Privacy Policy

At DoesItDefend, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Breach & Attack Simulation platform for LLM applications.

1. Information We Collect

1.1 Personal Information

We may collect personal information that you voluntarily provide to us when you:

• Register for an account
• Use our platform
• Contact our support team
• Subscribe to our newsletter
• Participate in surveys or promotions

This information may include:

• Name and email address
• Company name and job title
• Payment information (processed securely by our payment provider)
• Usage data and preferences

1.2 Usage Data

We automatically collect certain information when you visit, use, or navigate the platform. This information does not reveal your specific identity but may include:

• Device and browser information
• IP address and location data
• Usage patterns and feature interactions
• Log and performance data

2. How We Use Your Information

We use the information we collect for the following purposes, with their respective legal bases under the LGPD (Art. 7):

• Provide, maintain, and improve our services
• Process transactions and send related information
• Send administrative information and updates
• Respond to inquiries and offer support
• Send marketing and promotional communications (with your consent)
• Protect against fraudulent or illegal activity
• Comply with legal obligations

Legal Bases (LGPD Art. 7)

• Provide and maintain SaaS services — Performance of contract (Art. 7, V)
• Process transactions and payments — Performance of contract (Art. 7, V)
• Send administrative information — Performance of contract (Art. 7, V)
• Respond to support requests — Performance of contract (Art. 7, V)
• Send marketing communications — Consent (Art. 7, I)
• Analyze product usage and improvements — Legitimate interest (Art. 7, IX)
• Prevent fraud and ensure security — Legitimate interest (Art. 7, IX)
• Comply with legal obligations — Legal obligation (Art. 7, II)
• Run attack simulations and generate findings — Performance of contract (Art. 7, V)

Use of Artificial Intelligence

We use artificial intelligence models (primarily Google Gemini) to power the simulation engine. AI is used to:

• Generate attack scenarios and adversarial probes tailored to the target LLM application
• Classify defensive responses (covered / partial / gap) against MITRE ATT&CK and OWASP LLM Top 10
• Generate findings, severity scoring, and prioritized remediation plans
• Answer methodology questions via the in-product assistant

Data sent to the AI provider:

• Target configuration you submit (endpoint metadata, scan profile, allowed scope)
• Attack scenario parameters and assertion catalogues
• Messages exchanged in the in-product assistant
• Run history and tenant context required to scope evidence packs correctly

Protection measures:

• In the chat assistant, personally identifiable data (emails, phone numbers, tax IDs) is automatically masked before being sent to the AI provider
• The AI provider’s data handling is governed by its terms of service. Review Google’s AI privacy policy for details on data use for model improvement
• We implement prompt injection detection and input limits

Right to review (LGPD Art. 20): You have the right to request human review of automated decisions that affect your interests. Our findings and severity scores are decision-support outputs (not binding automated decisions); a security analyst on your team is expected to validate every remediation before acting. Our full methodology — the evaluation set, graders and defense-lattice scoring — is documented internally and can be summarised on request via research@doesitdefend.ai. To exercise this right, contact our DPO.

3. How We Share Your Information

We may share your information with:

• Service Providers: Third-party vendors who provide services on our behalf
• Business Partners: Partners with whom we jointly offer products or services
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with a merger, sale, or acquisition

4. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

• Encryption in transit (TLS 1.2+) and at rest (provider-managed encryption)
• Security assessments and automated testing
• Access controls and authentication requirements
• Monitoring, alerting, and error reporting

5. Your Privacy Rights

In accordance with the General Data Protection Law (Law No. 13,709/2018), you have the following rights regarding your personal data:

• Confirmation and access (Art. 18, I and II): confirm whether we process your data and request a copy
• Correction (Art. 18, III): correct incomplete, inaccurate, or outdated data
• Anonymization, blocking, or deletion (Art. 18, IV): of unnecessary, excessive, or non-compliant data
• Portability (Art. 18, V): request a copy of your data in a structured format by contacting our DPO
• Deletion (Art. 18, VI): request deletion of your account and associated data via your account settings or by contacting our DPO
• Information about sharing (Art. 18, VII): know with whom your data was shared
• Consent revocation (Art. 18, IX): withdraw consent at any time
• Automated decision review (Art. 20): request review of decisions made exclusively by automated means
• ANPD petition (Art. 18, §2): file a complaint with the National Data Protection Authority

Response time: 15 business days from the request (Art. 18, caput). To exercise your rights, contact our Data Protection Officer at privacy@doesitdefend.ai.

6. Cookies and Tracking

We use the following cookies and tracking technologies:

Essential cookies (do not require consent): did_{environment}_access (JWT authentication, 1 hour), did_{environment}_refresh (session renewal, 30 days), and doesitdefend-locale (language preference, 1 year). Authentication cookies are HttpOnly, SameSite=Lax, Secure in production, and isolated by environment.

Optional first-party analytics: only after you select Allow analytics, we record public page views, CTA and demo interactions, and signup completion through server-side logging on Google Cloud. We store an opaque visitor identifier and first-touch attribution in localStorage for up to 30 days; the consent choice is retained for up to 180 days. We never include prompts, private results, names, email addresses, full query strings, or full referrer URLs. No Google Analytics, advertising pixel, or data sale is involved. Legal basis: consent (LGPD Art. 7º I / GDPR Art. 6(1)(a)).

Management: select Analytics preferences in the site footer to allow, reject, or revoke optional analytics. Rejection or revocation deletes the browser identifiers immediately and stops non-essential events. Server-side telemetry is retained for 180 days. To request deletion of usage data linked to your workspace, contact our DPO (privacy@doesitdefend.ai). Essential authentication and locale storage cannot be disabled without compromising the service.

7. Data Retention

We retain your personal data for the following periods:

• Account data: retained while your account is active and deleted upon account deletion request
• Payment data: retained as required for tax and legal compliance
• Access logs: retained for up to 6 months (Internet Civil Framework, Art. 15)
• Analytics events: retained for a limited period to support product improvement
• Run findings and evidence packs: retained while your account is active (export available on request)
• Simulation cache: temporary (automatically expires)
• Authentication tokens: expire automatically after their configured lifetime

We retain personal data only for as long as necessary to fulfill the purposes described in this policy or as required by law. You may request deletion of your account and associated data at any time by contacting our DPO.

8. Children’s Privacy

Our services are not intended for individuals under 18 years of age, in compliance with the Child and Adolescent Statute (ECA) and the Digital ECA (in effect since March 2026). We do not knowingly collect personal information from children or adolescents. If we identify that a minor has provided personal data, we will take immediate steps to delete that information. Parents or guardians who become aware that a minor has provided us with data should contact us immediately at privacy@doesitdefend.ai.

9. International Data Transfers

Your data may be transferred and processed outside of Brazil in the following situations:

• Google (Gemini AI) — USA: simulation orchestration and scoring — Standard Contractual Clauses (ANPD Resolution 19/2024)
• Google (Cloud Run / Logging) — USA: hosting, structured logs, traces — Standard Contractual Clauses
• Stripe — USA: payment processing — Standard Contractual Clauses
• AWS / GCP object storage — USA or EU: encrypted evidence pack storage — Standard Contractual Clauses
• Anthropic, OpenAI (optional, future) — USA: alternative model providers, only if explicitly enabled by tenant — Standard Contractual Clauses

We implement appropriate safeguards for international transfers, including Standard Contractual Clauses where applicable. For details about contractual arrangements, contact our DPO.

Optional integrations configured by you (such as HubSpot, Salesforce, or Slack) may involve additional data transfers governed by your own agreements with those providers.

Data Protection Impact Report (DPIA/RIPD)

In compliance with LGPD Arts. 5, XVII and 38, we are preparing a Data Protection Impact Report (RIPD) to document personal data processing activities, risk assessments associated with the use of artificial intelligence, and the technical and organizational mitigation measures implemented. The RIPD will be made available to the ANPD upon request.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of our services after any changes indicates your acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Data Protection Officer (DPO): privacy@doesitdefend.ai
• Support: support@doesitdefend.ai
• Legal: legal@doesitdefend.ai
• Lumina Serviços de Consultoria LTDA — CNPJ 57.150.909/0001-43 — Santa Bárbara d’Oeste, São Paulo, Brazil
• Response time: 15 business days.