Privacy Policy

2.1 Information You Provide

We collect information that you voluntarily provide to us when you:

• Create an account: Name, email address, username, password, profile information, and optional profile picture
• Submit vulnerability reports: Report details, proof of concept code, screenshots, videos, and related documentation
• Complete your profile: Professional background, skills, expertise areas, location, and social media links
• Communicate with us: Messages, support requests, feedback, and any other communications
• Participate in programs: Information required for program participation, payment processing, and tax reporting
• Subscribe to our newsletter: Email address and subscription preferences

2.2 Information Collected Automatically

When you use our Service, we automatically collect certain information:

• Device information: IP address, browser type and version, device type, operating system, and device identifiers
• Usage data: Pages visited, time spent on pages, clickstream data, search queries, and navigation patterns
• Log data: Access times, error logs, and system performance data
• Cookies and tracking technologies: Information collected through cookies, web beacons, and similar technologies (see Section 7 for more details)
• Location data: Approximate location based on IP address (with your consent where required)

2.3 Information from Third Parties

We may receive information about you from third-party sources:

• Authentication providers: If you sign in using third-party services (e.g., Google, GitHub), we may receive profile information
• Payment processors: Payment information and transaction history for reward processing
• Public databases: Information from publicly available sources to verify identity or prevent fraud
• Organizations: Information shared by organizations participating in bug bounty programs

3.1 Service Provision

• Create and manage your account
• Process and facilitate vulnerability submissions
• Enable communication between researchers and organizations
• Process payments and reward distributions
• Provide customer support and respond to inquiries
• Send service-related notifications and updates

3.2 Platform Improvement

• Analyze usage patterns to improve our Service
• Develop new features and functionality
• Conduct research and analytics
• Test and optimize platform performance
• Prevent fraud, abuse, and security threats

3.3 Communication

• Send newsletters, marketing communications, and promotional materials (with your consent)
• Notify you about program updates, new opportunities, and platform changes
• Respond to your questions and support requests
• Send important security and policy updates

3.4 Legal and Compliance

• Comply with legal obligations and regulatory requirements
• Enforce our Terms of Service and Code of Conduct
• Protect our rights, property, and safety, as well as that of our users
• Respond to legal requests and prevent illegal activities
• Facilitate tax reporting and compliance

4.1 With Organizations

When you submit a vulnerability report, we share:

• Your username and profile information (as displayed on your public profile)
• The vulnerability report and associated documentation
• Communication history related to the report

Organizations may use this information solely for the purpose of reviewing, triaging, and remediating vulnerabilities. They are required to maintain confidentiality and not use your information for other purposes.

4.2 Service Providers

We may share information with third-party service providers who perform services on our behalf:

• Payment processors for reward distribution
• Cloud hosting and infrastructure providers
• Analytics and monitoring services
• Email and communication services
• Customer support platforms

These service providers are contractually obligated to protect your information and use it only for the purposes we specify.

4.3 Legal Requirements

We may disclose your information if required by law or in response to:

• Court orders, subpoenas, or legal processes
• Government requests and regulatory investigations
• Requests from law enforcement agencies
• Legal obligations to protect rights, property, or safety

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change in ownership or control.

4.5 Public Information

Certain information may be publicly visible on your profile or in public leaderboards, including:

• Username and profile picture
• Public profile information you choose to share
• Leaderboard rankings and statistics (if you opt-in)
• Public acknowledgments and recognitions

7.1 Types of Cookies

• Essential cookies: Required for the Service to function properly (e.g., authentication, security)
• Functional cookies: Enhance functionality and personalization (e.g., preferences, settings)
• Analytics cookies: Help us understand how users interact with our Service
• Advertising cookies: Used to deliver relevant advertisements (if applicable)

7.2 Cookie Management

You can control cookies through your browser settings. However, disabling certain cookies may limit your ability to use some features of our Service. For more information about our cookie practices, please contact us.

8.1 Access and Portability

You have the right to access and receive a copy of your personal information in a portable format.

8.2 Correction and Update

You can update or correct your personal information through your account settings or by contacting us.

8.3 Deletion

You may request deletion of your personal information, subject to legal and contractual obligations.

8.4 Objection and Restriction

You may object to certain processing activities or request restrictions on how we process your information.

8.5 Opt-Out

You can opt-out of marketing communications by clicking the unsubscribe link in our emails or updating your preferences in your account settings.

8.6 Exercising Your Rights

To exercise any of these rights, please contact us at privacy@nidful.com. We will respond to your request within 30 days, subject to applicable law.