Privacy Policy

PenStrike operates this website and the PenStrike access program. For any privacy-related request you can reach us at [email protected]. Where required by law, PenStrike acts as the data controller for the personal data described below.

We only collect what we need to evaluate access requests and respond to you:

• Information you provide. When you submit the access or contact form we collect your name, work email, company, role, team size and the use case you describe, together with your authorization attestation.
• Technical data. Our servers automatically record limited request metadata such as IP address, timestamp, user agent and referring page for security, abuse-prevention and diagnostic purposes.
• Preferences. The site stores a small local preference in your browser (for example, whether ambient sound is enabled). This never leaves your device.

• Review, verify and respond to access requests and enquiries.
• Operate, secure and improve the website and the service.
• Detect, prevent and investigate abuse, fraud and security incidents.
• Comply with applicable legal obligations and enforce our agreements.

We do not sell your personal data, and we do not use it for third-party advertising.

Where the GDPR or a similar framework applies, we rely on: your consent (which you may withdraw at any time), our legitimate interests in running and securing the service, the performance of a contract or steps taken at your request, and compliance with a legal obligation.

We share personal data only with vetted processors acting on our instructions:

• Email delivery. We use Resend to deliver transactional email related to your request.
• Hosting. Our website and services run on a dedicated server operated by our infrastructure provider.

These providers are bound by contract to protect your data and to process it only as necessary to provide their services to us.

We keep access-request data for as long as needed to evaluate and follow up on your request, and for up to 24 months afterwards unless a longer period is required to comply with the law or resolve disputes. Technical logs are retained for a short rolling window and then deleted or anonymised.

Data is encrypted in transit (HTTPS). We apply access controls, data minimisation and least-privilege principles to the systems that store submissions. No method of transmission or storage is perfectly secure, but we work to protect your data using appropriate technical and organisational measures.

Depending on your location, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. To exercise any of these rights, email [email protected]. You also have the right to lodge a complaint with your local data protection authority.

Your data may be processed in countries other than your own. Where it is transferred internationally, we rely on appropriate safeguards such as standard contractual clauses or an equivalent recognised mechanism.

This website does not use advertising or cross-site tracking cookies. We use only strictly necessary storage and a single local preference for the ambient-sound toggle.

The service is intended for security professionals and organisations. It is not directed to, and we do not knowingly collect data from, anyone under 18.

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above, and where appropriate we will provide additional notice.

Questions about this policy or your data? Email [email protected].