Privacy statement
We collect as little as we can. This site sets no cookies, runs no analytics and loads nothing from other websites.
Last updated
Who we are
ExploitBench is a one-person business in the Netherlands, run by Gerben Brouwer and registered with the Dutch Chamber of Commerce (KvK) under number [NUMBER]. VAT number: [VAT NUMBER]. We are the controller for the personal data described here.
Questions about your data: check@exploitbench.io
When you visit this site
Cloudflare hosts the site. To deliver the pages and block attacks, Cloudflare processes your IP address and the details your browser sends with each request (such as the page address and browser type). We don't receive or keep these logs.
When you ask for a free check
- What
- Your name, email address and company name, what you write in your email, and the component list you send (names and versions). We don't need source code or firmware, so please don't send them.
- Why
- To run the check and send you the result. Legal basis: steps you ask us to take before a possible contract (GDPR article 6(1)(b)). With the result, we also send one email about ongoing monitoring. Legal basis: our legitimate interest in telling you about our service (GDPR article 6(1)(f)). After that we only write if you reply.
- How long
- If you don't become a customer, we delete your email and component list within 30 days of sending the result.
When you are a customer
- What
- Contact details of the people who receive alerts, your component lists, the alerts, triage notes and reports we write for you, and your billing details.
- Why
- To run the monitoring and send alerts and reports. Legal basis: our contract with you (GDPR article 6(1)(b)). We keep invoices because Dutch tax law requires it (GDPR article 6(1)(c)).
- How long
- For as long as your subscription runs, then deleted within 30 days. Invoices and payment records are kept for 7 years, as Dutch tax law requires.
When you report a security issue
If you email security@exploitbench.io, we use your email address and report to investigate and fix the issue, and to credit you if you want. Legal basis: our legitimate interest in keeping this site secure (GDPR article 6(1)(f)). We delete the report within 12 months of fixing the issue.
Who processes your data for us
- Proton AG, Switzerland: email. Your emails and component lists are stored on Proton's servers in Switzerland, Germany or Norway. Germany and Norway fall under the GDPR; Switzerland is recognised by the EU as offering adequate protection.
- Cloudflare, Inc., United States: hosting this website. Cloudflare is certified under the EU-US Data Privacy Framework.
- [Accountant and payment provider, if you use them]
Each of them processes data only on our instructions. We don't sell your data, share it with anyone else or use it for marketing. Your component lists are used only for your own checks.
Your rights
You can ask us to show, correct or delete the data we hold about you, to limit how we use it, or to send it to you in a common file format. You can also object to processing based on our legitimate interest. Email check@exploitbench.io and we reply within 1 month.
We make no automated decisions about you.
If you think we handle your data wrongly, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.
Changes
If we change this statement, we update the date at the top. If a change affects customers, we tell them by email first.