Legal
Privacy policy
This policy explains what information Spyandhack collects, why we collect it, how we protect it and the choices you have. It applies to our website and to enquiries made through it.
Last updated: January 15, 2026
1. Information we collect
We collect information you give us directly, such as your name, email address, organization and the details you submit through our contact or scope-request forms. When you visit the site we may also collect limited technical data such as your browser type, pages viewed and approximate region, used only in aggregate.
2. How we use information
We use your information to respond to enquiries, scope and deliver authorized services, meet legal and contractual obligations, improve our website, and communicate about security-relevant updates. We do not sell your personal data.
3. Legal basis
Depending on your region, we process data on the basis of your consent, the performance of a contract, our legitimate interests in operating a secure business, or a legal obligation. You may withdraw consent at any time where consent is the basis.
4. Cookies & analytics
We use a minimal set of cookies and local storage. A theme-preference value is stored locally so the site remembers your light or dark choice. Any analytics we use are privacy-respecting and aggregate. You can clear cookies and local storage through your browser settings at any time.
5. Data sharing
We share data only with trusted service providers who help us operate the site, or where required by law. We never share client engagement details, findings or credentials with third parties without authorization.
6. Data retention
We keep personal data only as long as needed for the purposes described here, or as required by law and our contractual obligations. Engagement artifacts are retained per the agreed statement of work and then securely deleted.
7. Your rights
Depending on your jurisdiction you may have the right to access, correct, delete, restrict or port your personal data, and to object to certain processing. To exercise any right, contact us using the details below and we will respond within the timeframe required by law.
8. Security
We apply appropriate technical and organizational measures to protect your data, including encryption in transit, access controls and least-privilege handling. No method of transmission is perfectly secure, but we work hard to protect what you share with us.
9. International transfers
If you access the site from outside our home region, your data may be transferred and processed elsewhere. We rely on appropriate safeguards for any such transfer.
10. Children's privacy
Our services are for businesses and adults. We do not knowingly collect personal data from children. If you believe a child has provided us information, contact us and we will remove it.
11. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top reflects the most recent revision. Material changes will be highlighted on the site.
12. Contact
For privacy questions or requests, contact us through our contact page or at the email address listed there. Replace placeholder contact details with your real, monitored address before going live.
Template notice. This policy is a starting point, not legal advice. Have a qualified attorney review it for your jurisdiction and actual data practices before publishing.