Short, because we
collect little.
This website has no analytics, no advertising trackers and sets no cookies. Here is exactly what we do keep, and why.
Last updated 9 October 2026
01 Who we are
SegfaultSec is a software engineering and security company. For anything in this policy, write to hello@segfaultsec.org.
02 What we collect on this website
Only what you type into a form: the free audit form, the contact form, or the vulnerability disclosure form.
- Your email address, so we can answer you.
- Your name and company, if you give them.
- The website address and the message you send us.
- Your IP address, for a short time, only to stop the same sender from flooding our forms.
03 What we do not collect
This website sets no cookies. We use no analytics, no tracking pixels, no advertising networks and no third-party fonts or scripts. We do not buy, sell or rent personal data.
To show prices in your currency, the page guesses your region from your browser's time zone and language, inside your browser; nothing is sent to us. If you pick a region yourself, that choice is kept in your browser's local storage, which you can clear at any time.
04 Why we use it
To answer your request and to do the work you ask for. A request from a form becomes a record in our own work dashboard, so the engineer who answers you sees what you sent.
05 Clients of our dashboard
If you are a client, your account holds your name, email, company, projects, tickets, messages and invoices. The dashboard uses one cookie to keep you signed in, and one to remember whether you prefer the light or dark theme.
Card payments go through Stripe or Paddle; we never see or store your card number. Invoice emails go through our mail provider.
06 Where it is stored
On servers we run ourselves, and with the providers above where you use them. Connections are encrypted with TLS.
07 How long we keep it
A request that does not become a project is deleted on request, and otherwise after 24 months without contact. Client records are kept as long as you are a client, and invoices as long as tax law requires.
08 Your rights
You can ask what we hold about you, ask us to correct it, or ask us to delete it. Write to hello@segfaultsec.org and we answer within 30 days. If you are in the EU or the UK, you can also complain to your data protection authority.
09 Changes
If this policy changes, the date at the top changes with it.