Privacy Policy

Last updated: 2026-08-10 · Effective: 2026-08-10

1. Introduction

This Privacy Policy explains how RealExploit (the "Service"), operated under the trade name "Keystone Labs" ("Keystone Labs", "we", "us", or "our"), collects, uses, discloses, and protects personal data. Keystone Labs is a sole proprietorship; specific operator details are available upon written request to [email protected] for legitimate legal purposes.

By using the Service, you consent to the data practices described in this Policy. If you do not agree, please do not use the Service.

2. Data We Collect

Account data.

• Email address (required, used as account identifier and for service notifications).
• Password — stored only as a bcrypt hash. We never store, log, or transmit your plaintext password.
• Optional profile fields: organization name, display name.

Service-usage data.

• API request logs: timestamp, endpoint, response status, requested CVE identifier, response latency.
• IP address at signup and at each session start (for abuse prevention and security forensics).
• Browser user-agent string and approximate session metadata.
• Aggregate usage metrics (calls per month, quota consumption) for billing and capacity planning.

Bulk-analysis data.

• The CVE identifiers, optional job name, job state, result preview, and timestamps associated with a CSV or JSON batch.
• For asynchronous jobs, normalized CVE identifiers are held as working rows only while the job is active. When the job reaches a terminal state, those rows are deleted and at most ten result rows remain as a preview. A private result object is retained when an export completes. The original upload bytes and unsupported customer columns are not retained in object storage.
• Completion or failure notifications associated with the submitting account.

Telegram Free-plan activation data.

• If you activate a Free account, our bot receives the one-time code you send, your numeric Telegram user identifier, and the result of a live channel-membership check.
• We immediately pseudonymize the numeric identifier with a keyed HMAC fingerprint. We persist only that fingerprint, code HMACs, activation state, and security timestamps; the raw identifier is not stored.
• We do not persist your raw Telegram identifier, username, display name, phone number, profile photo, message body, or channel-membership response. We never ask for your Telegram password or phone number.
• Telegram may make public account data and messages available to a bot when you interact with it, as explained in Telegram's Privacy Policy. Our bot deliberately ignores fields it does not need.

Customer webhook data.

• If your paid plan includes outbound webhooks, we process the endpoint name and destination URL you configure. The destination URL and per-endpoint signing secret are stored together in an encrypted, versioned envelope; list, history, and administrative views expose only a bounded URL hint.
• We store delivery state, stable event/delivery identifiers, attempt count and timing, HTTP status, and bounded error categories, together with the public CVE verdict transition needed to identify the event.
• We do not persist outbound request bodies, response bodies, response headers, resolved IP addresses, signing secrets outside the encrypted envelope, or arbitrary remote error text. A newly created or rotated signing secret is returned once and cannot be recovered later.

Billing data. Names and payment data are collected and processed by Paddle.com as Merchant of Record. Keystone Labs receives only transaction identifiers, plan, status, country (for tax purposes), and the last four digits / brand of the card. We never receive or store full card numbers, CVVs, or banking credentials.

Optional data. Any feedback, support correspondence, or content you voluntarily submit to us via email or the support form.

3. Purpose of Processing

We process the categories above for the following purposes:

• Service delivery — authentication, session management, rate limiting, quota enforcement, abuse prevention.
• Billing and account administration — invoicing, dunning, subscription lifecycle.
• Customer support — responding to inquiries, troubleshooting, and resolving issues you report.
• Security — detecting and preventing fraud, credential stuffing, account takeover, and abuse.
• Free-plan eligibility — performing a one-time Telegram channel-membership check, preventing one Telegram identity from activating multiple accounts, and enforcing the published Free-plan community gate.
• Customer integrations — signing, delivering, retrying, securing, and troubleshooting verdict-change notifications to HTTPS destinations that an entitled customer expressly configures.
• Bulk analysis — validating CVE-only CSV uploads, processing synchronous or asynchronous jobs, generating result exports, enforcing quota, and notifying the submitting user when an asynchronous job completes or fails.
• Product improvement — de-identified, aggregated analytics on usage patterns. Individual records are not used for analytics.
• Legal compliance — responding to lawful requests, enforcing our Terms of Service, and meeting regulatory obligations.

4. Cookies and Tracking

The marketing site at realexploit.io sets no cookies. Authentication requests go to api.realexploit.io, which sets a single host-only first-party session cookie (a JWT). The cookie is HttpOnly, Secure, and SameSite=Lax. The SPA sends API requests with credentials included; the cookie is not readable by SPA JavaScript and is not sent to app.realexploit.io or the marketing host.

We do not use third-party analytics pixels, advertising trackers, session-replay scripts, or behavioral profiling cookies. We do not participate in cross-site advertising networks. Because we set no advertising or analytics cookies, no Cookie Consent banner is required for compliance with EU/UK ePrivacy rules.

Links to Telegram leave our sites. Telegram processes your visit and bot interaction under its own policy; RealExploit does not place a Telegram tracker or widget on the marketing site or application.

5. Third-Party Service Providers

The following service providers process data needed to operate RealExploit. Their role and applicable privacy terms are identified below:

• Paddle.com Market Limited — payment processing, tax remittance, fraud screening (Merchant of Record). Privacy policy.
• Postmark (ActiveCampaign, LLC) — transactional email delivery (account verification, password reset, billing notifications). Privacy policy.
• Cloudflare, Inc. — content delivery network, DDoS protection, edge security, bot management, and private R2 object storage for asynchronous bulk result files. Privacy policy.
• Sentry (Functional Software, Inc.) — application error tracking, with PII redacted from stack traces. Privacy policy.
• Hetzner Online GmbH — server hosting in Frankfurt, Germany. Privacy policy.
• Telegram Messenger Inc. — independent messaging platform used only when a Free user chooses to join the channel and interact with our activation bot. Telegram receives the bot message and related account data under its own Privacy Policy and Terms; Telegram is not used for analytics or advertising on our sites.

Customer-directed webhook recipients are destinations selected and controlled by the customer, not RealExploit subprocessors. When a customer enables an endpoint, RealExploit sends the configured public CVE event and delivery headers to that recipient. The customer is responsible for its recipient, access controls, downstream retention, and applicable privacy notices.

We do not sell, rent, or trade personal data to any third party. We may disclose data when legally compelled (subpoena, court order, regulatory request) and will challenge overbroad requests where appropriate.

6. Data Hosting Location

Account, billing-reference, authentication, and job metadata are processed and stored on our primary infrastructure in Frankfurt, Germany (European Union). Static assets and private bulk objects are handled by Cloudflare's distributed network and R2 service. Cloudflare and other sub-processors listed above may process data internationally pursuant to their data-processing agreements and Standard Contractual Clauses, where applicable.

Telegram interactions are processed separately on Telegram's infrastructure under Telegram's location and transfer practices. The RealExploit fingerprint and activation record remain in our Frankfurt PostgreSQL database.

Outbound customer webhooks necessarily transmit a signed event to the destination selected by that customer. Its hosting location and further processing are determined by the customer and destination provider.

7. Data Retention

• Active account record — retained for the lifetime of your account. You can delete your account at any time via your dashboard or by emailing [email protected]. Upon deletion, the user record is anonymized within 30 days.
• API request logs — 90 days, then aggregated and anonymized.
• Server access logs — 30 days.
• Audit logs (administrative actions, security events) — 24 months, for compliance and forensic purposes.
• Telegram activation — the keyed identity fingerprint and activation timestamp are retained for the lifetime of the active account to enforce one-identity-per-account. Terminal, invalidated, or expired code metadata is deleted after 90 days. Account deletion immediately deletes code records and clears the Telegram fingerprint as part of the deletion transaction.
• Customer webhook endpoints — the encrypted destination/signing-secret envelope is retained while the endpoint and owner remain active and entitled. Rotation, revocation, suspension, downgrade, endpoint/account deletion, or organization deletion immediately removes that envelope from the active database and cancels runnable deliveries. Plan expiry immediately blocks new delivery; the next maintenance sweep removes the inactive envelope. This is logical deletion, not destruction of the shared encryption key; historical database storage or backups may retain an older encrypted copy until their applicable retention expires. Deletion also removes the creator and original endpoint name; revoked/deleted terminal metadata is purged after 90 days once no delivery references it.
• Customer webhook deliveries — succeeded and cancelled delivery/attempt metadata is deleted after 30 days; dead delivery/attempt metadata and orphaned event records are deleted after 90 days.
• Bulk analysis — original upload bytes are discarded after parsing. Synchronous jobs may retain up to 100 normalized result rows with their job record. Asynchronous working rows are deleted when the job completes, fails, or is cancelled; at most ten result rows remain as a preview. Bulk requests do not create duplicate per-CVE lookup-history records. Result-download access expires 30 days after completion. Each signed link lasts no longer than five minutes and is further capped by the remaining availability window. Account deletion or access revocation blocks new links immediately, but an already-issued bearer link can remain usable until that short TTL expires. Application maintenance and the provider lifecycle policy then schedule deletion of any remaining result object. Cloudflare notes that physical lifecycle deletion can occur after the expiry time. Job metadata, bounded previews or synchronous results, and associated console notifications are deleted after 90 days; account deletion schedules object removal and removes eligible personal or organization-owned metadata sooner. Uploads must contain only the supported CVE column; customers should not add asset names, hostnames, credentials, client names, or other personal or confidential fields.
• Billing records and tax documents — up to 7 years, as required by typical financial-recordkeeping obligations.
• Anonymized account stub — retained indefinitely for referential integrity of audit logs (no personal identifiers remain).

8. Your Rights

Depending on your jurisdiction of residence, you have rights regarding your personal data. We comply with the following frameworks for residents of the relevant regions.

European Union and United Kingdom (GDPR / UK DPA)

If you are a resident of the European Economic Area or the United Kingdom, you have the following rights under the General Data Protection Regulation and equivalent UK law:

• Right of access (Article 15) — obtain a copy of your personal data and information about how it is processed.
• Right to rectification (Article 16) — correct inaccurate or incomplete data.
• Right to erasure / "right to be forgotten" (Article 17) — request deletion of your data.
• Right to restriction of processing (Article 18) — limit how we use your data.
• Right to data portability (Article 20) — receive your data in a structured, machine-readable format.
• Right to object (Article 21) — object to processing based on legitimate interests.
• Right to withdraw consent at any time, where processing is based on consent.
• Right to lodge a complaint with your local supervisory authority.

To exercise these rights, contact [email protected]. We respond within 30 days; extensions of up to two further months are possible for complex requests, with notice.

California, United States (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to know what personal information we collect, the categories of sources, and the purposes for which it is used.
• Right to delete personal information we have collected.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information — we do not sell or share personal information for cross-context behavioral advertising, so no opt-out is necessary.
• Right to limit use and disclosure of sensitive personal information.
• Right to non-discrimination for exercising any of the above rights.

To exercise these rights, contact [email protected]. Authorized agents may submit requests on your behalf with verifiable written authorization.

Other jurisdictions

Residents of other regions may have additional rights under local data-protection laws — including but not limited to Brazil's Lei Geral de Proteção de Dados (LGPD), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and Australia's Privacy Act 1988. Contact [email protected] to exercise such rights; we honor reasonable requests in accordance with applicable local law.

9. Data Subject Verification

To protect your privacy and prevent fraudulent requests, we may request verification of your identity before fulfilling rights requests — typically by confirming control of the email address on file. For high-risk requests we may request additional reasonable verification.

10. Children's Privacy

The Service is not intended for users under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact [email protected] and we will promptly delete it.

11. Security Measures

• TLS 1.3 in transit for all client connections; HSTS preload enforced.
• Bcrypt (cost factor 12) for password hashing; passwords are never logged in plaintext.
• SHA-256 hashes with constant-time comparison for API keys, session tokens, email-verification tokens, and password-reset tokens. Telegram codes and identities use separate keyed HMAC-SHA-256 secrets; raw codes and numeric Telegram ids are never persisted in PostgreSQL.
• Encryption at rest provided by the hosting infrastructure.
• Database least-privilege role separation: migrations run as a superuser role, the application runtime runs as a least-privilege role.
• Audit logging of administrative actions for 24 months.
• Cloudflare WAF, DDoS protection, and bot defense (Cloudflare Turnstile) on authentication endpoints.
• PII redaction (emails, JWTs, API keys) in application logs before any renderer sees them.

12. Data Breach Notification

In the event of a personal data breach affecting your data, we will notify affected users without undue delay through the email address on your account and, where applicable, within 72 hours of becoming aware as required by GDPR Article 33. Notifications will include the nature of the breach, the categories of data affected, the likely consequences, and the remedial steps taken or recommended.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' advance notice via email and by posting the updated version on this page with a revised "Last updated" date. Continued use of the Service after the effective date constitutes acceptance.

14. Contact

• Privacy inquiries and rights requests: [email protected]
• Data Protection Officer (DPO): [email protected]
• General support: [email protected]
• Security disclosures: [email protected]

Disclaimer. This Privacy Policy is provided as a comprehensive baseline. Specific compliance obligations under your jurisdiction's data-protection law may differ. It is not legal advice; consult qualified legal counsel for your specific situation.