Privacy policy

Mockingjay Pte Ltd, SingaporeEffective June 2026

TL;DR

We collect only what we need to run the platform and the tests you ask for.
Test evidence stays scoped to your engagement, is encrypted, and is kept only as long as you choose.
Credentials you share for testing are stored in an encrypted vault and deleted when the engagement ends.
We never sell your data, and we never use your content to train AI models.

What we collect

Four kinds of information, each for a specific purpose.

Account and billingName, work email, company, role, IP address at sign-up and payment details. Card payments are handled by our payment processor; we never see full card numbers.
Platform usageHow you use the Mockingjay console, such as pages visited, scans configured and findings viewed. We measure this ourselves, without third-party ad trackers.
Engagement and scan dataScope, test accounts and credentials you provide, findings, and evidence such as screenshots and request and response excerpts. Evidence can incidentally contain personal data from your systems; we capture only what proves a finding and redact the rest.
Website and bookingDetails you submit when booking a demo through our scheduling provider, and messages you send to hello@mockingjay.io.

What we don’t collect

Bulk copies of your dataWe don’t copy databases or file shares. Testing proves access with the minimum evidence needed.
Source code beyond scopeCode you share for white-box testing is used only for that engagement and deleted when it closes.
Tracking profilesNo behavioural fingerprinting, advertising pixels or cross-site tracking.

How we use it

Only to run the service you signed up for:

Delivering the serviceRunning scans and pentests, reporting findings, retests and support.
Operating your accountAuthentication, billing, security monitoring and service notices.
Improving the productAggregated usage patterns, kept private to Mockingjay. Customer content is never used to train AI models.

Where data is stored

Platform data is hosted in Singapore and Germany. Where we transfer data outside Singapore, we use contractual safeguards that give it a comparable standard of protection.

How we protect it

EncryptionIn transit with TLS and at rest. Credentials for testing are kept in a separate encrypted vault.
AccessLeast-privilege access for staff and testers, with every access logged and reviewable.
Testing trafficConducted only within the scope and rules of engagement you approve.

How long we keep it

Findings and evidence60 days after the engagement closes, or as you request
Testing credentialsDeleted within 30 days of the engagement closing, or sooner on request
White-box source codeDeleted when the engagement closes
Account dataLife of the account plus 30 days
Billing records7 years, to meet accounting obligations
Usage data13 months, rolling

Your rights

Under Singapore’s PDPA, the GDPR, UK GDPR and CCPA/CPRA, you can ask to access, correct, export or delete your personal data, or withdraw consent. Email hello@mockingjay.io and we’ll respond within 30 days.

Cookies

Our website uses only the cookies needed for it to work. The booking widget from our scheduling provider may set its own cookies when you use it.

Acceptable use

Only use Mockingjay against systems you own or have written authorisation to test. That excludes third-party services you don’t have a testing agreement with, and your customers’ systems without their consent.

Changes to this policy

We’ll email you and show a notice in the platform at least 30 days before any material change. Minor updates are posted here with a new effective date.

Contact

Mockingjay Pte Ltd, Singapore. For anything privacy-related, email hello@mockingjay.io.