Privacy Policy

Last updated: 24 October 2026

Data Controller

The controller of your personal data is Michał Fox, operating under the "VulCode" brand (hereinafter: "VulCode", "we", "us"), based in Kraków, Poland, email: hello@vulcode.com.

Data We Collect

Depending on how you use our services, we may collect the following data:

Contact and identification data:

Full name / company name
Email address
Phone number (if voluntarily provided)

Technical data (analytics):

IP address: not stored in analytics, used only to compute the daily visit identifier (point 5.2); the server keeps it in its technical logs solely for security
Browser type and version
Operating system
Pages visited and time of visit
Scroll depth

Form data:

Content of contact messages
Email address and category preferences (newsletter subscription)

Purpose and Legal Basis for Processing

Purpose	Legal basis
Performance of the ordered service	Art. 6(1)(b) GDPR (performance of a contract)
Communication regarding an Order	Art. 6(1)(b) GDPR
Sending newsletters	Art. 6(1)(a) GDPR (consent)
Website analytics (in-house, no third-party cookies)	Art. 6(1)(f) GDPR (legitimate interest)
Compliance with legal obligations (e.g. invoicing)	Art. 6(1)(c) GDPR

4.1

Newsletter subscription is voluntary and requires confirmation of the email address (double opt-in).

4.2

You may unsubscribe at any time by clicking the "Unsubscribe" link in any message, or by contacting us at hello@vulcode.com.

4.3

A subscriber's email address is retained until the subscription is cancelled or a deletion request is received.

Analytics - In-House System

5.1

VulCode (vulcode.com) uses its own analytics system (without Google Analytics or any other third-party tracking tools).

5.2

We collect only statistical data (visits, device type, pages) necessary to improve the quality of the service. Data are anonymised and do not allow the identification of any individual. We count a visit on the server: its identifier is a hash of your IP address and browser type with a random value that changes every day and is never stored. The hash cannot be reversed, and the next day it no longer matches the same person. Analytics stores nothing in your browser.

5.3

We do not use cookies for advertising purposes or user profiling.

5.4

The vulcode.com website itself sets no cookies and uses browser storage. The client panel at vulcode.com/panel keeps what it needs for signing in and its settings in browser storage, and sets one cookie for members of the VulCode team once they open an administration session. All of this is first-party data: only VulCode stores and reads it, with no advertising cookies and no third-party tracking tools. A full list of the data stored and how to remove it is set out in the Cookie Policy.

Data Sharing

6.1

We do not sell your personal data.

6.2

Data may be transferred only to entities strictly necessary for the performance of the service (e.g. hosting server, email provider) under appropriate data processing agreements.

6.3

Data may be disclosed to public authorities solely on the basis of applicable law.

Data Retention

Client data (in connection with the performance of Orders): for the duration of the contract and 5 years after its termination (tax and accounting requirements).
Newsletter subscriber data: until cancellation of the subscription.
Analytics data: up to 24 months.
Technical server logs: up to 60 days.
Contact form data: up to 12 months from the last contact.

Your Rights

You have the following rights in relation to the processing of your personal data:

Right of access: you may request information about the data being processed.
Right to rectification: you may request the correction of inaccurate data.
Right to erasure: you may request the deletion of your data ("right to be forgotten").
Right to restriction of processing: you may request that processing be restricted.
Right to data portability: you may receive your data in a structured format.
Right to object: you may object to processing based on legitimate interest.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of your rights, please contact us: hello@vulcode.com

You also have the right to lodge a complaint with the competent supervisory authority for data protection in your country.

Data Security

9.1

We apply technical and organisational security measures appropriate to the risk, including connection encryption (HTTPS), access controls, and regular backups.

9.2

In the event of a personal data breach, we will notify you and the competent supervisory authority in accordance with applicable law.

10.

Changes to the Privacy Policy

We will inform you of material changes to this Policy by updating the date at the top of this document and, where appropriate, by email.

11.

Contact

VulCode Email: hello@vulcode.com Website: https://vulcode.com

Spam protection (Cloudflare Turnstile)

To protect the forms on the site (including the contact form) against spam and abuse, we use Cloudflare Turnstile, provided by Cloudflare, Inc. (USA). For this purpose Cloudflare, acting as a processor, may process technical data, including your IP address and browser behaviour signals, solely to distinguish human traffic from automated traffic. This mechanism may store a technical token in your browser that is necessary for it to work; it is not used for tracking or profiling. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in protecting the site against abuse.