VulCode

Trust and documents: security, GDPR, terms and vulnerability disclosure

Everything a client's IT department or lawyer wants to check before signing, in one place. Each topic has its own page with the full content.

Terms of service
The Trust and documents page on vulcode.com with the browser tools open: the cookie list for vulcode.com is empty

Documents and policies

Three documents that govern working with us and the site. For each, its chapters and the points people check most often.

Terms of Service

Version effective from: 10 October 2026
1General provisions
2Definitions
3Formation of contract and scope of work
4Delivery and acceptance
5Remuneration and payment
6Copyright and licences
7Warranty and support
8Liability
9Confidentiality
10Personal data
11Maintenance and service levels
12Third-party services
13Security and backups
14Force majeure
15Termination
16Consumers and sole traders with consumer rights
17Complaints
18Website, client panel and communication
19Amendments to the Terms
20Final provisions
  1. The contract is made when we confirm the order in writing, email included, or when you pay the advance.
  2. We may use subcontractors; anyone who would access your data is named before work starts.
  3. Matters the terms do not cover fall under the law applicable to the contract.

Privacy Policy

Last updated: 18 May 2026
1Data Controller
2Data We Collect
3Purpose and Legal Basis for Processing
4Newsletter
5Analytics - In-House System
6Data Sharing
7Data Retention
8Your Rights
9Data Security
10Changes to the Privacy Policy
11Contact
  1. Our own analytics, without Google Analytics or third-party trackers.
  2. We do not sell your personal data.
  3. A form message up to 12 months from the last contact, client data for the contract term and 5 years after it.

Cookie Policy

Last updated: 13 October 2026
1What this document covers
2What cookies and similar technologies are
3Categories used
4What exactly we use
5Legal basis
6Third parties
7How to delete stored data and withdraw consent
8Storage period
9Changes to this Cookie Policy
10Contact
  1. The site sets no cookies and uses browser storage only.
  2. The only marketing data is a referral code from a link, with no ads and no profiling.
  3. Apart from the five items of the full list the site stores nothing in the browser.

Security, vulnerabilities and GDPR on their own pages

Since 6 October 2026 each of these topics has its own page with the full content, and the reporting address is also in the security.txt file.

  • Sign-in to the VulCode client panel with the too-many-attempts message and the Discord sign-in button

    Security

    Where we keep code, how the panel is protected and what happens at handover.

    Read
  • A vulnerability report to hello@vulcode.com: where, what, how to reproduce, impact, proof and credit

    Vulnerability disclosure

    How to report a flaw, what not to test and what happens next.

    Read
  • An email from the VulCode client panel with the account deletion link, valid for 24 hours

    GDPR and data processing

    When we process data on your behalf and what the processing agreement covers.

    Read

The key points of our terms

The six points legal departments ask about most, word for word and next to them the same in plain words. Where they differ, the full text applies.

VulCode terms of service
Version effective from: 10 October 2026
Full terms of service

  1. clause 5.2 Advance and payment

    Wording: Unless otherwise agreed, an advance payment of 50% of the total Order value is collected before work commences. The remaining 50% is due upon final acceptance.

    In plain words: Unless agreed otherwise, you pay 50% of the order value before work starts and the rest after final acceptance.

  2. clause 6.1 Rights to the code

    Wording: Upon full settlement of remuneration, the Client acquires full economic rights to the code, graphics, and other materials created specifically for the Client within the scope of the Order.

    In plain words: Once paid in full, the full economic rights to the code and graphics made for you pass to you. Open source libraries keep their own licences.

  3. clause 6.2 Portfolio

    Wording: VulCode retains the right to present completed work in its portfolio, unless the Client has required confidentiality.

    In plain words: We may show the project in our portfolio unless you ask for confidentiality.

  4. clause 7.1 Warranty

    Wording: VulCode provides a warranty for delivered software in accordance with the scope specified in the Order (typically 90 days from final acceptance, unless the Order states otherwise).

    In plain words: 90 days from acceptance. It covers bugs in our work, not functional changes or your own modifications.

  5. clause 9.1 Confidentiality

    Wording: Both parties undertake to maintain the confidentiality of all confidential information obtained in connection with the execution of the Order.

    In plain words: Both parties keep information obtained during the order confidential.

  6. clause 19.1 Changes to the terms

    Wording: VulCode reserves the right to amend these Terms of Service. Clients will be notified of material changes at least 14 days in advance.

    In plain words: We announce material changes at least 14 days in advance.

When we are the controller and when we process data for you

This decides which document applies. Examples from everyday work.

If you write through the form on vulcode.com,

Data controller

then our privacy policy applies. Privacy policy

If you open an account in the client panel,

Data controller

then our privacy policy and terms apply. Privacy policy

If we maintain your site holding your customers' data,

Processor

then we sign a processing agreement under Art. 28 GDPR. GDPR and data processing

If we move your store together with its customer base,

Processor

then we sign a processing agreement under Art. 28 GDPR. GDPR and data processing

If we build a landing page without a form,

No personal data processed

then the terms and the order are enough. Terms of service

Data protection in short

What can be checked in the code of the site and the panel, not declarations. Details on the Security page.

On vulcode.com

Cookies set by vulcode.com

No cookies

Browser storage: the full list from the cookie policy
  • A visit id for the statisticsanalytics
    until you remove it
  • The page visited beforeanalytics
    until the tab closes
  • The last opened questions, at most 5analytics
    until the tab closes
  • A referral code from a referral linkmarketing
    until the tab closes
  • Sign-in to the admin panel, authorised people onlynecessary
    7 days
  • Encrypted connectionsThe site and the panel run over HTTPS only.
  • A site without cookiesvulcode.com sets no cookies; it uses browser storage, listed item by item in the cookie policy.
  • Our own analyticsNo Google Analytics or third-party trackers; IP addresses are anonymised.

In the client panel

Account settings in the VulCode client panel: the password changed message with other devices signed out, the email change, the Sign out everywhere button and account deletion
  • Passwords and sign-inWe store passwords only as bcrypt hashes. A password change ends the other sessions, and after 30 failed attempts in 15 minutes the panel blocks further ones from that address.
  • Sign out everywhereOne button ends every session, and the list of recent sign-ins stays in the panel.
  • Deleting the accountAfter you confirm with the link from the email the account is gone in 3 days, and until then you can undo it.

Who is behind VulCode

The same details you will find in our terms and privacy policy.

VulCode details

Service provider
Michał Fox, trading as VulCode
Contact
hello@vulcode.com
City
Kraków, Poland. We have no office for meetings; we come to the client.
Governing law
Polish law, in particular the Civil Code
Working languages
Polish and English
GDPR supervisory authority
President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw

Questions from IT and legal

What an IT department or a lawyer asks before signing.

Need a document that is not here?

Tell us what your IT department or lawyer requires. We will reply with what we can sign and in what form.