1. Introduction

Flyingduck (“Flyingduck,” “we,” “us,” or “our”) provides a code security intelligence platform that helps development and security teams identify vulnerabilities, secrets, license risks, and logical flaws in software (the “Service”). This Privacy Policy describes how we collect, use, disclose, and protect information when you visit our website at www.flyingduck.io (the “Site”), sign up for or use the Service, or otherwise interact with us.

Flyingduck operates through two affiliated entities:

• Flyingduck Inc., a company incorporated in the United States; and
• Flyingduck Labs Private Limited, a company incorporated in India.

References to “Flyingduck,” “we,” “us,” or “our” in this Policy refer collectively to both entities and their affiliates. The specific Flyingduck entity responsible for processing your information as a data controller/fiduciary will generally be the entity you have contracted with, or, where no contract exists, the entity most closely associated with your location or use of the Service. If you have questions about which entity applies to you, please contact us using the details in Section 16.

This Policy applies globally to all visitors, users, and customers of the Site and the Service, regardless of where you are located, subject to Section 12 (which describes rights that apply specifically depending on your jurisdiction).

By accessing or using the Site or the Service, you agree to the collection and use of information in accordance with this Policy. If you do not agree, please do not use the Site or the Service.

2. Scope of This Policy

This Policy covers:

• Information we collect through the Site (e.g., marketing pages, blog, contact/demo request forms, newsletter sign-up).
• Information we collect through the Service (e.g., account data, data generated by connecting your code repositories and development tools).

This Policy does not cover information processed by our customers as independent controllers of their own end users’ data, except to the extent we process that information on their behalf as described below. Where we act as a data processor/service provider on behalf of a customer (for example, processing a customer’s source code or repository data to deliver scan results), our processing is also governed by our data processing terms or the commercial agreement with that customer, which take precedence over this Policy in case of conflict for that data.

3. Definitions

• “Personal Data” means any information relating to an identified or identifiable natural person.
• “Account Data” means information you provide when creating and managing an account (e.g., name, email address, company, role).
• “Customer Data” means data submitted to the Service in connection with a customer’s use of the Service, including repository metadata, code, dependency information, and scan results, as further described in Section 4.2.
• “Usage Data” means information automatically collected about how the Site or Service is accessed and used.

4. Information We Collect

5. How We Use Information

We use the information described above to:

• Provide, operate, maintain, and support the Site and Service
• Create and manage accounts, authenticate users, and provide customer support
• Perform vulnerability, secrets, SCA, SBOM, and logical-flaw analysis and generate results and remediation recommendations
• Process transactions and manage billing
• Communicate with you, including responding to inquiries, sending service and security notifications, and (where permitted) sending product updates or marketing communications
• Monitor, analyze, and improve the performance, security, and functionality of the Site and Service
• Detect, investigate, and prevent fraud, abuse, security incidents, or violations of our terms
• Comply with legal obligations and enforce our agreements
• With your consent or as otherwise permitted, for research, product development, and creating aggregated or de-identified analytics

6. AI-Based Analysis

Certain features of the Service (e.g., our “AI Analysis” capability) use machine learning models to analyze code, dependencies, and vulnerabilities and to prioritize or recommend remediations. These models are hosted and operated internally by Flyingduck. We do not transmit your code or Customer Data to third-party large language model (LLM) providers (such as OpenAI or Anthropic) for this purpose. If this changes in the future, we will update this Policy and, where required, obtain appropriate consent or provide notice in advance.

7. Legal Bases for Processing

Where applicable law requires a legal basis for processing Personal Data (for example, under the EU/UK GDPR or similar frameworks), we rely on one or more of the following:

• Contractual necessity — to provide the Service you or your organization has signed up for
• Legitimate interests — to operate, secure, and improve our Site and Service, and for direct marketing, in each case balanced against your interests and rights
• Consent — where you have given consent (e.g., for certain cookies or marketing communications), which you may withdraw at any time
• Legal obligation — to comply with applicable laws, regulations, or legal process

8. How We Share Information

We do not sell your Personal Data. We may share information with:

• Service providers/subprocessors who perform services on our behalf, such as cloud hosting, infrastructure, analytics, customer support tools, email delivery, and billing/invoicing (e.g., Zoho Books). These providers are contractually bound to protect your information and use it only for the purposes we specify.
• Your organization/team members — if you access the Service as part of an organization’s account, information may be visible to administrators or other authorized users of that account.
• Professional advisors — such as auditors, lawyers, and accountants, where necessary for our business operations.
• Legal and safety purposes — where required to comply with applicable law, regulation, legal process, or governmental request; to enforce our agreements; to detect or prevent fraud or security issues; or to protect the rights, property, or safety of Flyingduck, our users, or others.
• Business transfers — in the event of a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to standard confidentiality safeguards.

9. International Data Transfers

Flyingduck operates globally and works with infrastructure and service providers that may process data in various locations. Where information is transferred across borders, we take steps designed to ensure it continues to be protected in accordance with this Policy and applicable data protection laws, including the use of appropriate contractual safeguards with our service providers where required.

10. Data Security

We implement technical and organizational measures designed to protect information against unauthorized access, disclosure, alteration, or destruction, including encryption in transit and at rest, access controls, and regular security reviews. Our hybrid architecture option is designed to let customers keep their source code within their own environment, reducing the data footprint transmitted to us. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Data Retention

We retain Personal Data and Customer Data for as long as your account is active and as necessary to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Upon account termination or a valid deletion request, we will delete or anonymize data within a reasonable period, except where retention is required by law or for legitimate business purposes (e.g., billing records).

12. Your Privacy Rights

Depending on your location, you may have some or all of the rights described below. To exercise any of these rights, contact us at success@flyingduck.io. We may need to verify your identity before fulfilling certain requests.

13. Children’s Privacy

The Site and Service are intended for business use by adults and are not directed to individuals under the age of 18 (or the age of majority in their jurisdiction). We do not knowingly collect Personal Data from children. If you believe a child has provided us with Personal Data, please contact us so we can take appropriate action.

14. Third-Party Links and Integrations

The Site and Service may contain links to, or integrations with, third-party websites, tools, and services (e.g., GitHub, GitLab, Bitbucket, Slack, Jira). This Policy does not apply to those third-party services, and we encourage you to review their privacy policies. We are not responsible for the privacy practices of third parties.

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated Policy on this page with a revised “Last Updated” date, and, where required by law, provide additional notice or obtain consent. Your continued use of the Site or Service after an update constitutes acceptance of the revised Policy, to the extent permitted by applicable law.

16. Grievance Officer / Contact Us

If you have questions, concerns, or requests regarding this Policy or our data practices, or wish to raise a grievance, please contact us at:

Email: success@flyingduck.io

Grievance Officer (India): Sarat Lingamallu, Founder & CEO.