Privacy Policy

1. Who we are and how this policy applies

CyberImmune Inc. ("CyberImmune," "DeepScan," "we," "us," or "our") is headquartered at 18 King St E, Suite 1400, Toronto, Ontario, Canada. DeepScan is the security testing platform operated by CyberImmune Inc.

This policy applies to personal information under our control. When a customer submits data for an engagement, that customer may determine the purposes of processing and we may act as its service provider under the customer’s agreement and instructions.

2. Information we collect

We collect information you provide, information generated through use of DeepScan, and limited technical information from your browser or device.

• Account and organization information, including name, business email, job title, organization, role, authentication identifiers, and preferences.
• Commercial and engagement information, including requested services, approved scope, order details, support requests, and communications.
• Technical and usage information, including IP address, browser and device details, timestamps, pages viewed, diagnostic events, and activity logs.
• Content submitted through forms, email, product interfaces, or authorized support channels.

3. Security testing data

DeepScan may process sensitive security testing data supplied or generated for an authorized assessment. This can include domains, IP addresses, URLs, API definitions, configuration context, test credentials, session material, application responses, findings, reproduction steps, screenshots, logs, evidence, remediation records, and retest results.

We use security testing data only to provide, secure, support, and improve the services, follow documented customer instructions, and meet legal obligations. Customers must not submit targets, credentials, personal information, or systems they are not authorized to provide for testing.

4. How we use information

We use personal information for purposes a reasonable person would consider appropriate, including to:

• Administer accounts, organizations, roles, and authorized projects.
• Deliver autonomous testing, expert-led pentesting, findings, reports, remediation guidance, and retesting.
• Authenticate users, prevent abuse, maintain audit records, and protect DeepScan, customers, and scoped systems.
• Provide support and manage contracts, billing, and customer relationships.
• Measure and improve the public website when optional analytics consent has been provided.
• Comply with law, enforce agreements, investigate incidents, and establish or defend legal claims.

5. Consent and lawful processing

Where Canadian privacy law applies, including the Personal Information Protection and Electronic Documents Act (PIPEDA), we obtain meaningful consent unless another lawful basis permits or requires processing. You may withdraw consent subject to legal or contractual restrictions and reasonable notice.

In jurisdictions recognizing additional bases, processing may also be necessary to perform a contract, comply with law, protect legitimate interests such as service security and fraud prevention, or establish and defend legal claims.

6. When we disclose information

We do not sell personal information. We may disclose information to service providers supporting hosting, authentication, communications, analytics, support, or billing; authorized CyberImmune personnel and testing specialists; customer administrators; regulators or authorities where legally required; and a successor in a financing, merger, reorganization, or sale subject to appropriate protections.

7. International processing

CyberImmune is headquartered in Canada and may use personnel or service providers in Canada, the United States, India, and other locations. Information may be processed outside your jurisdiction and may be accessible to authorities under local law.

We use contractual, organizational, and technical measures designed to protect information when processed across borders.

8. Retention and deletion

We retain personal information only as long as reasonably necessary for identified purposes, customer instructions, contractual commitments, security and audit requirements, disputes, and law. Security evidence may be retained through the engagement, remediation, retest, audit, and agreed reporting lifecycle.

When information is no longer required, we delete, anonymize, or securely dispose of it, subject to backups and lawful retention requirements.

9. Security safeguards

We maintain administrative, technical, and physical safeguards appropriate to sensitivity, including access controls, authentication, logging, encryption where appropriate, personnel confidentiality, environment separation, secret redaction, and controlled testing procedures.

No system is completely secure. Customers remain responsible for protecting credentials, limiting authorized access, and promptly reporting suspected compromise.

10. Your privacy rights

You may request access to personal information under our control, correction of inaccurate information, withdrawal of consent, or review of our compliance by contacting hello@cyberimmune.com. We may verify your identity and may be permitted or required to withhold certain information.

If we process information for your organization, we may direct the request to that organization. Canadian residents may also contact the Office of the Privacy Commissioner of Canada or an applicable provincial regulator.

11. Cookies and communications

The public site stores your cookie preference and loads optional Vercel Analytics only after consent. See our Cookie Policy and use Cookie preferences in the footer to change your choice.

Where Canada’s Anti-Spam Legislation (CASL) applies, commercial electronic messages are sent with the required consent or another permitted basis, sender identification, and an unsubscribe mechanism. Necessary transactional, security, and service messages may still be sent.

12. Children

DeepScan is a business security service and is not directed to children. We do not knowingly collect personal information from children through the service. Contact us if you believe a child has provided information to us.

13. Changes and contact

We may update this policy as services, practices, or legal obligations change. We will post the revised version with a new last-updated date and provide additional notice where required.

Questions, requests, and complaints may be sent to hello@cyberimmune.com or CyberImmune Inc., 18 King St E, Suite 1400, Toronto, Ontario, Canada.