Legal
Privacy policy
We collect as little as we can, never sell your data, and only send marketing email if you tick a separate box.
Last updated
On this page8
Who we are
VulnCrest provides WordPress penetration testing, incident response and the VulnCrest Radar vulnerability database. VulnCrest is the controller of the personal data described here.
What we collect
- Account: email address, display name, password hash, two-factor secret (encrypted), sign-in sessions.
- Watchlist and sites: plugins and themes you watch, and site URLs you check while signed in.
- Consent records: what you agreed to, when, and the version of the text you saw.
- Security logs: IP addresses stored only as salted hashes, raw IPs kept no longer than 30 days.
Why we use it
To run your account, send the alerts you asked for, protect the service against abuse, and meet legal obligations. Watchlist alerts and account emails are part of the service and do not require marketing consent.
Marketing email and consent
We send the weekly digest and news about VulnCrest services only if you tick the separate, unticked box for it. You can withdraw consent at any time in Notifications or with the one-click unsubscribe link in every email.
How long we keep it
Account data is kept while your account exists. Anonymous Check my site logs are deleted after 30 days. When you delete your account we delete your personal data, keeping only anonymised logs where required.
Sharing
We do not sell or share your email address. We use processors for hosting, email delivery and bot protection (Cloudflare Turnstile) under data processing agreements.
Your rights
You can access, correct, export and delete your data. Export and delete are self-service in Security. Depending on where you live (EU GDPR, Vietnam Decree 13/2023, US state laws) you may have further rights, including complaining to a supervisory authority.
Contact
Email [email protected].