Privacy Policy

Who we are and how to contact us

Exploit Armor W.L.L. is registered in the Kingdom of Bahrain at Unit 202, Building 120, Road 3803, Block 338, Manama Center, Kingdom of Bahrain. Exploit Armor W.L.L. operates ExploitArmor, a cyber decision intelligence platform and cybersecurity services business.

For privacy requests or questions about personal data, contact admin@exploitarmor.com.

Information, purposes and choices

ExploitArmor may process account, organization, security, technical and commercial information to provide and secure the platform, respond to requests, administer subscriptions and meet legal obligations. Subscription-request contact and billing details are used for commercial review and administration and are not treated as cyber-intelligence data.

On the public service and Enterprise inquiry forms, contact name, work email, organization, country or region, preferred timeframe, business objective and authorization confirmation are required. Service selection is required on a service inquiry. Role or title is optional. If required fields are not provided or the authorization confirmation is not selected, the form cannot be submitted. Do not submit passwords, access tokens, vulnerability evidence or other secrets; attachments are not accepted.

We use inquiry information to assess and respond to the requested commercial or service inquiry. Sending an inquiry does not enroll you in marketing communications. The forms do not send customer acknowledgement emails.

Recipients and international processing

When a secure inquiry form is enabled, its content is routed to authorized Exploit Armor personnel at admin@exploitarmor.com. Relevant data may also be processed by providers supporting website hosting, security and abuse prevention (including Turnstile), email delivery, professional advice, and lawful public-authority requests. The planned Cloudflare Pages, Workers, Turnstile and Email Service components are not yet configured for live submissions; provider locations and transfer safeguards must be confirmed before activation. Depending on the providers used, information may be processed outside the Kingdom of Bahrain under applicable transfer requirements.

The static candidate has no inquiry database, CRM or ticketing system. Its proposed guard retains only a keyed IP rate-limit value and an idempotency status/timestamp for up to 24 hours; it does not retain inquiry content. Forms remain disabled and fail closed until protections and delivery bindings are configured.

Your privacy rights

You may contact us to ask whether personal data about you is processed, request information or correction, and exercise other rights available under applicable law. We may need to verify identity and apply lawful exceptions. A request is reviewed under applicable law; submitting one does not itself confirm that deletion is complete.

Essential Trial and retention schedule

The Essential Trial provides seven days of access, beginning only after required verification and setup and your explicit activation. At expiry, platform access becomes upgrade-only; account-security, privacy, deletion and paid-plan request functions remain available. One trial per verified normalized email is permitted, with repeat eligibility restricted until 365 days after trial expiry.

The approved retention schedule sets heavy technical data for deletion 30 days after trial expiry and inactive account and eligibility-record deletion for 365 days after expiry, subject to paid conversion, shared identity, legal/security/dispute/investigation holds and other lawful retention requirements. These are policy due dates, not a guarantee of physical deletion by those dates: the complete erasure adapter and automated production processing are not currently operational. A deletion request is recorded and must be reviewed; it does not confirm completion. If conversion occurs before heavy-data deletion, trial data is retained. After deletion, a later paid workspace starts with clean technical data.

For repeat-trial eligibility, the design retains a secret-keyed HMAC of the normalized email with its lock expiry and minimal reason/audit data. It does not retain the plaintext email for that purpose after early account deletion. This token is pseudonymous, not irreversibly anonymous; it remains protected and potentially linkable by a party with the secret.

Encrypted backups can retain records after deletion from active systems. The backup-retention policy describes daily, weekly and monthly encrypted copies, but the current production backup rotation and deletion timing have not been verified; no fixed time for removal from every backup is promised. Backup cleanup is report-only until restore evidence and separate approval. Authorized recovery may restore an earlier copy, so expiry and deletion controls must be reapplied before restored data is made available. Essential Trial users may submit an account deletion request in Subscription and trial. Applicable privacy and deletion rights remain subject to governing law and lawful retention bases.

Essential includes documentation and in-product guidance, with no support entitlement. This notice does not limit rights available under applicable privacy law.