Keep the evidence useful. Keep the data small.

What this site collects

The scope form collects the name, work email, company, optional public links, target path, decision needed, preferred timing, consent, and submission time that you choose to provide. A one-way network fingerprint is used only to limit repeated submissions and is not intended to reveal your raw IP address. The hosting provider may also process basic security and service logs.

This site has no customer account, checkout, advertising tracker, or mailing-list sign-up. Form records are stored in the site's protected enquiry database and are visible only through the configured owner sign-in.

What an engagement may use

Only information needed to qualify an enquiry, form the agreement, verify testing authority, deliver the named cases, protect the systems involved, invoice, keep transaction records, handle an objection, or comply with law. This may include business contact details, accepted scope, authorization evidence, invoice references, and the minimum technical evidence required for the report.

Do not send passwords, API secrets, access tokens, OTPs, payment credentials, customer exports, or sensitive production data in ordinary email.

Use and sharing

Information is used only for the stated enquiry or engagement, record keeping, safety, dispute handling, and lawful compliance. It is not sold. It is shared only with a service provider needed for hosting, email, secure file transfer, payment, or professional advice, or when law requires it. Each buyer’s private evidence is kept separate and goes only to recipients named in the accepted scope.

Retention

• Unqualified or inactive form enquiries: normally deleted within 90 days.
• Abuse-prevention fingerprint: used for a rolling 24-hour submission limit and removed with the related enquiry record.
• Raw private test evidence: normally deleted 30 days after delivery.
• Credentials and tokens: not retained after their relevant test.
• Final report and redacted evidence index: normally retained for 12 months.
• Contracts, invoices, receipts, payment and delivery records: at least five years.
• Opt-out record: the minimum needed to prevent repeat contact.

A contract or law may require a different period; the accepted scope records it.

Your choices

You may ask what personal information is held, request correction or lawful deletion, object to direct marketing, withdraw consent, or complain. Identity may be verified without asking for excessive new information. Some transaction or legal records cannot be deleted immediately.

Security or unexpected data

Testing stops if authorization is disputed, a production effect appears, or unexpected sensitive data is exposed. The named buyer contact is notified and work resumes only after a safe written path is confirmed.