Privacy notice

Last updated: 17 October 2026

Privacy · Terms · DPA · Security · Imprint

We offer this service to businesses in the European Union, so the GDPR applies to our processing of your personal data (Article 3(2)) even though we are established outside the EU. Our representative in the EU, the EEA and the UK under Article 27 GDPR and Article 27 UK GDPR is Data Protection Representative Limited (trading as DataRep); how to reach them is under Your representative in the EU and the UK.

This notice covers the data we decide about ourselves. For the personal data you upload or enter as a customer, you are the controller and we are your processor; that relationship is governed by the Data Processing Agreement, which applies to every plan.

If you reported a vulnerability through a manufacturer's reporting page on our service, or a manufacturer put your email address on its list for security advisories, that manufacturer is the controller of your report or address and we process it on their behalf under the DPA: we store the report and the optional name and email address you gave, or your address on their list, alert the manufacturer, and send you the acknowledgment or advisory emails they ask us to send, each advisory email with a link that unsubscribes you. Your IP address is used only in memory to limit abuse and is not stored. To exercise your rights, contact the manufacturer; if you write to us, we pass your request on to them.

What we process and why

• Account data (email, name/username, Auth0 identifier): to provide the service and authenticate you. Legal basis: contract (Art. 6(1)(b) GDPR).
• Product, SBOM and vulnerability data you upload or that we derive: the service itself. Legal basis: contract.
• Notification settings and contact details you enter for CRA reporting: pre-filling your drafts and alerting you. Legal basis: contract.
• Evidence log (who did what, when): the audit trail you rely on. Legal basis: contract and our legitimate interest in providing verifiable records.
• Billing data via Stripe: to charge for the service and meet accounting obligations. Legal basis: contract; legal obligation.
• Technical logs (IP address, user agent, request metadata) for security and reliability. Legal basis: legitimate interest (Art. 6(1)(f)).
• Walkthrough bookings: if you book a call through our booking page, Cal.com, Inc. (USA) receives the name, email address and answers you enter and passes the appointment to our Google Calendar (Google, USA); the call itself runs on Google Meet. We use this only to hold and prepare the call, and delete the booking details within 12 months unless you become a customer. Legal basis: steps at your request before a contract (Art. 6(1)(b)) and our legitimate interest in answering you (Art. 6(1)(f)). Cal.com and Google transfer data to the United States under their own Standard Contractual Clauses.

Recipients and sub-processors

This is the complete list. It is the same list that forms the Annex to our DPA, where you also find the 30 day notice period and your right to object to a new sub-processor. The lookup recipients below (OSV.dev, FIRST EPSS and NIST NVD) receive component and CVE identifiers from your SBOMs and no personal data; what each one receives is stated per service. We do not sell data, we do not share it for advertising, and we do not use it to train models.

Lookup recipients (no personal data)

To find advisories and exploitation signals we query public vulnerability services. These receive technical identifiers only. They receive no account data, no product names and no SBOM documents. Your component list is nevertheless commercially confidential, so we send identifiers only, never the SBOM itself, and store the results ourselves. All three lookups run on every scan by default.

Removed from this list on 11 September 2026: Google LLC (Google Fonts). The interface's web fonts are self-hosted from our own domain, so no visitor data reaches Google on page load. Removing a recipient does not require the 30 day notice that adding one does.

Your own alert endpoints (an email address, a Slack incoming webhook or an HTTPS webhook you enter in Settings) receive alert content when you configure them, and a Jira Cloud site or GitHub repository you connect under Settings › Integrations receives the tickets you create from a case. Those endpoints and services are yours, not our sub-processors.

Alert email is sent through our own provider; there is no option to supply your own SMTP server. If you configure a Slack or HTTPS webhook in Settings, alert content also goes to that endpoint, which is yours and not our sub-processor.

International transfers

Your account, product, SBOM, case and evidence data is stored and processed in the EU (Frankfurt, Germany (EU)). Because we are established in the United States of America, our staff access that data from outside the EU to operate and support the service. For customers, that transfer is covered by the EU Standard Contractual Clauses, Module Two, incorporated into the DPA, together with a transfer impact assessment you can read there. Stripe and Twilio process data in the United States under their own Standard Contractual Clauses. Auth0 stores your login identity in its EU region. The web fonts are served from our own domain, so loading a page sends nothing to a font provider.

How long we keep data

We are precise here, because a promise the software does not keep is worse than no promise.

• While the account exists: account data, products, SBOMs, cases, drafts and the evidence log are kept for the life of the account. Nothing is deleted automatically and there is no per-plan purge. The evidence log is designed to be long-lived proof, so we do not trim it.
• Export at any time: Settings gives you a complete JSON export of everything the account holds, including the evidence log and its verification data. You do not need to ask us and you do not need a special plan.
• Deletion by you: deleting the account in Settings is immediate and irreversible. It removes products, versions, SBOMs, components, matches, cases, deadlines, drafts, evidence events, anchors, notification settings, API keys and invites, and anonymises the account record. There is no grace period and no undo, so export first.
• After termination or non-payment: if the contract ends and you do not delete the account yourself, we delete the account data within 90 days of the end of the contract. This is a step we run, not an automatic timer in the product, and we send an export reminder to the account owner before we do it.
• Backups: the weekly database dumps roll off after twelve weeks, so deleted data can persist in a backup for up to that long. Backups are used for disaster recovery only.
• Billing records: invoices and the accounting data behind them are kept for the statutory retention period under tax and commercial law, together with the Stripe customer identifier that links them.
• Technical logs: held by our hosting provider under its log retention and not archived by us.

Your rights

Access, rectification, erasure, restriction, portability and objection, and the right to complain to your supervisory authority (Art. 77 GDPR). Export and deletion are self-serve in Settings. For anything else write to support@exploitclock.com; we reply within 2 business days and complete the request within the statutory deadline. If you are an employee or contact person of a customer, your employer is the controller for that data, so we will pass your request on to them.

Your representative in the EU and the UK

ExploitClock LLC (trading as ExploitClock and exploitclock.com) has appointed Data Protection Representative Limited (trading as DataRep) as its data protection representative in the European Union and the EEA (Article 27 GDPR) and in the United Kingdom (Article 27 UK GDPR). If you are in the EU, the EEA or the UK, you can contact DataRep about how we process your personal data and to exercise your rights:

• by email to datarequest@datarep.com, with “ExploitClock LLC” in the subject line;
• through DataRep's web form at datarep.com/data-request, naming ExploitClock LLC as the organisation;
• by post to the DataRep address in your country, listed below. Address the letter to “DataRep”, not to us, or it may not reach them.

DataRep, or we, may ask you to verify your identity before answering, so that your data goes to no one but you. DataRep handles your request under its own privacy notice at datarep.com/privacy-policy. Questions about the ExploitClock service itself (your account, billing, support) go to support@exploitclock.com, not to DataRep, and you can always send a data protection request to us directly there too.

Cookies

Two cookies, both set by us, neither used for tracking:

• Session cookie: signed, HTTP-only, strictly necessary to keep you logged in. It expires with the session (2 hour idle, 8 hour absolute).
• Language cookie (lang): set when you switch between English and German, kept for one year so the site stays in the language you chose.

There are no analytics, advertising, profiling or session-recording cookies, so there is no consent banner to click. Both cookies are strictly necessary or set on your explicit request under § 25(2) TDDDG.

Automated decision-making

We do not make automated decisions with legal effect about people. The matching engine scores components and vulnerabilities, not individuals.

Changes

We announce material changes to this notice by email to the account owner and publish the date above. Previous versions are available on request.