Privacy

1. Who is responsible

PT. DEVINCI GROUP INDONESIA operates zerodayfindings.com and is responsible for the personal data processed for that site. Privacy requests go to contact@zerodayfindings.com.

2. Data we collect

Most of the catalog is public vulnerability metadata and does not identify you. We collect personal data in these cases:

• Account. Email address, name, a password hash, the membership package, and the time the account was created. Sign-in may also use Google. Optional address details are stored only if you save them.
• Session. A cookie named zd_session keeps you signed in. It is sent only to this site.
• Focus, watches, and newsletters. The technologies and topics you follow, the records you watch, and the newsletter choices tied to your email address.
• Jobs Corner. The skills you select, the hourly rate, an optional website, and the text of each service offer. A Ping this offer enquiry stores that you contacted that offer, and the email to the poster includes your name, your email address, your website if you saved one, and any note you wrote. Publishing an offer, and each enquiry, also sends a notice to the site operator.
• API keys. On packages that include the API, the key name, a secret, and an expiration date.
• Press board. A cookie named zd_press stores the publications and topics you selected for The Press Corner.
• Security check. Sign-in, sign-up, and password reset use Cloudflare Turnstile. That check is there to reject automated abuse.
• Measurement. Google Analytics records page views. The measurement identifier on this site is G-K9ZDRTB8BB.
• Mail and hosting. Messages we send, and the technical logs produced by Cloudflare while the site is served.

3. Why we use it

We use this data to run the account you asked for, send the messages you subscribed to, publish a Jobs Corner offer you chose to publish, deliver an enquiry to the member who posted it, keep the site reliable, and understand which public pages are read. We do not sell personal data. We do not use it to build an advertising profile of the catalog.

4. Who receives it

• Cloudflare, which hosts the site, the database, and the Turnstile check.
• Google, when you sign in with Google or when Analytics records a page view.
• The mail service that delivers verification messages, password reset links, digests, alerts, Jobs Corner enquiries, and package requests.
• The site operator, when a Free member asks for another package. That notice includes the member’s name, email address, and the package requested. The package on the account stays Free until the request is handled.
• The member who posted an offer, when you use Ping this offer. That member receives your name and email address so they can reply.

Public pages show a published offer, the member’s name, the rate, the skills, and the website the member chose to display. They do not show the member’s email address.

5. How long we keep it

Account data stays while the account is open. A password reset link expires after one hour and is removed when it is used or replaced. A session cookie expires after 30 days of the session that set it. Newsletter choices stay until you change them or ask us to remove that address. An unpublished offer stays on the account until you delete the account or we close it. Ping records are kept long enough to enforce the one-enquiry-a-day limit and to answer a complaint about an enquiry. Server logs follow the retention of the host. You can ask us to delete an account and the personal data tied to it, except where we must keep a record to meet a legal duty or to resolve a dispute.

6. Your choices

You can correct your name, address, focus, watches, skills, and offers from the account pages. You can change newsletter choices from the account or by using the same email address in the site footer. You can stop Analytics with your browser’s controls. To close an account, export a question, or object to a use of your data, write to contact@zerodayfindings.com. We will respond in line with the personal-data law that applies, including Indonesia’s Law No. 27 of 2022 on Personal Data Protection where that law applies to the request.

7. Children

The site is written for operators and security practitioners. It is not directed at children, and we do not knowingly create an account for a child.

8. Changes

We post changes on this page and update the date at the top. The conditions of use are in the General Conditions.