Privacy Policy · Exploit Total

In order to ensure transparency and give you more control over your personal information, this privacy policy (“Privacy Policy”) governs how Anyday Security Inc. and Anyday Security Ltd. (as applicable) (together with its affiliates, “Anyday Security”, “we”, “our” or “us”), use, collect and store personal information that we collect or receive from or about you (“you”) in connection with our websites and online services, including the Anyday Security website / landing page available at https://anyday.security (“Landing Page”) and the ExploitTotal platform and community available at https://exploittotal.ai/ (“ExploitTotal”) (each individually, and collectively, the “Website”) and the services provided by Anyday Security to its corporate customers (the “Services”).

We greatly respect your privacy, which is why we make every effort to provide a platform that would live up to the highest user privacy standards. Please read this Privacy Policy carefully, so you can fully understand our practices in relation to personal information. With respect to Israeli privacy law, you are not legally required to provide us with personal information, and the provision of your personal information is voluntary and is provided based on your free will and consent. However, please note that if you choose not to provide certain information, we may not be able to provide you with the full range of the Website or Services or respond effectively to your requests. Important note: Nothing in this Privacy Policy is intended to limit in any way your statutory rights, including your rights to a remedy or other means of enforcement.

Table of contents:

What personal information we collect, why we collect it, and how it is used
How we protect and retain your personal information
How we share your personal information
Your privacy rights
International transfers of personal information
Use by children
Interaction with third party products
Analytic tools/cookies
Contact us

This Privacy Policy can be updated from time to time and, therefore, we ask you to check back periodically for the latest version of this Privacy Policy. If we implement material changes in the way we use your personal information, in a manner that is different from that stated at the time of collection, we will notify you by posting a notice on our Website or by other means and take any additional steps as required by applicable law.

1. What personal information we collect, why we collect it, and how it is used

We Process the Following Personal Information

Landing Page: Through our Landing Page, our processing is limited to: (1) Contact and Demo Request Details: when you choose to contact us, request a demo, or submit an inquiry via our forms, we collect your full name, work email address, company name, role/job title, and any additional message content or details you decide to provide; and (2) Newsletter and Marketing Updates: if you subscribe to our updates or newsletters, we collect your full name, work email address, and company name.
ExploitTotal: Through our ExploitTotal platform, personal information is collected depending on your user access tier and interactions: (1) Unverified / Anonymous Visitors: We automatically collect IP addresses, device identifiers, and browsing activity via cookies and analytics tools to deliver basic vulnerability metadata; (2) Signed-In Users: When you register an account, registration is permitted exclusively via supported single sign-on providers (specifically, Google or Microsoft account authentication), through which we collect your verified work email address, full name, authentication tokens, and account authentication records; (3) Verified Users (PoC Download Access): To achieve verified status allowing the download of non-harmful Proof-of-Concept (PoC) security exploit research materials, you must complete a verification form and provide your corporate/work email address belonging to your organization, first name, last name, company name, role/job title, declared country of residence, and optional professional profile (such as LinkedIn profile URL); and (4) Community Forum and Discussion Features: When signed-in and verified users participate in community forums, we collect your selected username, user-generated comments, forum activity, timestamps, and reports. Community forum comments and usernames are visible to other users and the public.
Personal information collected via the Services. We collect personal information that you voluntarily provide, including your full name, email address, password, as well as any other personal information that you decide to provide us. We also collect the contact and billing information of our customers.
Personal information automatically collected. Through your access to and use of our corporate Landing Page and the ExploitTotal platform, we automatically collect technical and usage data via cookies, pixels, and tracking technology and similar identifiers (“Technologies”), including your Internet Protocol (IP) address, device identifiers, browser type and version, language settings, geolocation data, hardware model, operating system, internet service provider, referring URLs, pages viewed, and interaction logs. We deploy a cookie consent banner to allow visitors to manage non-essential Technologies.
Personal information from Other Sources. We also may obtain personal information about you from other sources, including publicly - or commercially- available information, and through third-party data platforms, partners and service providers.
Personal information you provide to us in person. For example, when you visit one of our exhibition booths or attend one of our events and you provide us with your contact details.
Personal information we collect from online interactions. For example, if you attend a webinar, contact us via social media or otherwise interact with our business, including as a representative of a current / prospective customer, supplier or partner, we track and make a record of those interactions, which may contain your contact details, such as full name, email address, messages and any other personal information that you decide to provide us with.

We process personal information for the following purposes

ExploitTotal: For the ExploitTotal platform, our processing purposes include: (1) registering user accounts, authenticating credentials, and managing account settings (including via Google and Microsoft single sign-on); (2) verifying eligibility for elevated access tiers (including by vetting corporate credentials); (3) providing the ExploitTotal platform; (4) enforcing access controls, weekly download quotas, and compliance with our Terms of Use; (5) operating the CVE community forum; (6) sending administrative, verification, security and other transactional notifications to registered users; and (7) sending newsletters, security research briefings, product updates, and marketing communications.
Landing Page: For the Anyday Security corporate Landing Page, our processing purposes include: (1) receiving and responding to inquiries and messages submitted through the Contact Us form; (2) delivering requested corporate, cybersecurity, and research information; (3) measuring visitor traffic and engagement with our published materials; and (4) maintaining and optimizing the landing page interface.
For Administrative Purposes. Anyday Security processes personal data to: (1) provide technical support and handle user feedback or requests for expanded PoC download quotas; (2) maintain internal governance records, quality assurance, and data accuracy; (3) conduct internal system diagnostics and capacity planning; (4) preserve the operational resilience of our infrastructure; and (5) manage relationships with security researchers, customers, partners, and vendors.
Newsletters, Product Updates, and Marketing Communications: Where you subscribe to our mailing lists or consent to receive marketing communications, Anyday Security uses your contact details to send you newsletters, research bulletins, and product updates; you may withdraw consent or opt out at any point via the unsubscribe link in our emails or by contacting us as further described in Section 4.
Security purposes. Some of the personal information mentioned in this Privacy Policy will be used for detecting, taking steps to prevent and prosecuting fraud or other illegal activity; to identify and repair errors; to conduct audits; and for security purposes. Personal information may also be used to comply with applicable laws, with investigations performed by the relevant authorities, law enforcement purposes, and/or to exercise or defend legal claims.
De-identified and Aggregated Information Use. Anyday Security generates and utilizes anonymized, de-identified, and aggregated datasets (including metrics on AI exploit generation time, compute cost, and model capability across open-weight and commercial AI models) to operate, analyze, improve, and develop our Services (including to train and improve AI models) as well as to perform research, benchmark, and publish industry threat intelligence and other papers and statistics. We may share such de-identified and/or aggregated information with third parties for lawful purposes.
Cookies and Similar Technologies. Through Technologies, Anyday Security records technical telemetry and interaction patterns across our Websites and the Services. If you would like to opt out of the cookies and similar technologies we employ on the Website and Services, you may do so by blocking, deleting, or disabling them as your browser or device permits or by changing your setting and preferences on the Website.

The lawful bases we rely on for processing personal information are (if and when applicable)

The data subject has given consent to the processing of his or her personal information;
Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
Processing is necessary for compliance with a legal obligation to which the controller is subject; and/or
Processing is necessary for the purposes of legitimate interest.

2. How we protect and retain your personal information

2.1 Security. We implement and maintain industry-standard technical, organizational and security measures designed to protect your personal information. However, please note that we cannot guarantee that the personal information will not be compromised as a result of unauthorized penetration of our servers. As the security of information depends in part on the security of the computer, device or network you use to communicate with us and the security you use to protect your user IDs and passwords, please make sure to take appropriate measures to protect this information.

2.2 Retention of your personal information. Your personal information will be stored until we proactively delete it from our records, or until you send a valid deletion request. Please note that in some circumstances we store your personal information for longer periods of time, for example (i) where we are required to do so in accordance with legal, regulatory, tax or accounting requirements, or (ii) for us to have an accurate record of your dealings with us in the event of any complaints or challenges, and/or (iii) if we reasonably believe there is a prospect of litigation relating to your personal information or dealings.

We may share your personal information as follows:

3.1 The personal information Anyday Security gathers may share with our partners and other third parties.

3.2 We also share personal information about you with our affiliated companies.

3.3 We use third party service providers to process your personal information for the purposes outlined above, including, without limitation:

With cloud service providers for hosting purposes;
With websites and web content creation platforms in order to help us manage our Website;
With email and corporate productivity providers, marketing, CRM, other similar tool providers;
Cookie consent management provider;
With artificial intelligence tools and features; and
With analytic companies, in order to help us understand and analyze information we collect in accordance with this policy.

3.4 To the extent necessary, with regulators, courts, banks or competent authorities, to comply with applicable laws, regulations and rules (including, without limitation, federal, state or local laws), and requests of law enforcement, regulatory and other governmental agencies or if required to do so by court order, as well as for internal compliance procedures and to protect the safety, security, and integrity of Anyday Security, our Services, customers, employees, property, and the public as well as for export or sanctions compliance. We may use or disclose the personal information we collect in order to ensure that our users are complying with all applicable aspects of our policies.

3.5 We may disclose personal information with our lawyers, accountants, auditors and other professional advisors where necessary to obtain legal or other advice or otherwise protect and manage our business interests;

3.6 We may use or disclose the personal information to investigate, prevent, or take action regarding illegal activities, suspected fraud, cybersecurity threats, situations involving potential threats to the physical safety of any person, violations of this policy, or as otherwise required or allowed by law and regulations;

3.7 If, in the future, we sell or transfer, or we consider selling or transferring, some or all of our business, shares or assets to a third party, we will disclose your personal information to such third party (whether actual or potential) in connection with the foregoing events (including, without limitation, our current or potential investors). In the event that we are acquired by, or merged with, a third party entity, or in the event of bankruptcy or a comparable event, we reserve the right to transfer, disclose or assign your personal information in connection with the foregoing events.

3.8 Where you have otherwise provided your consent to us for sharing or transferring your personal information.

4. Your privacy rights

4.1 The following rights (which may be subject to certain exemptions or derogations) shall apply to certain individuals (some of which only apply to individuals protected by specific laws):

You have the right to withdraw consent to the processing, where consent is the basis of processing.
You have the right to request access to your personal information held by us, along with details on how it is processed, subject to certain conditions. You have the right to demand rectification of inaccurate personal information about you. We will promptly correct any information found to be incorrect.
You have the right to object to unlawful data processing under certain conditions.
You have the right to the erasure of past personal information about you (your “right to be forgotten”) under certain conditions.
You have the right to demand that we restrict the processing of your personal information, under certain conditions, if you believe we have exceeded the legitimate basis for processing, the processing is no longer necessary, or if you believe your personal information is inaccurate.
You have the right to data portability of personal information concerning you that you provided us in a structured, commonly used, and machine-readable format, subject to certain conditions.
The personal information we collect is not used for automated decision-making and profiling, except for automated processes in the context of marketing. As stated below, you can opt out of direct marketing by contacting us directly or by following the instructions through the unsubscribe options in our email messages.

4.2 You can exercise your rights by contacting us at info@anyday.security (for Landing Page inquiries) or info@exploittotal.ai (for ExploitTotal inquiries). You may use an authorized agent to submit a request on your behalf if you provide the authorized agent written permission signed by you (where this is permitted by applicable law). To protect your privacy, we may take steps to verify your identity before fulfilling your request. Subject to legal and other permissible considerations, we will make every reasonable effort to honor your request promptly in accordance with applicable law or inform you if we require further information in order to fulfil your request. When processing your request, we may ask you for additional information to confirm or verify your identity and for security purposes, before processing and/or honoring your request. We reserve the right to charge a fee where permitted by law, for instance if your request is manifestly unfounded or excessive. In the event that your request would adversely affect the rights and freedoms of others (for example, would impact the duty of confidentiality we owe to others) or if we are legally entitled to deal with your request in a different way than initially requested, we will address your request to the maximum extent possible, all in accordance with applicable law.

4.3 Deleting your account: Registered ExploitTotal users may request account deletion at any time by emailing info@exploittotal.ai; upon termination, personal identifiers linked to your account are removed from active access, although public comments, research submissions, and technical contributions previously posted in community forums or discussion threads will remain visible in aggregated or disassociated form to preserve community continuity.

4.4 Marketing emails and newsletters (opt-out): To stop receiving product updates, newsletters, or marketing emails from Anyday Security, you may click the unsubscribe link at the bottom of any marketing email or send an opt-out request with the subject “BLOCK” or “UNSUBSCRIBE” to info@anyday.security or info@exploittotal.ai, which we will process within a reasonable period after receipt.

5. International transfers of personal information

In order to run our business and provide our Website and Services to you, we transfer personal information to certain countries around the world, including to our affiliates and service providers, many of whom are located outside of your jurisdiction. Therefore, your personal information may be processed in countries with privacy laws that are different from privacy laws in your country. Whenever personal information is transferred internationally, we ensure it is protected by using Standard Contractual Clauses or other lawful mechanisms:

making sure the destination country has been deemed by the European Commission to provide an adequate level of protection for personal information; and/or
by executing data onward transfer instruments such as data processing and protection agreements.

According to the Israeli law, by providing your consent to this Privacy Policy, you acknowledge and agree that Personal Information relating to you may be transferred to and stored outside the borders of Israel, in accordance with applicable law and for the purposes described herein.

6. Use by children

We do not offer our products or Services for use by children and our Website and Services are intended solely for professionals and individuals aged 18 and older, and Anyday Security, therefore, does not knowingly collect personal information from anyone under the age of 18; if you are under 18, you may not register an account or submit personal information, without the involvement of a parent or a guardian. In the event that we become aware that you provided personal information in violation of applicable privacy laws, we reserve the right to delete it. If you believe that we might have any such information, please contact us at info@anyday.security.

7. Interaction with third party products

We enable you to interact with third party websites, mobile software applications and products or services that are not owned, or controlled, by us (each, a “Third Party Service”). We are not responsible for the privacy practices or the content of such Third Party Services. Please be aware that Third Party Services can collect personal information from you. Accordingly, we encourage you to read the terms and conditions and privacy policies of each Third Party Service.

8. Analytic tools/cookies

Google Analytics. The Website uses a tool called “Google Analytics” to collect information about use of the Website. Google Analytics collects information such as how often users visit this Website, what pages they visit when they do so, and what other websites they used prior to coming to this Website. We use the information we get from Google Analytics to maintain and improve the Website and our products. We do not combine the information collected through the use of Google Analytics with information we collect. Google’s ability to use and share information collected by Google Analytics about your visits to this Website is restricted by the Google Analytics Terms of Service, available here, and the Google Privacy Policy, available here. You may learn more about how Google collects and processes data specifically in connection with Google Analytics here. You may prevent your data from being used by Google Analytics by downloading and installing the Google Analytics Opt-out Browser Add-on, available here.
Mixpanel. We collect personal information such as your email address and your user activity through the use of Mixpanel. Mixpanel’s ability to use and share personal information is governed by the Mixpanel Terms of Use, available here, and the Mixpanel Privacy Policy, available here. You can opt-out of Mixpanel’s services by clicking here.
HubSpot. Anyday Security uses HubSpot for customer relationship management (CRM), handling contact form submissions, and dispatching newsletters and product updates, which may involve cookies and tracking pixels governed by HubSpot’s Privacy Policy (https://legal.hubspot.com/privacy-policy).
We use log files. We use such personal information to analyze trends, administer the Website, track user movement around the Website, and gather demographic information.

We reserve the right to remove or add new analytic tools, cookies, pixels and other tracking technologies.

9. Contact us

For any questions, concerns, or to exercise your privacy rights, please contact us at info@anyday.security (for Anyday Security website matters) or info@exploittotal.ai (for ExploitTotal platform matters).