Privacy Policy

Last updated: 2026-09-21 · Effective: 2026-09-10

1. Introduction

This Privacy Policy explains how RealExploit, operated by KeyStone Labs, collects, uses and protects personal data. The Operator is responsible for RealExploit account data. Contact privacy@realexploit.io for privacy requests.

By using the Service, you consent to the data practices described in this Policy. If you do not agree, please do not use the Service.

2. Data We Collect

Account data.

• Email address (required, used as account identifier and for service notifications).
• Password, if you choose email and password sign-in — stored only as a bcrypt hash. We never store or log your plaintext password.
• If you choose Google, GitHub or X sign-in, we store the provider name and stable account identifier linked to your RealExploit account. We use a provider-verified email for registration when available. We do not store provider access tokens or read your repositories, posts or messages. X requires a post-read permission as part of its identity endpoint; we do not use it to retrieve posts.
• Optional profile fields: organization name, display name.

Service-usage data.

• API request logs: timestamp, endpoint, response status, requested CVE identifier, response latency.
• IP address at signup and at each session start (for abuse prevention and security forensics).
• Browser user-agent string and approximate session metadata.
• Aggregate usage metrics (calls per month, quota consumption) for billing and capacity planning.

Bulk-analysis data.

• The CVE identifiers, optional job name, job state, result preview, and timestamps associated with a CSV or JSON batch.
• For asynchronous jobs, normalized CVE identifiers are held as working rows only while the job is active. When the job reaches a terminal state, those rows are deleted and at most ten result rows remain as a preview. A private result object is retained when an export completes. The original upload bytes and unsupported customer columns are not retained in object storage.
• Completion or failure notifications associated with the submitting account.

Patch-tracking data (Pro, Team and Enterprise).

When you use patch tracking, we store the asset identifiers, hostnames, sites, owner or assignee labels, criticality, exposure flags, CVE associations and dates you submit, plus patch states, evidence notes, saved dashboard filters and authenticated actor identifiers. This data supports workspace prioritization and historical tracking. Saved executive reports retain a fixed copy of the selected data and author notes. Reports are private to their author in the current workspace and are erased when the author deletes their account or the owning organization is dissolved through account deletion. Hostnames and evidence notes are not sent to threat-intelligence providers. Use team labels and ticket references where possible; do not upload credentials or unrelated sensitive data.

Patch inventories and their audit history remain in the primary database while their workspace exists. Deleting the workspace removes its inventory, dashboards, import metadata and history. If an actor account is deleted while the workspace remains, the actor reference is cleared and the workspace history is retained. Temporary analysis rows and normalized import payloads are removed when an import completes or fails. These rules are separate from Bulk CSV export retention; backup retention follows the existing backup policy.

Historical Telegram activation data.

• Under the retired Free activation flow, our bot received the one-time code you sent, your numeric Telegram user identifier, and the result of a live channel-membership check.
• We immediately pseudonymize the numeric identifier with a keyed HMAC fingerprint. We persist only that fingerprint, code HMACs, activation state, and security timestamps; the raw identifier is not stored.
• We do not persist your raw Telegram identifier, username, display name, phone number, profile photo, message body, or channel-membership response. We never ask for your Telegram password or phone number.
• Telegram may make public account data and messages available to a bot when you interact with it, as explained in Telegram's Privacy Policy. Our bot deliberately ignores fields it does not need.

Customer webhook data.

• If your paid plan includes outbound webhooks, we process the endpoint name and destination URL you configure. The destination URL and per-endpoint signing secret are stored together in an encrypted, versioned envelope; list, history, and administrative views expose only a bounded URL hint.
• We store delivery state, stable event/delivery identifiers, attempt count and timing, HTTP status, and bounded error categories, together with the public CVE verdict transition needed to identify the event.
• We do not persist outbound request bodies, response bodies, response headers, resolved IP addresses, signing secrets outside the encrypted envelope, or arbitrary remote error text. A newly created or rotated signing secret is returned once and cannot be recovered later.

Billing data. Creem (Armitage Labs OÜ) collects payment details as Merchant of Record. We store provider identifiers, plan, subscription state and the paid access period. Payment notifications can include payer contact and tax information; our audit keeps a digest and processing result rather than the complete notification. We do not collect or store full card numbers, CVVs or banking credentials.

Optional data. Any feedback, support correspondence, or content you voluntarily submit to us via email or the support form.

3. Purpose of Processing

We process the categories above for the following purposes:

• Service delivery — authentication, session management, rate limiting, quota enforcement, abuse prevention.
• Billing and account administration — invoicing, dunning, subscription lifecycle.
• Customer support — responding to inquiries, troubleshooting, and resolving issues you report.
• Security — detecting and preventing fraud, credential stuffing, account takeover, and abuse.
• Historical Telegram activation records — retained security records from the retired community activation flow. No current plan requires Telegram membership, and pending gate codes are invalidated during the transition.
• Customer integrations — signing, delivering, retrying, securing, and troubleshooting verdict-change notifications to HTTPS destinations that an entitled customer expressly configures.
• Bulk analysis — validating CVE-only CSV uploads, processing synchronous or asynchronous jobs, generating result exports, enforcing quota, and notifying the submitting user when an asynchronous job completes or fails.
• Product improvement — de-identified, aggregated analytics on usage patterns. Individual records are not used for analytics.
• Legal compliance — responding to lawful requests, enforcing our Terms of Service, and meeting regulatory obligations.

4. Cookies and Tracking

The marketing site at realexploit.io sets no cookies. Authentication requests go to api.realexploit.io, which sets a host-only first-party session cookie (a JWT). The cookie is HttpOnly, Secure, and SameSite=Lax. The SPA sends API requests with credentials included; the cookie is not readable by SPA JavaScript and is not sent to app.realexploit.io or the marketing host.

When you select Stay signed in, an active session can renew for up to 30 days from that sign-in. Signing out, changing your password or signing in elsewhere revokes it. Social sign-in uses an additional host-only, HttpOnly transaction cookie that expires after ten minutes, with a single-use server record removed on completion. Browser storage retains only the non-sensitive session preference and selected plan.

We do not use third-party analytics pixels, advertising trackers, session-replay scripts, or behavioral profiling cookies. We do not participate in cross-site advertising networks. Because we set no advertising or analytics cookies, no Cookie Consent banner is required for compliance with EU/UK ePrivacy rules.

Links to Telegram leave our sites. Telegram processes your visit and bot interaction under its own policy; RealExploit does not place a Telegram tracker or widget on the marketing site or application.

5. Third-Party Service Providers

We use the following categories of service providers to operate RealExploit. Access is limited to the data needed for their function. Services that you choose directly are identified below:

• Google, GitHub and X — optional identity providers, used only when you choose their sign-in or link your account. Each provider handles your authentication under its own privacy policy: Google, GitHub, X.
• Creem (Armitage Labs OÜ) — payment processing, tax remittance, fraud screening (Merchant of Record). Privacy policy.
• Transactional email delivery — delivers account verification, password recovery, billing, and service notifications; processes recipient addresses and message content.
• Network protection and private storage — protects web traffic, mitigates abuse, and stores temporary analysis exports with restricted access.
• Operational monitoring — processes technical error information to diagnose failures, with personal data redacted from application logs.
• Hosting and data processing — hosts the service and its account and job data in the regions described below.
• Telegram Messenger Inc. — independent messaging platform used when a user voluntarily joins the community or interacts with our bot. Telegram receives the bot message and related account data under its own Privacy Policy and Terms; Telegram is not used for analytics or advertising on our sites.

Customer-directed webhook recipients are destinations selected and controlled by the customer, not RealExploit subprocessors. When a customer enables an endpoint, RealExploit sends the configured public CVE event and delivery headers to that recipient. The customer is responsible for its recipient, access controls, downstream retention, and applicable privacy notices.

We do not sell, rent, or trade personal data to any third party. We may disclose data when legally compelled (subpoena, court order, regulatory request) and will challenge overbroad requests where appropriate.

6. Data Hosting Location

Account, billing-reference, authentication, and job metadata are processed and stored on our primary infrastructure in Frankfurt, Germany (European Union). Static assets and private analysis exports are processed by network and storage services. These providers may process data internationally under their data-processing agreements and applicable transfer safeguards, including Standard Contractual Clauses where applicable. Contact privacy@realexploit.io for information about processors and international transfers relevant to your account.

Telegram interactions are processed separately on Telegram's infrastructure under Telegram's location and transfer practices. The RealExploit fingerprint and activation record remain in our primary database in Frankfurt.

Outbound customer webhooks necessarily transmit a signed event to the destination selected by that customer. Its hosting location and further processing are determined by the customer and destination provider.

7. Data Retention

• Active account record — retained for the lifetime of your account. You can delete your account at any time via your dashboard or by emailing privacy@realexploit.io. Upon deletion, the user record is anonymized within 30 days.
• API request logs — 90 days, then aggregated and anonymized.
• Server access logs — 30 days.
• Audit logs (administrative actions, security events) — 24 months, for compliance and forensic purposes.
• Telegram activation — the keyed identity fingerprint and activation timestamp are retained for the lifetime of the active account as historical security records. Terminal, invalidated, or expired code metadata is deleted after 90 days. Account deletion immediately deletes code records and clears the Telegram fingerprint as part of the deletion transaction.
• Customer webhook endpoints — the encrypted destination/signing-secret envelope is retained while the endpoint and owner remain active and entitled. Rotation, revocation, suspension, downgrade, endpoint/account deletion, or organization deletion immediately removes that envelope from the active database and cancels runnable deliveries. Plan expiry immediately blocks new delivery; the next maintenance sweep removes the inactive envelope. This is logical deletion, not destruction of the shared encryption key; historical database storage or backups may retain an older encrypted copy until their applicable retention expires. Deletion also removes the creator and original endpoint name; revoked/deleted terminal metadata is purged after 90 days once no delivery references it.
• Customer webhook deliveries — succeeded and cancelled delivery/attempt metadata is deleted after 30 days; dead delivery/attempt metadata and orphaned event records are deleted after 90 days.
• Bulk analysis — original upload bytes are discarded after parsing. Synchronous jobs may retain up to 100 normalized result rows with their job record. Asynchronous working rows are deleted when the job completes, fails, or is cancelled; at most ten result rows remain as a preview. Bulk requests do not create duplicate per-CVE lookup-history records. Result-download access expires 30 days after completion. Each signed link lasts no longer than five minutes and is further capped by the remaining availability window. Account deletion or access revocation blocks new links immediately, but an already-issued bearer link can remain usable until that short TTL expires. Application maintenance and the provider lifecycle policy then schedule deletion of any remaining result object. Physical deletion can occur after download access expires. Job metadata, bounded previews or synchronous results, and associated console notifications are deleted after 90 days; account deletion schedules object removal and removes eligible personal or organization-owned metadata sooner. Uploads must contain only the supported CVE column; customers should not add asset names, hostnames, credentials, client names, or other personal or confidential fields.
• Billing records and tax documents — at least 7 years for commercial transactions, and longer where applicable law requires.
• Anonymized account stub — retained indefinitely for referential integrity of audit logs (no personal identifiers remain).

8. Your Rights

Depending on your jurisdiction of residence, you have rights regarding your personal data. We comply with the following frameworks for residents of the relevant regions.

European Union and United Kingdom (GDPR / UK DPA)

If you are a resident of the European Economic Area or the United Kingdom, you have the following rights under the General Data Protection Regulation and equivalent UK law:

• Right of access (Article 15) — obtain a copy of your personal data and information about how it is processed.
• Right to rectification (Article 16) — correct inaccurate or incomplete data.
• Right to erasure / "right to be forgotten" (Article 17) — request deletion of your data.
• Right to restriction of processing (Article 18) — limit how we use your data.
• Right to data portability (Article 20) — receive your data in a structured, machine-readable format.
• Right to object (Article 21) — object to processing based on legitimate interests.
• Right to withdraw consent at any time, where processing is based on consent.
• Right to lodge a complaint with your local supervisory authority.

To exercise these rights, contact privacy@realexploit.io. We respond within 30 days; extensions of up to two further months are possible for complex requests, with notice.

California, United States (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to know what personal information we collect, the categories of sources, and the purposes for which it is used.
• Right to delete personal information we have collected.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information — we do not sell or share personal information for cross-context behavioral advertising, so no opt-out is necessary.
• Right to limit use and disclosure of sensitive personal information.
• Right to non-discrimination for exercising any of the above rights.

To exercise these rights, contact privacy@realexploit.io. Authorized agents may submit requests on your behalf with verifiable written authorization.

Other jurisdictions

Residents of other regions may have additional rights under local data-protection laws — including but not limited to Brazil's Lei Geral de Proteção de Dados (LGPD), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and Australia's Privacy Act 1988. Contact privacy@realexploit.io to exercise such rights; we honor reasonable requests in accordance with applicable local law.

9. Data Subject Verification

To protect your privacy and prevent fraudulent requests, we may request verification of your identity before fulfilling rights requests — typically by confirming control of the email address on file. For high-risk requests we may request additional reasonable verification.

10. Children's Privacy

The Service is not intended for users under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact privacy@realexploit.io and we will promptly delete it.

11. Security Measures

• HTTPS connections with valid certificates, TLS 1.3 support, and strict transport security (HSTS).
• Bcrypt (cost factor 12) for password hashing; passwords are never logged in plaintext.
• SHA-256 hashes with constant-time comparison for API keys, session tokens, email-verification tokens, and password-reset tokens. Telegram codes and identities use separate keyed HMAC-SHA-256 secrets; raw codes and numeric Telegram ids are never persisted in the database.
• Encrypted webhook destinations and signing secrets, with restricted access to private exports and backups.
• Database least-privilege role separation: migrations run as a superuser role, the application runtime runs as a least-privilege role.
• Audit logging of administrative actions for 24 months.
• DDoS protection, bot defense, and rate limits on authentication endpoints.
• PII redaction (emails, JWTs, API keys) in application logs before any renderer sees them.

12. Data Breach Notification

In the event of a personal data breach affecting your data, we will notify affected users without undue delay through the email address on your account and, where applicable, within 72 hours of becoming aware as required by GDPR Article 33. Notifications will include the nature of the breach, the categories of data affected, the likely consequences, and the remedial steps taken or recommended.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' advance notice via email and by posting the updated version on this page with a revised "Last updated" date. Continued use of the Service after the effective date constitutes acceptance.

14. Contact

RealExploit is offered under the KeyStone Labs brand. Use the contacts below for privacy, support and security requests.

• Privacy inquiries and rights requests: privacy@realexploit.io
• General support: support@realexploit.io
• Security disclosures: security@realexploit.io