Privacy Policy

Zulfiqaar, operated by MSS · Last updated 20 October 2026

Sessions are monitored and recorded. Zulfiqaar is a hosted offensive-security platform for authorized work only. To check that work stays within its authorization, our operators can watch and record everything that happens in a session: the agent's actions, tool calls, captured traffic, and the live browser. Section 3 explains this in full.

1. Who we are

Zulfiqaar is operated by MSS ("we", "us"). This policy covers the website at msszulfiqaar.com and the hosted Zulfiqaar workbench. For any privacy question or request, email access@msszulfiqaar.com.

2. What we collect

Account data: your full name, username, email address, and your password, which we store only as a salted hash.
Billing data: payments are handled by Whop (the trial) and Paddle (access plans). We receive the order reference, plan, amount and payment status. We never see or store your card details.
Engagement data: the programs, targets, scope and authorization statements you enter, and the findings produced during your sessions.
Session activity: agent actions, tool output, HTTP traffic captured by the engine, browser activity, and timing data from sessions running on our infrastructure.
Operational logs: sign-ins, authorization checks, approvals, operator monitoring events, and request metadata such as IP address and timestamp.

Session activity can include data belonging to the systems you test. You are responsible for making sure your engagement allows that data to be processed.

3. Monitoring and recording

Zulfiqaar runs powerful offensive tooling, so operators may watch any active session in real time and keep recordings of session activity. We do this to:

check that work stays within the authorization you declared;
investigate abuse and security incidents;
assess claims under the finding guarantee on plans that include one.

Monitoring is a condition of using the hosted platform. If you do not accept it, do not run sessions on our infrastructure.

4. How we use data, and our legal basis

To provide the service (your account, sessions and containers): necessary to perform our contract with you.
To check authorization, monitor sessions and prevent abuse: our legitimate interest in keeping the platform lawful and safe, and a condition of the contract.
To process payments and keep financial records: contract, and legal obligations such as tax law.
To send account email (activation, password reset, session status): necessary to provide the service. We do not send marketing email.
To respond to lawful requests from authorities: legal obligation.

We do not sell personal data, and we do not use your engagement data to train AI models.

We share data only with the providers that run parts of the service, and only what each one needs:

Whop processes trial payments, and Paddle processes access plan payments.
Resend delivers account email.
Cloudflare carries traffic between your browser and our servers.
AI model providers (such as OpenAI, Anthropic, DeepSeek or OpenRouter, depending on your session's model) receive the prompts, context and tool output the agent needs to work. On bring-your-own-key plans, this goes to the provider account you connected, under that provider's terms.

We also disclose data where the law requires it, or where it is needed to stop unauthorized testing.

6. Cookies and local storage

The website sets no cookies and runs no analytics or advertising trackers. When you sign in, your browser keeps a sign-in token in local storage so you stay logged in. It is removed when you log out.

7. Isolation and security

Each hosted session runs in a container dedicated to your account, with its own storage. Your session is routed to that container only through your authenticated sign-in, never through a value you can supply, so one user cannot reach another user's container or data. No system is perfectly secure, but we design to limit the impact of any single failure.

8. How long we keep data

Account data: for as long as your account exists.
Session recordings, engagement data and audit logs: 180 days, then deleted or anonymized, unless we need them longer to investigate a specific incident.
Billing records: for as long as tax and accounting law requires.

9. International transfers

Our servers and providers may be located in other countries. When data moves across borders, we rely on the safeguards our providers offer for international transfers.

10. Your rights

You can ask to access, correct, export or delete your personal data, or object to how we use it, by emailing access@msszulfiqaar.com. We answer within 30 days. We may keep some data where the law requires it or to deal with an open abuse investigation, and we will tell you if so. You can also complain to the data protection authority where you live.

11. Age

Zulfiqaar is not intended for anyone under 18, and we do not knowingly collect their data.

12. Changes to this policy

When we change this policy, we update the date at the top of this page. If a change is significant, we will also email account holders before it takes effect.