Privacy and information notice

Your personal data is processed by Noroxi LLC (“Noroxi”) in its capacity as data controller.

We process only the data you give us or data that is strictly necessary for the service to work.

We keep the tool usage log to be able to trace misuse and to improve the service. When your account is deleted, the account link on scan results is removed, but the results are not deleted. The tool usage log stays as it is: the IP address, the browser identifier and the ID of the deleted account remain in it. You can ask for them to be deleted separately; see how to apply below.

We do not ask for special categories of personal data (such as health or biometric data). Please do not share this kind of information in forms.

We process your data on the following legal grounds set out in Article 5 of KVKK:

If we ever need to process data for any other purpose, for example marketing, we will do so only with your explicit consent, and you can withdraw your consent at any time.

During a penetration test or red team engagement, we may access personal data in our client’s systems. In that case, our client is the data controller; Noroxi acts as a data processor and only on the instructions set out in the contract.

• A non-disclosure agreement and a data processing addendum are signed before the work begins.
• Only the minimum data needed to demonstrate a finding is taken as evidence; personal data is masked in the report.
• Reports are delivered over an encrypted channel.
• Test data is deleted 30 days after the project is closed, and a deletion record is shared.

An agency account adds, scans and reports on its own clients’ sites. The agency decides which sites are added and what is shared with the client; Noroxi keeps these records in the agency’s account.

• Client portal: the agency invites its client by email address. The client sees only the sites the agency assigned to them; internal notes on findings, the assignee, evidence attachments and port scan findings are not shown in the portal. The client’s marks and requests in the portal are passed to the agency.
• Shared report link: anyone who knows a link created by the account owner can open the report. The link is valid for 30 days and the account owner can close it earlier. Internal notes on findings, the assignee and port findings are not included in this report.
• Tool report pages: anyone who knows the address of a free tool’s report page (scorecard, WP Lens, subdomains and others) can open it; these pages are closed to search engines. A port scan report is visible only to the person who ran the scan.
• Status page subscription: if you subscribe to a status page by email, your address is verified with a confirmation email. The owner of the page does not see subscribers’ addresses, only how many there are.

Noroxi links in emails carry measurement tags (utm_source, utm_medium, utm_campaign). The tag is a fixed code that only tells us the type of email; your email address, domain or account ID is never written into it.

We share your data with the following recipients only to the extent necessary to provide the service:

• Service providers: companies that provide us with hosting, email and accounting services. These companies process your data only on our instructions.
• Competent authorities: where there is a legal obligation or a court order, and only to the extent requested.

The service providers we use today and the data that reaches them:

If a service provider’s servers are located outside Türkiye, the transfer is made only with the safeguards provided for in Article 9 of KVKK, for example the standard contract published by the Personal Data Protection Board (KVKK Board). You can request the current list of service providers at kvkk@noroxi.com.

When the retention period expires, the data is deleted, destroyed or anonymized.

We do not use advertising or retargeting cookies on this site. To see which pages are useful we use Google Analytics: Google sets an analytics cookie to measure your visit (IP anonymized, advertising signals and ad personalization off). You can turn this off at any time with the “Turn analytics off” link at the bottom of the page; while it is off, no cookie is set.

When you sign in a session cookie is set, and a preference cookie (NEXT_LOCALE) keeps your language choice. Beyond these, some features keep data in your browser’s storage. Most of it never leaves your browser; the table says which items are sent to the server.

You can delete this data in your browser settings, or all at once with the button below. The button deletes every key except your analytics opt-out; if that choice were deleted, measurement would switch back on without you knowing.

Security is our business; we apply to our own systems the same standards we recommend to our clients.

• All traffic is encrypted with TLS; forms are submitted only over HTTPS.
• Only employees who need access for their work can access data, and only with two-factor authentication.
• Access is logged and reviewed regularly.

If you have found a vulnerability in our systems, please report it in line with our responsible disclosure policy.

Under Article 11 of KVKK, you have the right to:

• learn whether your data is processed and, if so, request information about it;
• learn the purpose of the processing and whether the data is used in line with that purpose;
• know the third parties, in Türkiye or abroad, to whom your data has been transferred;
• request rectification if your data has been processed incompletely or inaccurately;
• request erasure or destruction of your data, and request that these actions be notified to the parties to whom the data has been transferred;
• object to an outcome against you that results from analysis of your data exclusively by automated systems;
• claim compensation if you suffer damage because of unlawful processing.

How to apply

You can send your request to kvkk@noroxi.com or in writing to the address above. So that we can verify your identity, please state your first and last name and describe your request clearly.

We will respond to your request free of charge within 30 days at the latest. If you are not satisfied with our response, you may file a complaint with the Personal Data Protection Board (KVKK Board).

Deleting your account

There is no button in account settings that deletes the account. If you want your account deleted, send your request to kvkk@noroxi.com or use the request form on this page with the “Erasure” option. If you also want the tool usage log and the scan results kept independently of your account to be deleted, say so in your request.

When we change this notice, we update the version number and date. If you have an account, we will also notify you of material changes by email.