Full privacy notice

Courtesy translation. The Spanish version is the legally binding one and prevails in case of discrepancy.

1. Data controller

NullGhost, S.A. de C.V. (NullGhost), located at Paseo de la República 1304, C.P. 76120, Querétaro, Qro., Mexico, is responsible for the personal data collected through nullghost.io and the mailbox contacto@nullghost.io. Contact for anything related to this notice: contacto@nullghost.io.

2. Personal data we handle

• Contact form: name and company, business email, phone (optional) and service of interest.
• Free scan form: domain, email, and confirmation that you own the domain or are authorized to request the review.
• Messages and emails you send us: whatever you choose to include (for example name, role, signature and message content).
• Technical browsing data: IP address, date and time, requested page, browser and device, and the referring page when your browser sends it. Kept in server logs.

We do not request sensitive personal data (health, ethnic origin, beliefs, sexual orientation, among others) or financial data. Please do not send them, nor passwords, access keys or sensitive evidence in a first contact.

3. Purposes

We use your data to:

• reply to and follow up on your request;
• prepare quotes and coordinate the scope of a service;
• run and deliver the scan you requested, and verify that the requester owns or is authorized for the domain;
• protect the site, prevent abuse and spam, and diagnose faults (server logs);
• comply with applicable legal obligations.

All these purposes are necessary to handle your request and none requires additional consent. We do not use your data for advertising or any other purpose. If that changes, we will tell you and ask for your consent before using it that way. By submitting a form or writing to us, after this notice was made available to you, we understand that you consent to the processing for these purposes; you can withdraw that consent at any time (section 7).

4. Who processes your data

We do not sell your data or transfer it to third parties for their own purposes. Some providers process it on NullGhost's behalf, only to deliver the service we hire them for:

• Web3Forms: receives form submissions and forwards them to us by email. It is a provider located outside Mexico and may keep a copy of submissions under its privacy policy and the plan we use.
• Apple (iCloud Mail): hosts the contacto@nullghost.io mailbox.
• Amazon Web Services: hosts the site and stores access logs (infrastructure in the United States).

We may disclose data to a competent authority when there is a legal requirement.

5. How long we keep it

• Forms and emails: while we handle your request. If no service is agreed, we delete them at most 12 months after the last contact. If you hire us, they are kept as set by the contract and, afterwards, during the blocking period that matches legal limitation periods before deletion.
• Site access logs: 90 days.

6. Cookies and analytics

nullghost.io does not use cookies or third-party analytics, advertising or tracking tools.

7. Your rights and how to exercise them

You can exercise your rights of access, rectification, cancellation and objection (ARCO), and withdraw your consent, by writing to contacto@nullghost.io with the subject "ARCO rights". Your request must include:

• your name and an address or means to receive notifications;
• documents proving your identity or, if applicable, your representative's;
• a clear description of the data and the right you want to exercise (for access, describing the data is not required);
• any element that helps locate your data.

We will answer within 20 business days of receiving your request. If it is granted, we will carry it out within the following 15 business days after our answer. These periods may be extended once by an equal period when circumstances justify it. Exercising your rights is free of charge; only reproduction, copy or shipping costs may be charged. Cancellation involves a blocking period before final deletion.

If you disagree with our answer, or do not receive one in time, you can file a data protection request with the Secretaría Anticorrupción y Buen Gobierno within 15 days after the answer is communicated to you.

8. How to limit the use or disclosure of your data

Write to contacto@nullghost.io and we will stop contacting you or using your data for the purpose you indicate, except as needed to meet a legal obligation or a contract in force.

9. Third-party data in security reviews

An external review may find public information associated with a domain, such as corporate email addresses that appear in already published leaks. That information is used only to prepare the domain's report and is delivered to whoever proved to own the domain or to be authorized; in the report, access data is shown redacted. If your data appears in a review and you want to exercise your rights, write to the same address. Data handled within a contracted service (evidence, access, results) is also governed by what the contract and scope of the service agree; see Data and scope.

10. Changes to this notice

We will publish any change on this same page, with its update date. If the change alters the purposes or the identity of the controller, we will also notify you at the email you gave us.