provider in a common format.
Where we rely on your consent, you can withdraw it at any time. For cookies, analytics and recordings, use “Cookie settings” at the bottom of any page. For everything else, email privacy@deckardsecurity.com. We reply within one month and we don’t charge for it.
If you think we have handled your data wrongly, please tell us first so we can put it right. You can also complain to the National Center for Personal Data Protection of the Republic of Moldova (datepersonale.md) or to the data protection authority where you live.
08 How we protect it
Data is encrypted in transit and at rest. Access is limited to the people who need it for their work, protected by two-step sign-in and logged. If a breach puts your data at risk, we will tell you and the authorities as the law requires.
09 Children
Our service is for organizations. It is not meant for anyone under 18, and we don’t knowingly collect their data.
10 Changes to this policy
When we change this policy we update the date at the top. If a change affects how we use data you already gave us, we will email clients before it takes effect.