Privacy Policy
What we collect to run a RiskBits Check, why, and your rights. We collect as little as we can.
Effective 25 October 2026
1. Who is responsible
The data controller is Ionuț-Robert Sandu, Persoană Fizică Autorizată (PFA), CUI 51596898, B-dul Bucureștii Noi 136, parter, ap. 5, Sector 1, Bucharest, Romania. Privacy questions: hello@riskbits.net.
2. What we collect
- Order & authorization: your name, role, company, email, the targets in scope, your scope notes, and the authorization you give (with a timestamp and the IP address it was submitted from) — this is our record of consent for active testing.
- Assessment data: the technical results of scanning your authorized targets (public and reachable information about those systems), and any evidence needed to demonstrate a finding.
- Billing: Stripe processes payment; we receive your payment and tax-id details and status — never your card number.
- Free check: if you run the instant check, the domain you enter and a short-lived per-IP counter to prevent abuse.
3. Why (legal basis)
To perform the assessment you ordered (contract), to keep an authorization record for active testing and to prevent misuse (legal obligation and legitimate interest), and to keep billing records (legal obligation).
4. Who processes data for us
- Cloudflare — hosting, storage (Workers KV), report rendering and email delivery.
- Stripe — payments and invoices.
During an assessment we query public services about your targets (for example DNS, certificate-transparency logs and vulnerability databases) with the target identifiers only — never with your personal data. We do not sell or share personal data.
5. How long we keep it
We keep the report, the assessment data and the authorization record for as long as needed to provide and stand behind the assessment, and to meet legal obligations — typically up to 24 months for assessment data, longer for the authorization and billing records where the law requires it. You can ask us to delete the assessment data sooner.
6. Your rights
You can access, correct, export or delete your personal data, object to processing and restrict it — by email. You may also complain to the Romanian data protection authority (ANSPDCP) or the authority in your country.
7. International transfers
Cloudflare and Stripe may process data outside the EU under the European Commission's Standard Contractual Clauses and their data processing agreements.