Privacy Policy

Cantic is operated by Cantic Ltd, a company registered in England & Wales (Company No. 17165585). In this policy, “Cantic”, “we”, and “us” mean Cantic Ltd. For any privacy question, or to exercise the rights described below, email us at team@cantic.ai.

This policy applies to the Cantic security testing service, dashboard, scan reports, and this website. It does not cover third-party sites we link to or the applications you ask us to test (which remain under your control).

When you use Cantic, we collect:

• Domain and scan data: the domains you submit for testing, the results of our AI agent’s attack simulations, and the generated reports. This includes discovered endpoints, authentication test results, and any vulnerabilities found.
• Account data: if you subscribe, your email address and payment information (processed by our payment provider, not stored by us).
• Authorization confirmation: your attestation that you are authorized to test the submitted domain.
• Usage and operational data: scan timestamps, IP addresses, and service usage patterns, used to operate the service and prevent abuse.
• Communications: if you email us, the content of that correspondence.

We set a single essential cookie to keep you signed in to your dashboard session. It is strictly necessary for the dashboard to work and is stored with the httpOnly flag. We do not use advertising or cross-site tracking cookies.

Under UK GDPR we rely on: performance of a contract, to run the scans and provide the reports you requested; our legitimate interests, in operating a reliable and secure service and responding to enquiries; and, where applicable, your consent, which you can withdraw at any time.

Scan reports are retained for the duration of your subscription plus 30 days, so you can access historical results. Free scan reports are retained for 14 days unless you subscribe. Account and payment records are kept as required by law. Operational logs are retained for up to 90 days.

We use infrastructure providers to run the service. We do not sell your data or share it with third parties for their own purposes. We may disclose data where the law requires it.

Scan results are encrypted at rest. Access is restricted to operations that need it to run the service. Our AI agent uses read-only tools and cannot modify, delete, or exfiltrate data from the applications it tests.

Under UK data protection law you have the right to access, correct, or delete your personal data, to restrict or object to processing, to data portability, and to withdraw consent. To exercise any right, email team@cantic.ai; we aim to respond within one month. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk).

Cantic is a tool for businesses and developers and is not directed at children. We do not knowingly collect personal data from anyone under 16.

We may update this policy as the product evolves. Material changes will be reflected in the “last updated” date at the top, and where appropriate we will notify subscribers.

Questions or requests can be sent to team@cantic.ai.