Proofsec - Security Research & Bug Bounty Platform

1. Who we are

Proofsec is a platform project operated from Croatia, European Union. Proofsec has not yet been registered as a legal entity. Until a legal entity is established, references to "Proofsec", "we", "us" or "our" mean the people operating and developing the Proofsec platform, as applicable.

For privacy-related questions, requests or concerns, contact contact@proofsec.net. Our current country of operation is Croatia, within the European Union.

This policy describes the intended privacy framework for the Proofsec platform. The identity of the legally responsible controller must be determined according to the actual operating arrangements and applicable data protection law.

2. Scope of this policy

This Privacy Policy applies to personal data processed in connection with the Proofsec website, user accounts, profiles, security research activities, collaboration sessions, vulnerability reports, organization features, communications and related platform services.

It applies to researchers, team members, organization representatives, visitors and other individuals whose personal data is processed through the platform.

Separate program rules, contractual terms or notices may apply to particular activities. If another notice explains a specific processing activity in greater detail, it should be read together with this policy.

3. Personal data we may process

The personal data processed depends on which Proofsec features you use and what information you choose to provide. We aim to process only data that is relevant to operating, securing and improving the platform.

Account and identity data: username, name if provided, email address, profile image, country, biography and profile links.
Profile and community data: reputation indicators, achievements, participation history and other information associated with your profile or platform activity.
Research and report data: vulnerability descriptions, reproduction steps, technical findings, evidence, notes, code snippets, attachments and communications submitted through the platform.
Collaboration data: team membership, session participation, messages, shared files and other content created or shared through collaboration features.
Organization data: organization name and details, representative contact information, program configuration, asset scope, rules, report decisions and related administrative records.
Reward and payment data: reward amounts, payment status, transaction references and records needed to administer rewards. Payment card or banking details may be handled by the relevant payment provider rather than stored directly by Proofsec.
Technical and usage data: IP address, browser and device information, timestamps, diagnostic information, authentication-related data, security events and interactions with platform features, where collected.
Cookie and analytics data: identifiers, page visits, feature usage, referral information and similar events, depending on the analytics technologies enabled and your applicable consent choices.
Support and correspondence data: messages and information you provide when contacting Proofsec or requesting assistance.

4. Information about other people

You may include information about other people in a vulnerability report, support request, organization record or collaboration message. You should include only information that is relevant to the legitimate purpose of the submission and that you are permitted to provide.

Do not upload passwords, authentication tokens, private communications, identity documents or other sensitive personal information unless it is strictly necessary for the report and the relevant submission process permits it. Redact unrelated personal information from screenshots, logs, files and proof-of-concept material whenever possible.

If a report contains personal data relating to another person, access to that report should be limited to what is reasonably necessary for assessment, remediation and related platform operations.

5. How we obtain personal data

We may receive personal data directly from you when you create an account, complete a profile, participate in a session, submit a report, communicate with another user or organization, contact support or use a platform feature.

Some technical information may be generated automatically when your browser or device communicates with the platform. Analytics technologies may also collect usage information, subject to the configuration of those technologies and applicable consent requirements.

We may receive information from organizations, teammates, payment providers or other users when it is relevant to a report, collaboration session, reward or platform operation. Information received from another source should be handled in accordance with applicable law and the context in which it was provided.

6. Why we process personal data

Depending on the circumstances and the legal basis that applies, personal data may be processed for the following purposes:

To create and maintain user accounts, authenticate users and provide requested platform features.
To display profiles, support collaboration and maintain records of participation in research activities.
To receive, organize, review and communicate about vulnerability reports and related evidence.
To allow participating organizations to assess reports concerning their programs and coordinate remediation.
To administer rewards and payments, maintain transaction records and address payment-related questions.
To protect accounts, investigate suspected abuse, detect suspicious activity, reduce spam and identify potentially duplicate reports.
To operate, maintain, troubleshoot and improve the platform and its usability.
To understand platform usage through analytics and evaluate feature performance, subject to applicable consent requirements.
To respond to support requests, communicate service-related information and resolve disputes.
To comply with applicable legal obligations and respond to valid legal requests.
To establish, exercise or defend legal claims where necessary.

7. Legal bases for processing

Where the General Data Protection Regulation applies, personal data must be processed on an applicable legal basis under Article 6 GDPR. The appropriate basis depends on the particular activity and its context.

Performance of a contract or pre-contractual steps: processing necessary to provide an account or feature you request, or to take steps at your request before entering into an agreement.

Legitimate interests: processing necessary for proportionate platform security, fraud prevention, service reliability, report integrity, dispute handling or protection of legal rights, where those interests are not overridden by your rights and freedoms.

Legal obligation: processing necessary to comply with applicable legal requirements, including obligations that may apply to payment, accounting or tax records.

Consent: processing that requires your consent, which may include certain analytics or non-essential cookies depending on the technologies used and applicable law. You may withdraw consent at any time, without affecting processing lawfully carried out before withdrawal.

We do not treat consent as the legal basis for every activity. Where processing relies on consent, the relevant request should explain what you are consenting to and how to withdraw it.

8. Public profiles and visibility

Certain profile information may be visible to other users or to the public when the relevant feature is enabled. This may include a username, profile image, biography, links, achievements, reputation indicators or public participation information, depending on your profile settings and the platform's actual configuration.

Information submitted in vulnerability reports, private messages, collaboration sessions and organization workflows is not intended to be publicly displayed by default. It may be accessible to the organization handling a report, the members of a relevant collaboration session or other authorized recipients where necessary for the feature or process.

Before publishing personal information on a public profile, consider whether you want it to be available to anyone who can access that profile. Information made public may be copied, indexed, cached or redistributed by third parties.

If profile visibility controls are available, you can use them to manage the information displayed through those controls. Changes to visibility may not remove copies already obtained by third parties.

9. Vulnerability reports and research material

Reports may contain technical evidence, affected asset information, reproduction steps, logs, screenshots, code snippets and other material needed to evaluate a security issue. Some of this information may be confidential or may inadvertently contain personal data.

A report may be shared with the organization responsible for the relevant program and with individuals authorized to assess, reproduce, remediate or administer that report. Access should be limited according to the needs of the report-handling process and the applicable program rules.

Researchers should review their submissions before sending them and remove unrelated personal data, secrets and sensitive information. When credentials, tokens or other secrets are necessary to demonstrate an issue, use the minimum information required and follow the relevant program's instructions.

Submitting a report does not automatically authorize public disclosure. Any disclosure must follow the applicable program rules, confidentiality requirements and relevant law.

10. When we share personal data

We do not sell personal data. We may disclose personal data when necessary for the purposes described in this policy, subject to applicable law and appropriate limitations.

Recipients may process data under their own legal responsibilities or under arrangements applicable to their services. Where required by law, appropriate agreements and safeguards should govern processing carried out on our behalf.

Participating organizations: information necessary to review, validate, prioritize and remediate reports submitted to their programs.
Session participants: messages, shared files and other information made available to members of a collaboration session through its features.
Infrastructure and technology providers: information processed to host, store, secure, maintain or deliver the platform.
Payment providers: information necessary to process or administer a reward or payment, where that functionality is used.
Analytics providers: usage and technical information processed by analytics tools that are enabled on the platform.
Professional advisers: information reasonably necessary for legal, accounting, tax, security or other professional assistance, where applicable.
Public authorities and other recipients: information where disclosure is required by law, a valid legal process or is otherwise permitted or necessary to protect legal rights and safety.

11. Hosting, database and platform infrastructure

Proofsec uses Vercel for hosting and Neon for database infrastructure. Personal data processed through the platform may therefore be handled by these providers to the extent necessary to deliver the relevant services.

The specific data processed, the locations in which it is stored, available security controls and applicable contractual terms depend on the services and configurations in use. Users should consult the providers' current privacy and security documentation for information about their respective practices.

Proofsec may change or add infrastructure providers as the platform develops. Material changes to processing practices will be reflected in this policy or in an applicable notice where required.

12. Payments and rewards

Proofsec may use Stripe to support payment-related functionality. When a payment or reward feature is used, Stripe may process information necessary to provide its services, verify transactions, prevent fraud and comply with legal requirements.

The information processed may include contact details, transaction references, payment status and other information required by the relevant payment flow. The exact information depends on the payment method and the functionality implemented.

Proofsec does not claim to store full payment card details itself. Whether any payment information is collected or stored directly by the platform depends on the specific integration and must be assessed against the actual implementation.

Payment processing may also be subject to Stripe's terms, privacy notice, verification procedures and applicable financial regulations. A reward or payment may require additional information to meet legal, tax or payment-provider requirements.

13. Cookies and similar technologies

Proofsec may use cookies and similar technologies to support essential website functions, maintain authentication, protect the platform, remember preferences and understand how the service is used.

Essential technologies may be necessary to provide a feature you request or to maintain the security of the service. Analytics technologies may collect information about visits, page interactions, navigation and feature usage to help evaluate performance and improve the platform.

Non-essential cookies or similar technologies will be used in accordance with applicable consent requirements. Where consent is required, those technologies should not be activated before valid consent is obtained. You should be able to withdraw or change your consent through the available controls.

You can also manage cookies through your browser settings. Blocking essential cookies may prevent sign-in or other platform functions from working correctly. Browser settings alone may not withdraw consent already recorded through a separate consent mechanism.

The exact cookies, identifiers, analytics tools, retention periods and third parties involved depend on the technologies enabled in the deployed version of Proofsec. The platform's actual cookie notice and consent controls should reflect that configuration.

14. Analytics and service improvement

Analytics may be used to understand how people navigate Proofsec, which features are used, whether pages function correctly and where usability or reliability can be improved.

Depending on the analytics tool and configuration, collected information may include page views, interactions, referral sources, approximate location derived from technical information, device or browser details, timestamps and online identifiers.

Analytics data should be limited to what is necessary for the stated purposes. Where analytics relies on consent under applicable law, you can refuse or withdraw that consent without losing access to features that do not require analytics.

The specific analytics provider and its configuration are not identified in this policy because they have not been confirmed here. The deployed service should disclose the provider and relevant details in its cookie or privacy controls before analytics is enabled.

15. Data retention

Personal data is retained only for as long as it is reasonably necessary for the purposes for which it was collected, taking account of the nature of the information, the relevant service, security requirements and applicable legal obligations.

When an account is closed, Proofsec's intended retention period for account-associated personal data is up to 30 days, after which the data should be deleted or anonymized where technically and legally possible.

The 30-day period does not require the deletion of information that must be retained for a longer period under applicable law, that is necessary to establish, exercise or defend legal claims, or that must remain available for legitimate security or fraud-prevention purposes. Any such retention should be limited to the information and period reasonably required for the applicable purpose.

Some information may remain in backups for a limited period before being overwritten or deleted through normal backup cycles. Data retained in backups should remain protected and should not be restored to active use except where necessary for recovery, security or another lawful purpose.

Payment, accounting or tax records may be subject to separate statutory retention periods. Closing an account does not automatically remove records that must legally be retained.

The actual deletion and anonymization process depends on the deployed systems and operational procedures. The stated retention period should be implemented consistently across relevant databases, storage systems, logs and service providers.

16. Your data protection rights

Where the GDPR or other applicable data protection law applies, you may have the right to:

These rights are not absolute and may be subject to legal conditions or exceptions. The rights available in a particular case depend on the applicable law and the processing involved.

Request access to your personal data and information about how it is processed.
Request correction of inaccurate or incomplete personal data.
Request deletion of personal data where the legal requirements for erasure are met.
Request restriction of processing in circumstances provided by law.
Object to processing based on legitimate interests, on grounds relating to your particular situation.
Receive certain personal data in a structured, commonly used and machine-readable format and request its transfer to another controller where the legal requirements for portability are met.
Withdraw consent where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
Lodge a complaint with a competent data protection supervisory authority.

17. How to make a privacy request

To submit a privacy request, contact contact@proofsec.net and describe the request clearly. For example, you may request access to your data, correction of a profile detail, account closure or deletion of personal data.

We may need to verify your identity before responding, particularly where the request concerns account access, deletion or information that could affect another person's rights. Verification should be proportionate to the sensitivity of the request.

We aim to respond within the time limits required by applicable law. Under the GDPR, a response is generally due within one month of receipt. This period may be extended by up to two additional months where permitted by law, taking into account the complexity and number of requests; if extended, the requester must be informed within the applicable deadline.

A request may not result in complete deletion where information must be retained by law or where another lawful exception applies. If a request cannot be fully fulfilled, the response should explain the relevant reasons and available options as required by law.

18. Supervisory authority

If you believe that your personal data has been processed in breach of applicable data protection law, you may lodge a complaint with the competent supervisory authority.

In Croatia, the national data protection supervisory authority is the Croatian Personal Data Protection Agency, known as AZOP (Agencija za zaštitu osobnih podataka). Official information and contact details are available on its website: https://azop.hr/.

You may also have the right to lodge a complaint with another supervisory authority, particularly where you reside, work or believe an infringement occurred, in accordance with applicable law.

19. International data transfers

Some infrastructure, analytics or payment providers may process personal data in countries outside Croatia or the European Economic Area, depending on their services, configurations and subcontractors.

Where a transfer of personal data outside the European Economic Area is subject to GDPR transfer restrictions, the transfer must rely on an applicable legal mechanism. Depending on the circumstances, this may include an adequacy decision, standard contractual clauses or another lawful safeguard.

The safeguards applicable to a particular transfer depend on the provider, the processing arrangement and the relevant destination. Proofsec should verify the transfer terms and applicable safeguards for each provider used in the deployed service.

20. Data security

Proofsec is intended to handle account information, security research material and collaboration data with appropriate care. Measures used to protect that information should be proportionate to the risks presented by the processing.

Depending on the deployed implementation, appropriate measures may include access restrictions, secure authentication, encrypted connections, limited permissions, dependency maintenance, backups, logging and procedures for responding to security incidents.

This policy does not guarantee that every listed measure is implemented in every part of the platform. The actual security controls depend on the systems, integrations and operational practices in use at the relevant time.

No website, transmission method or storage system can be guaranteed to be completely secure. Users should protect their credentials, avoid sharing unnecessary secrets and report suspected account compromise or unauthorized exposure promptly to the Proofsec contact address.

21. Personal data breaches

If you believe that personal data associated with Proofsec has been exposed or accessed without authorization, contact contact@proofsec.net. Provide a concise description of the suspected incident and avoid sending additional secrets or unnecessary personal data.

Where a personal data breach occurs, the applicable response and notification obligations depend on the circumstances and the law. If the GDPR applies, a controller may be required to notify the competent supervisory authority within 72 hours after becoming aware of a breach unless the breach is unlikely to result in a risk to individuals' rights and freedoms. Affected individuals may also need to be informed where the legal threshold is met.

The appropriate response depends on the facts, including the type of data involved, the number of affected people, likely consequences and measures available to reduce harm.

22. Children's privacy and eligibility

Proofsec is designed for people who are legally eligible to use the platform and participate in its security research activities. Users must provide accurate information where requested and must not use the platform in violation of applicable age restrictions or other eligibility requirements.

The applicable minimum age may depend on the service, the terms of participation and local law. Proofsec should establish and publish a clear age requirement before making registration available to users.

If you believe a child has provided personal data in circumstances that are not permitted, contact the Proofsec privacy contact so the matter can be assessed.

23. Third-party websites and services

Proofsec may contain links to external websites, tools or services. Those third parties operate under their own privacy notices and terms, and Proofsec does not control their independent data-processing practices.

When you follow an external link or use an integrated third-party service, review the relevant provider's privacy information before submitting personal data. The presence of a link does not mean that Proofsec endorses every practice of the external service.

24. Changes to this policy

This Privacy Policy may be updated as Proofsec develops, adds features, changes service providers or responds to changes in applicable law.

The current version should be published on the Proofsec website with its effective date. Where a change materially affects users' rights or the way their personal data is processed, additional notice should be provided where required by law.

If a particular processing activity requires consent, publishing an updated policy does not replace the requirement to obtain valid consent where applicable.

25. Contact and effective date

For privacy questions, data protection requests or concerns about this policy, contact contact@proofsec.net.

Proofsec operates from Croatia, European Union, and has not yet been registered as a legal entity. The identity and contact details of the legally responsible controller should be updated once the operating entity and its arrangements have been formally established.

Effective date: September 14, 2026.

26. Privacy checklist for users

Provide only accurate information needed for your account and platform activities.
Review profile visibility before publishing personal information.
Remove unrelated personal information, credentials and secrets from research reports and attachments.
Share files and report evidence only with the people who need access to them.
Review available cookie and analytics controls and make a choice consistent with your preferences.
Contact Proofsec if you need to access, correct or request deletion of your personal data.
Report suspected unauthorized access or personal data exposure promptly.