Privacy Policy

2.1 Scope

This policy applies to all users — visitors, Free Tier users, and Paid Tier subscribers — and supplements any feature-specific notices we may provide.

2.2 Data We Collect

2.2.1 Data you provide directly

• Account registration — name, email, username, and password. Passwords are stored hashed; we never see the plain text.
• Payment data — subscription tier, billing status, transaction history. Card details go directly to Apple Inc. — we never receive or store them.
• Profile data — optional picture, professional role, skill level, organisation name.
• Support communications — messages, tickets, and feedback you send us.
• User Content — posts, write-ups, comments, and forum contributions.
• Code Submissions — source code, scripts, payloads, and config files submitted to vulnerability scanning or AI-assisted analysis. These can contain sensitive technical material and are handled under Section 2.12.9.

2.2.2 Data collected automatically

• Device data — model, OS version, unique identifiers, network information.
• Usage data — features accessed, challenge completions, time-on-task, navigation paths.
• Log data — IP address, access timestamps, crash logs, error reports.
• System logs — kept for a minimum of 180 days as required by applicable cybersecurity law.

2.2.3 Data from third parties

If you sign in via Google or Apple Sign-In, we receive whatever data that provider shares with you based on your settings with them. Analytics and crash-reporting partners may provide aggregated or pseudonymised usage data.

2.3 Legal Bases for Processing

• Consent — obtained before we collect data where law requires it. You can withdraw at any time by contacting info@exploitus.site.
• Contract performance — account management, delivering the Service, processing payments.
• Legitimate interests — running, securing, improving, and developing the Platform, including training our proprietary AI models, where not overridden by your rights.
• Legal obligations — retention requirements, breach notification, and cooperation with authorised authorities.

2.4 How We Use Your Data

• Providing, operating, and maintaining the Service.
• Account management, authentication, and security.
• Processing payments and managing your subscription.
• Personalising your learning experience and tracking progress.
• Sending transactional messages — receipts, password resets, security alerts.
• Sending promotional communications, only with your consent where law requires. Opt out any time via the unsubscribe link or info@exploitus.site.
• Detecting and preventing fraud, abuse, and policy violations.
• Training, evaluating, and improving our proprietary AI models — using interaction data, usage patterns, Code Submissions, and User Content in anonymised or pseudonymised form. Where GDPR or equivalent law applies, we obtain your consent for this separately and in advance.
• Building and testing new features.
• Meeting legal obligations and responding to lawful requests.

2.5 Data Sharing and Disclosure

We don't sell your data. We share only what's necessary, with:

• Service providers — hosting, analytics, support, email delivery, crash reporting. Each is bound by a data processing agreement that limits use to our instructions.
• Apple Inc. — for in-app purchases and App Store compliance.
• Professional advisors — lawyers, auditors, accountants, all under confidentiality obligations.
• Authorities — when legally required or necessary to protect safety or comply with a lawful order.
• Business transfers — in a merger or acquisition, subject to the acquirer honouring this policy or providing updated notice.

2.6 Cross-Border Data Transfers

Your data may be processed in countries other than your own. Where law requires it, transfers only happen with your explicit consent and/or under appropriate contractual safeguards — such as standard contractual clauses — and prior authorisation from the relevant data protection authority. We'll tell you before any such transfer takes effect.

2.7 Data Retention

We keep your data while your account is active, or as long as needed to deliver the Service. After account deletion, personal data is deleted or irreversibly anonymised within 90 days — except where:

• Law requires longer retention (e.g. the 180-day minimum for system logs).
• We need it to resolve a dispute, enforce an agreement, or meet a legal obligation.
• Data has been used in an AI training pipeline in anonymised form — those derivatives may persist as part of training datasets in a way that can't re-identify you.
• Data is fully aggregated and de-identified, in which case it may be kept indefinitely for analytics.

2.8 Data Security

We use TLS 1.2+ encryption in transit and at rest, strict role-based access controls, regular security assessments, and secure development practices.

If a breach is likely to risk your rights and freedoms, we'll notify you and the relevant authority within 72 hours of becoming aware. No system is perfectly secure, but we'll always tell you quickly if something affects your data.

2.9 Children's Privacy

The Service isn't for children under 13. If we discover we've collected data from someone under 13 without verified parental consent, we'll delete it immediately. Users aged 13–17 may only use the Service with verified parental or guardian consent through our consent process.

If you think we have a minor's data, email info@exploitus.site — we'll act within 24 hours of confirmation.

2.10 Your Rights

Depending on where you are, you may have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion, subject to retention obligations.
• Portability — receive your data in a structured, machine-readable format.
• Restriction — limit how we process your data in certain circumstances.
• Objection — object to processing based on legitimate interests, including use of your data for AI training.
• Withdrawal of consent — pull back any consent you've given, at any time, without affecting what we did before.

Write to us at info@exploitus.site from your registered email. We'll verify your identity and respond within 30 days. We won't treat you differently for exercising these rights.

2.11 Cookies and Tracking

Our mobile app doesn't use browser cookies. We may use mobile analytics SDKs to collect usage and performance data as described above. You can manage tracking permissions through your device's OS settings.

2.12 AI Features and Data Processing

Exploitus uses AI for personalised hints, vulnerability analysis, code scanning, adaptive learning paths, and write-up feedback. Here's how that works with your data.

2.12.1 What our AI processes

• Prompts and queries — anything you type into an AI feature, like hint requests or code checks.
• Code Submissions — code, scripts, config files, and payloads sent to scanning or analysis features. Handled with extra care under Section 2.12.9.
• Challenge activity — attempt history, solution paths, payloads, completion records.
• Skill and progress data — your skill level, module completions, time-on-task, and learning path.
• User content — write-ups, notes, and comments used to generate feedback.
• Session context — just enough context to make AI responses coherent within a session.

2.12.2 Legal basis for AI processing

• Contract — AI hints and vulnerability analysis are core parts of the Service you signed up for.
• Legitimate interests — improving accuracy, safety, and our own model development, where balanced against your rights.
• Consent — where we go beyond core delivery (e.g. using your data for training), we get explicit opt-in consent first. You can withdraw it any time.

2.12.3 Third-party AI providers

Some AI features run on third-party LLM infrastructure. When your data reaches those providers:

• We share only what's needed for the specific request — never your full profile or payment info.
• Code Submissions are strictly confidential. Providers are contractually barred from retaining, indexing, or training on your code for any purpose beyond fulfilling the request.
• Every provider is under a written data processing agreement prohibiting use of your data to train their own models.
• Cross-border transfers follow the safeguards in Section 2.6.
• We'll give you advance in-app notice if we switch providers in a way that affects how your data is handled.
• We don't sell your data to AI companies, and no provider can keep or use it beyond the immediate request.

2.12.4 Automated decision-making

Some AI features automatically influence your experience — difficulty settings, learning path suggestions, performance feedback. These don't produce legal decisions or significant real-world consequences outside the app. If we ever introduce automated decisions with significant effects as defined by law, we'll explain the logic and give you a way to request human review.

2.12.5 How long we keep AI interaction data

• Prompts and outputs — up to 90 days for security and quality purposes, then deleted or anonymised. Anonymised derivatives in training pipelines may persist longer.
• Session context — discarded when the session ends, unless you explicitly save something.
• Aggregated usage patterns — kept indefinitely in non-identifiable form.
• Security logs — may be kept beyond 90 days if tied to an active incident or investigation.

2.12.6 AI data security

• All AI inputs travel over TLS 1.2+ and are never logged in plain text in production.
• Access to AI interaction logs is limited to authorised personnel with a documented need.
• We periodically review our AI providers' security as part of vendor due diligence.

2.12.7 Your rights over AI features

• Opt out of optional AI — turn off non-essential AI features like personalised learning paths in Settings, without losing core access.
• Access your AI history — email info@exploitus.site with subject "AI Data Request".
• Delete your AI history — email us with subject "AI Data Deletion".
• Object to AI personalisation — we'll stop or restrict unless we have compelling grounds to continue.
• Request human review — if an AI output has materially and unfairly affected your experience, contact us.

All AI rights requests are handled within 30 days of identity verification.

2.12.8 How we use your data to train our own models

We use data from your use of the Service — interaction data, usage patterns, AI inputs, User Content, and Code Submissions — to train, evaluate, and improve Exploitus's own AI and security analysis models.

What we train on

• Interaction and usage data — challenge attempts, navigation, feature usage, time-on-task.
• AI inputs and outputs, in pseudonymised or anonymised form.
• User Content — write-ups, notes, forum posts, in pseudonymised or anonymised form.
• Code Submissions, after the pre-processing safeguards described in Section 2.12.9.

Legal basis

• Legitimate interests — building better, safer tools, balanced through the anonymisation and filtering safeguards in this policy.
• Consent (where required) — for users in GDPR or equivalent jurisdictions, we get separate opt-in consent before using your data for training. You can withdraw at any time without losing access.

Safeguards

• Data is pseudonymised or anonymised before entering any training pipeline.
• Once incorporated into model weights, those derivatives can't be individually reversed — but stored raw data remains subject to your erasure rights under Section 2.10.
• Training data is never shared with third parties for their own training and is never sold.

Your rights

• Opt out — email info@exploitus.site with subject "Training Opt-Out". Takes effect from that point forward.
• Erasure of raw data — request deletion of stored submissions under Section 2.10, completed within 90 days.
• Access — request a summary of data categories used for training via "Training Data Request".

2.12.9 Code Submissions — extra safeguards

Code Submissions are treated as sensitive technical data. On top of everything else in this policy, the following apply.

Before training use

Every Code Submission goes through:

• Credential scrubbing — automated detection and removal of API keys, passwords, tokens, private keys, and similar secrets.
• Pseudonymisation — account identifiers and directly identifying metadata are stripped or replaced with non-reversible pseudonyms.
• Sensitive pattern filtering — heuristic filters to catch and exclude code containing personal data, proprietary business identifiers, or regulated data categories.

What we don't do

• We don't share identifiable Code Submissions with third parties for their training.
• We don't sell Code Submissions or derived training data.
• We don't use Code Submissions to reconstruct or disclose any user's codebase to others.
• Third-party providers receiving code to fulfil a request are contractually barred from keeping or training on it.

Retention

• Raw Code Submissions are kept for up to 90 days, then deleted or irreversibly anonymised.
• Anonymised derivatives in training pipelines may be kept beyond 90 days in a form that can't re-identify you.
• Submissions tied to a security incident or policy investigation may be kept longer as needed.

Your rights

• Opt out of training use — email info@exploitus.site with subject "Code Training Opt-Out".
• Erasure — request deletion of stored Code Submissions within 90 days of a verified request.
• Access — request a record of stored submissions via "Code Data Request".

2.13 Data Protection Officer

Where required by law, we appoint a Data Protection Officer to oversee compliance. Contact them at info@exploitus.site with "DPO" in the subject line.

2.14 Updates to This Policy

We may update this policy from time to time. Material changes will be communicated via in-app notice or email at least 14 days before they take effect. Continuing to use the Service after that date means you accept the changes. If you don't, you can stop using the Service and close your account.