Privacy Policy

1.1 Information You Provide

We collect the information you choose to submit through our forms:

• Contact and inquiries: your name, email address, and message.
• Free security assessment: your name, work email, phone, company details, and your answers about your security posture.
• Service, partner, and penetration-test requests: your name, work email, company, and the details needed to scope the work.
• Security-testing authorizations: signer name and title, company legal name, the domains or application in scope, and a record of your acceptance (the exact accepted text, a timestamp, your IP address, and your electronic signature) kept as legal evidence that the testing was authorized.

1.2 Information Collected Automatically

Our website is a static site with no advertising or analytics trackers, so automatic collection is limited to:

• Server logs: your IP address, browser type, and the time of your request, recorded by our hosting provider to operate and secure the site.
• Bot protection: when you submit a form, Cloudflare Turnstile runs a security check that may process your IP address and set a strictly necessary cookie to tell humans from automated bots.
• We do not use analytics or advertising cookies, and we do not build behavioural profiles of you.

We use your information for the purposes below. Where the DIFC Data Protection Law (DIFC Law No. 5 of 2020), the EU or UK GDPR, or a similar law applies, our legal basis is shown in brackets:

• To respond to your inquiries and requests [your consent; our legitimate interest in answering you].
• To scope and deliver the services you request, including assessments, scans, and penetration tests [performance of a contract; your consent].
• To keep a record of the security-testing authorizations you give us [legal obligation; our legitimate interest in evidencing authorized testing].
• To secure our website and prevent fraud and abuse [our legitimate interest in security].
• To meet our legal, regulatory, and tax obligations [legal obligation].

We do not send marketing emails unless you ask us to, and we do not make automated decisions that produce legal effects about you.

3.1 Service Providers

We share your information only with the providers that operate our services, each bound by contract to protect it and use it solely on our instructions:

• Netlify — website hosting and server logs.
• Cloudflare — Turnstile bot protection on our forms.
• Resend — delivering the confirmation and notification emails triggered by your submission.
• Our secure client portal, operated for Zeroday — receiving and managing your request or engagement.

3.2 Legal Requirements

We may disclose your information if required by law or in response to court orders, subpoenas, or government requests, or to protect our rights and safety.

3.3 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may transfer to the acquiring entity under this Policy.

3.4 No Sale of Data

We do not sell your personal information, and we do not share it for advertising.

We set no non-essential cookies and show no cookie banner. The only cookies are the strictly necessary ones set by Cloudflare Turnstile on pages with forms, to distinguish humans from automated bots. You can block cookies in your browser settings, but our forms may then be unable to verify your submission.

Zeroday Technology, LLC is based in the United States, and some of our providers process data in the United States and other countries. Where we transfer personal data out of the DIFC, the EEA, or the United Kingdom, we rely on appropriate safeguards — such as the European Commission’s Standard Contractual Clauses or an equivalent mechanism — a copy of which you can request at privacy@zeroday.group.

We keep personal data only as long as necessary, then delete or anonymise it:

• Inquiries and form submissions: up to 24 months after our last contact with you.
• Security-testing authorization records: up to 12 months after the engagement, as legal evidence.
• Server logs: up to 90 days.

Depending on where you live, you have some or all of these rights over your personal data:

• Access — a copy of the data we hold about you.
• Rectification — correction of inaccurate data.
• Erasure — deletion of your data.
• Restriction — limiting how we process it.
• Portability — a copy in a portable, machine-readable format.
• Objection — to processing based on our legitimate interests.
• Withdraw consent — at any time, without affecting processing already carried out.

To exercise any of these, email privacy@zeroday.group; we respond within the time the applicable law requires. You also have the right to complain to a data-protection authority — for DIFC matters, the DIFC Commissioner of Data Protection; in the EEA or UK, your local supervisory authority.

We apply appropriate technical and organizational measures to protect your personal data, including encryption in transit and at rest, access controls, and least-privilege handling. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the relevant authority of a breach where the law requires.

Our website and services are intended for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact privacy@zeroday.group and we will delete it.

We may update this Policy from time to time. We will update the “Last Updated” date above, and we will post material changes on this page.

For any privacy question, or to exercise your rights, contact the controller — Zeroday Technology, LLC — at privacy@zeroday.group.