Privacy Policy

Last updated: 24 June 2026

The short version: VVM runs on your infrastructure. Your scan results, asset inventory, and findings stay on your systems — we never receive or store them. The only data your deployment sends us is a small amount of licensing telemetry, described below.

1. Who this covers

This policy explains what data we process through (a) this marketing website and (b) the licensing service that VVM deployments may report to. It does not cover data inside your VVM deployment — that data is controlled by you.

2. This website

Email you send us — if you email hello@ or sales@, we receive your message and address to respond.
One preference cookie — to remember that you dismissed the consent banner. No advertising or cross-site tracking cookies.
Standard server logs — our hosting/CDN provider processes connection metadata (e.g., IP address, timestamp) to serve and protect the site.

3. Your VVM deployment (on-premise)

Vulnerability findings, scan output, asset inventory, credentials, user accounts, and reports live entirely within your deployment, on your infrastructure. We have no access to them and do not collect, store, or transmit them.

4. Licensing telemetry (heartbeat)

When configured with a licence-server URL, your deployment periodically sends a small "heartbeat" so we can validate the licence, provide support, and manage renewals. It contains only:

Field	Why
Deployment ID + licence ID	Identify the licensed install; detect licence reuse
Organisation name + plan	Account management, support, renewals
Software version	Update notifications, support
Last-seen time	Confirm the deployment is healthy
Asset count (a number)	Plan limits — never the assets themselves

It does not include your findings, scan results, asset details, hostnames, IPs, or user data. The heartbeat is offline-tolerant: if it can't reach us, your deployment keeps working, and you may run VVM fully air-gapped with telemetry disabled.

5. How we use this data

Solely to operate licensing, provide support, notify you of updates, prevent licence abuse, and manage your account and renewals. We do not sell personal data, and we do not use it for advertising.

6. Sharing

We share data only with service providers that help us operate (e.g., hosting and CDN), under appropriate confidentiality and data-protection terms, and where required by law.

7. Retention & security

We keep licensing telemetry for as long as your subscription is active and for a reasonable period afterwards for records and renewals, then delete or anonymise it. We protect it with encryption in transit, signed licence verification, access controls, and hardened, isolated infrastructure.

8. Your rights

Subject to applicable law, you may request access to, correction of, or deletion of the limited account/telemetry data we hold about your organisation. Contact us using the details below.

9. Contact

Privacy questions or requests: [email protected].