What we keep, and for how long.
We are a security company. Collecting more data than we need would be hypocritical, so we don't. This policy describes exactly what hack1ng.com does with personal data, and applies to the Site and to personal data we process as a service provider.
01 Who we are
Hack1ng operates the website hack1ng.com and is the controller of the personal data described in clauses 02 and 03. We trade as Hack1ng; no further registration or address details are published at this pre-launch stage. We publish no email address either - see clause 12 for how to reach us.
02 Current state - the form is disabled
The service is preparing for launch and the request form on the Site is disabled. It cannot be submitted. Anything typed into it stays in your browser: it is not transmitted to us, not logged and not stored. Until intake opens, the only personal data we process through the Site is the technical log data in clause 03.
03 What we collect now
- Server log data. Standard web-server request records - IP address, timestamp, requested path, response status, referrer and browser user-agent - generated automatically when a page is served.
- Nothing else. We set no advertising or analytics cookies, run no tracking or fingerprinting scripts, embed no third-party pixels, and operate no newsletter or account system.
04 What we will collect once intake opens
When the request form is enabled it will collect the name, contact email address and scope description you choose to submit, together with the submission timestamp, originating IP address and user-agent for abuse prevention. We will ask for nothing more, and you should not put credentials, sensitive personal data, or detailed vulnerability information into an initial enquiry.
05 Why we are allowed to hold it
- Enquiries (once intake opens): to take steps at your request before entering a contract, and thereafter to perform it.
- Log data and abuse prevention: our legitimate interest in keeping the Site secure, available and free from attack and automated abuse.
- Records we must keep (for example accounting): compliance with a legal obligation.
Where we rely on legitimate interests, we have balanced them against your rights and use the minimum data necessary. You can object - see clause 10.
06 How long we keep it
- Web-server logs: rotated and deleted within 90 days.
- Enquiries that do not become engagements: deleted within 12 months.
- Engagement material (scopes, findings, evidence, reports): retained for the period set in the engagement letter, then securely destroyed with written confirmation.
- Records we are legally required to retain: for the statutory period only.
07 Cookies
The Site sets no cookies. It uses no local or session storage to track you, and there is therefore no consent banner to click. If that ever changes, this policy will be updated before the change takes effect and consent will be requested where the law requires it.
08 Who else sees it
We do not sell, rent or trade personal data, and we do not share it for advertising or profiling. The only third parties involved are:
- the infrastructure providers who host the Site and, once intake opens, carry our email - acting as processors under written contract;
- Google, which serves the two web fonts used by the Site and therefore receives your IP address and user-agent when a page loads;
- professional advisers, and public authorities where we are legally compelled to disclose.
Where personal data is transferred outside your jurisdiction, we rely on an adequacy decision or on standard contractual clauses with supplementary measures as appropriate.
09 Client and engagement data
Personal data we encounter inside your systems during an assessment is processed strictly on your instructions as a processor, under the data-processing terms of your engagement letter and the handling rules in our rules of engagement: minimum necessary extraction, encryption at rest and in transit, least-privilege access, no reuse for any other purpose, no training of models on it, and destruction on the agreed date.
10 Your rights
Subject to applicable law you may ask us to give you a copy of the personal data we hold about you, correct it, erase it, restrict our processing of it, provide it in a portable form, or object to processing based on legitimate interests. We do not carry out automated decision-making or profiling that produces legal effects for you.
We will respond within one month, and may ask for enough information to verify your identity before acting. If you are not satisfied with our response you may complain to your national data-protection authority.
11 Security, children, and changes
- The Site is served over HTTPS only. Access to any data we hold is least-privilege, and evidence from engagements is encrypted at rest.
- The Site is not directed at children and we do not knowingly collect data from anyone under 16.
- If a breach occurs that is likely to result in a risk to your rights, we will notify the competent authority, and you, as required by law.
- If this policy changes materially we will publish a new version and date at the top of this page, and tell affected clients directly.
- Found a flaw in our systems? Please use the channel in security.txt.
12 How to contact us
We deliberately publish no email address and no postal address at this pre-launch stage. Once intake opens, the form on the home page becomes the route for enquiries and for privacy requests. Until then the form is disabled and there is no channel through which to contact us - and because nothing submitted through it is transmitted or stored (clause 02), the only personal data we hold about a visitor is the short-lived server log data in clause 03.
Back to hack1ng