// LEGAL

Privacy Notice

Version privacy-v3. Effective 12 October 2026.

1. Who we are

Vulnera ("Vulnera", "we", "us") is a cybersecurity company headquartered in Muscat, Sultanate of Oman. We work with clients in the GCC, the United Kingdom, Europe and remotely worldwide.

The controller of the personal data described in this notice is Al Karmel Heights Trading L.L.C, commercial registration number 1222893, registered address South Al Khuwair, Bousher, Muscat, Sultanate of Oman.

Privacy questions and requests: privacy@vulnera.om
General enquiries: info@vulnera.om
Security reports and abuse of our tools: info@vulnera.om

This notice covers vulnera.om, its subdomains (such as labs.vulnera.om and media.vulnera.om) and the emails we send from them. It does not cover the data we handle for a client during a paid engagement: that is governed by the engagement contract and its data protection terms.

2. The short version

We collect what you give us through our forms, subscriptions and player accounts, plus the technical records needed to keep the site secure.
We do not use third-party analytics, advertising or social media trackers, and no third party sets cookies through our site except the security cookies of our network provider, Cloudflare (see the Cookie and Storage Notice).
We do not sell personal data or use it to build advertising profiles.
The site runs on servers we operate, Namecheap, Inc. (United States), with Cloudflare in front for protection. Our email runs on Google Workspace.
Every type of data has a set retention period (section 7). You can ask for a copy, a correction or deletion at any time (section 8).

3. What we collect and why

Contact, scope, demo, access, partnership and Exposure Advisor forms

What: your name, email address, company and phone number (where the form asks for them), your message or answers (for example your Scope Builder choices), the page and form you used, a reference number, and, to fight spam and abuse, your IP address, your browser's user agent and a spam score.
Exposure Advisor: the 25 questions are scored in your browser and nothing is sent to us while you answer. If you choose to email yourself the summary, we receive your name, email address, optional company, your score and your answers, and handle them like any other form.
Why: to reply to you, prepare a quote or proposal, send you an automatic confirmation, and keep a record of our correspondence. A copy of each submission is emailed to the team members who handle it.

Job applications

What: your name, email address, optional phone number and LinkedIn address, the role you are applying for, your CV file and cover note, plus your IP address and user agent for abuse prevention.
File scanning: every uploaded file is scanned with ClamAV, an open-source antivirus scanner that runs on our own servers, before anyone opens it. A file that fails the scan is quarantined and never opened.
Why: to assess your application and contact you about it.

What: your email address, the list you chose, your IP address and the time you subscribed, the time you confirmed and, later, the time you unsubscribed.
Double opt-in: after you subscribe we send one email with a confirmation link that works for 30 minutes. You are only added to the list if you click it.
Every email carries a one-click unsubscribe link. Our emails contain no tracking pixels, remote images or tracked links.
Weekly Threat Brief: the brief is published on the site and by RSS only. There is no email list for it, and reading the feed involves no personal data beyond our normal server logs.

Player accounts (labs, competitions and leaderboards)

What: your handle, display name, email address, password (stored only as a salted one-way hash, never in readable form), country, and optionally your organisation, job title, bio and avatar; any passkeys you register (we store only the public key); your notification choices; the time you accepted the Terms; your confirmation that you are at least 18 (a yes or no, the time and the wording version; we never ask for your date of birth); your IP address and user agent at sign-up; your sign-in sessions (IP address, browser, times); and your lab and competition activity and scores where those features are available.
Breached password check: when you set a password, we check it against the Have I Been Pwned list of known breached passwords. Only the first five characters of a one-way hash of the password leave our servers. Your password and email address are never sent.
What others see: your handle and display name appear on leaderboards and competition results. Your profile page is private unless you choose to make it public in your account settings.
Why: to provide the account and its features, keep it secure and tell you about sign-ins and changes.

Free security tools

Browser tools: many tools (encoders, hash tools, the Cisco Config Generator and others) run entirely in your browser. Nothing you type into them reaches us.
Server tools: DNS lookup, reverse DNS, WHOIS, IP geolocation, subdomain finder, HTTP headers, SSL checker, technology detector, port scanner and password strength checker run on our servers. We send the target you enter to that target and, where the tool needs it, to public lookup services (DNS resolvers, WHOIS and RDAP servers, and the crt.sh certificate transparency search). IP geolocation uses a database stored on our own servers.
What we record for each server run: the tool, the target you entered, your IP address, your player account if you are signed in, whether the run succeeded, how long it took and the time. We never store the results.
Password strength checker: the password is scored in memory and never stored or logged. Its runs are recorded without the input.
Authorisation confirmation: before the port scanner and subdomain finder run, you confirm that you own the target or are authorised to test it. That confirmation and its time are sent with each run. See the Acceptable Use Policy.
Why: to run the tool you asked for, to enforce rate limits, and to be able to investigate and answer complaints about misuse.

Security records

To protect the site, its users and the systems our tools can reach, we record:

server and application logs of each request: IP address, time, the address requested, the result and your browser's user agent;
sign-in attempts: the email address or handle entered, the IP address, the time and whether it succeeded;
abuse events and IP address blocks, when a rate limit or abuse rule is triggered;
an activity log of actions on public features (for example a form submission, a sign-in or a tool run).

Cloudflare, which sits in front of our servers, also processes each request (including your IP address) to filter attacks and bots.

Error reports are sent to an error tracker we host ourselves (GlitchTip). They stay on our servers and are not shared with an error-tracking company.

Page views and page speed. If you choose "Accept" in the cookie notice, your browser sends one small first-party message to our own servers for each public page you view. It records the page path (without anything after a question mark), the referring site (host name only), your IP address shortened to its first 24 bits for IPv4 or 48 bits for IPv6, and your browser family (not the full user agent). On the first page you open it also records page-speed timings, where your browser reports them (largest contentful paint, layout shift and interaction delay), and the performance setting your device is using (Full, Balanced or Lite). It sets no cookie, is not sent from sign-in, account or admin pages, is not linked to your account and is not shared with anyone. If you choose "Essential only", or make no choice, nothing is sent. We use it to keep the site fast and to see which pages help visitors, relying on your consent, which you can withdraw at any time in Cookie settings. We delete these records after 90 days.

Emails you send us

Emails to our addresses are stored in our Google Workspace mailboxes and kept for as long as the matter needs, in line with the periods in section 7.

Cookies and similar storage

We use a small number of strictly necessary cookies and, only if you accept, a few conveniences stored on your device. The full list is in the Cookie and Storage Notice.

What we do not do

We do not use third-party analytics or advertising services, social media pixels or device fingerprinting. We do not sell or rent personal data. We do not make decisions about you by automated means that have legal or similarly significant effects. Our spam filter scores form submissions to catch automated abuse; if you think a message did not reach us, write to info@vulnera.om.

4. Our legal bases

We are established in Oman, so Oman's Personal Data Protection Law (Royal Decree 6/2022) and its Executive Regulation apply to everything in this notice. Where you are in the European Economic Area or the United Kingdom, the GDPR or the UK GDPR also applies to our processing of your data.

Under Oman's law, we rely on your consent, which you give when you submit a form, subscribe, create an account or run a tool after reading this notice, or on one of the cases in which the law allows processing without consent, such as performing a contract with you or taking steps you ask for before one, or complying with a legal obligation. You can withdraw consent at any time (section 8); this does not affect processing that took place before.

Under the GDPR and the UK GDPR, our bases are:

Forms and enquiries: steps you ask for before a contract (Article 6(1)(b)) and our legitimate interest in answering enquiries and running our business (Article 6(1)(f)).
Job applications: steps you ask for before an employment contract (Article 6(1)(b)).
Email subscriptions: your consent (Article 6(1)(a)).
Player accounts: performing our contract with you, the Terms of Service (Article 6(1)(b)).
Server tools, security records and abuse prevention: our legitimate interest in keeping the site and other people's systems safe and in being able to answer complaints about misuse (Article 6(1)(f)).
Optional device storage, and page views and page speed: your consent (Article 6(1)(a)); strictly necessary cookies need no consent.
Records we must keep by law, and answers to lawful requests: legal obligation (Article 6(1)(c)).

Where we rely on legitimate interests, we have weighed them against your rights, keep the data to a minimum and keep it only for the periods below. You can object at any time (section 8).

We share personal data only with the service providers below, who act on our instructions under data processing terms, and with the recipients listed after them.

Namecheap, Inc. (United States):: rents us the servers the site, its database, its backups and our self-hosted tools run on. Our servers are located in United States.
Cloudflare, Inc. (United States): network security and delivery. Every request to the site passes through Cloudflare, which sees your IP address and the request details and may set the security cookies listed in the Cookie and Storage Notice.
Google (Google Workspace): sends our emails (confirmations, subscription and account emails) and hosts our mailboxes, including the copies of form submissions sent to our team.

Other recipients:

Targets and lookup services of the server tools receive the target you enter (section 3), not your identity.
Have I Been Pwned receives only a five-character hash prefix, which does not identify you or your password.
Our professional advisers (for example lawyers and accountants), under a duty of confidentiality, where needed.
Authorities, courts and the owners of affected systems, where the law requires it or where we receive a lawful request, for example when a tool has been used against a system without permission.
A buyer or successor if all or part of our business is transferred, under the same protections.

The following run on our own servers and involve no third party: our database, file storage, backups, ClamAV file scanning and the GlitchTip error tracker.

6. International transfers

Our servers are located in United States. Cloudflare and Google process data in many countries, including the United States. Sending personal data to them is a transfer outside Oman and, for visitors in Europe or the UK, may be a transfer outside the European Economic Area or the UK.

For transfers from Oman, we follow the conditions of the Personal Data Protection Law and its Executive Regulation.
For data covered by the GDPR or the UK GDPR, we rely on an adequacy decision where one exists, or on the standard contractual clauses approved by the European Commission (with the UK Addendum for UK data), which are part of our providers' data processing terms.

You can ask us for more information about these safeguards at privacy@vulnera.om.

7. How long we keep it

Data	How long
Form submissions and related correspondence	24 months after our last contact with you, then deleted. If you become a client, the engagement contract's record-keeping terms apply instead.
Submissions marked as spam	30 days
Job applications, including CV files	12 months after we receive them, then deleted. If you join us, they move to your employee file.
Email subscriptions	Until you unsubscribe. Unconfirmed sign-ups are deleted after 30 days. After you unsubscribe, or if the address bounces, we delete it within 30 days and keep only a one-way hash so that we never email you again by mistake.
Player accounts	Until you delete your account. Sign-ups never confirmed by email are deleted after 24 hours.
Server tool run records	30 days
Activity log	90 days
Sign-in attempts and abuse events	30 days
Page view and page-speed records	90 days
Lab environment records and flag submissions made without an account	30 days
Competition records (registrations, scores, boards, anti-cheat findings)	Kept with the competition; registration answers and IP addresses are removed when you delete your account
Certificates	Kept as a verifiable record; your name is removed when you delete your account
Server and application logs	Rotated automatically and kept for no longer than 30 days
IP address blocks	For as long as the block lasts, then deleted within 90 days; a permanent block is reviewed at least once a year
One-time sign-in codes and single-use links	Deleted within 24 hours of use or expiry
Backups	Encrypted nightly backups are kept for 14 days; weekly server snapshots are replaced on a rolling basis. Deleted data disappears from backups when they rotate out.

When you delete your player account, we immediately remove your handle, name, email address and profile details and end all your sessions. What remains cannot be linked back to you, apart from security records that expire on the schedule above.

We may keep data longer only where the law requires it, or where it is needed for a legal claim or an open investigation of misuse, and only for as long as that lasts.

8. Your rights

Depending on where you live, you have some or all of these rights:

to be told how we use your data (this notice);
to get a copy of your data, and to receive the data you gave us in a portable format;
to have inaccurate data corrected or completed;
to have your data deleted;
to object to processing based on legitimate interests, and to ask us to restrict processing while a question is resolved;
to withdraw consent at any time, for example by unsubscribing or choosing "Essential only" in Cookie settings;
to be told if a data breach affects you, where the law requires it;
to complain to a regulator (section 11).

How to use them:

Account holders can edit their profile and delete their account in the account settings. For a copy of your data, email us.
Subscribers can unsubscribe with the link in any of our emails.
Everyone else, and for anything else, email privacy@vulnera.om, ideally from the address the request is about. We may ask you to confirm your identity before we act, and we will not ask for more information than we need for that.

We reply within one month. If a request is complex we may take up to two further months and will tell you why. Requests are free unless they are clearly unfounded or excessive. If we cannot do what you ask, for example because the law requires us to keep something, we will explain why.

9. Children

Player accounts are for people aged 18 and over. When you create an account you confirm that you meet this age; we do not ask for your date of birth. We do not knowingly create accounts for, or collect personal data through accounts from, anyone under 18. If you believe a child has created an account, contact privacy@vulnera.om and we will delete it. The free tools, blog and threat intelligence pages can be used without an account.

10. How we protect your data

All connections to the site are encrypted (HTTPS).
Passwords are stored only as salted one-way hashes; sign-in is rate limited and protected against cross-site request forgery.
Access to personal data is limited to staff who need it, and every staff action in the admin area is recorded in an audit log.
Uploaded files are virus-scanned before anyone opens them, and the site loads no scripts, fonts or images from third parties.
Backups are encrypted.

No system is perfectly secure. If a breach affects your personal data, we will notify the competent authority and you where the law requires it.

11. Complaints

Please contact us first at privacy@vulnera.om so we can try to put things right. You also have the right to complain to a regulator:

Oman: the Ministry of Transport, Communications and Information Technology, which supervises the Personal Data Protection Law.
United Kingdom: the Information Commissioner's Office (ico.org.uk).
European Economic Area: the data protection authority of the country where you live or work, or where you believe the problem happened. The European Data Protection Board lists them at edpb.europa.eu.

12. Changes to this notice

We will update this notice when what we do changes. Each version has an identifier and an effective date, shown at the top of this page. If we make a significant change, we will say so on the site and, where we have your email address and the change affects you, tell you before it takes effect. Signed-in players may be asked to review the new version. Earlier versions are available on request.

13. Version

Version privacy-v3, effective 12 October 2026.