Privacy Policy

1. Information Handling

We do not collect personal data from customers beyond what is required for service delivery. Payment information is processed securely through authorized gateways such as PhonePe Business UPI, bank transfer, wire transfer, and Remitly. Information collected automatically when you browse this website is covered separately in section 2 below.

2. Cookies and Tracking

This website sets no cookies and runs no analytics. There is no tracking script of any kind on any page: no advertising or retargeting pixels, no session recording, no third party analytics, and nothing that follows you between sites or between visits. Nothing is stored on your device.

Because every page and asset is served from our own domain, no request you make while browsing this site reaches any third party. You do not need to accept anything, opt out of anything, or configure your browser in any particular way, and there is nothing here for a tracker blocker to block.

Our hosting provider processes standard server records such as IP addresses in order to deliver pages and to protect the site from attack. These are used for security and reliability only, never to profile visitors.

3. Contact Form and Enquiries

When you submit the enquiry form on our contact page, we collect your name, email address, the service you are interested in, your message, and your company name if you choose to provide it. We use this solely to respond to your enquiry and, if it leads to an engagement, to deliver the service you have asked for. We do not add you to a marketing list without your consent.

We do not operate a database of enquiries. Your submission is delivered directly to our inbox as an email and is not stored in any customer relationship or marketing system. Your IP address is checked at the moment of submission to limit automated abuse of the form, and is not retained afterwards.

Two service providers process this data on our behalf, and each is bound to use it only for the purpose we have engaged them for:

• Cloudflare, Inc. hosts this website and handles the form submission
• Resend delivers the resulting email to us

Cloudflare and Resend are based in the United States, which means your enquiry is transmitted outside India in the course of reaching us. If you would rather not use the form, you are welcome to email or call us directly using the details at the end of this policy. Booking a call through the scheduling link on our contact page takes you to Calendly, an external service governed by its own privacy policy.

4. Confidentiality

All customer information, reports, and engagement details are treated with strict confidentiality. We sign Non-Disclosure Agreements (NDA) before any engagement to ensure client trust.

5. Data Retention

We keep personal data only for as long as it serves the purpose it was collected for:

• Enquiries that do not lead to an engagement are deleted from our inbox within 12 months.
• Engagement records, including test reports and findings, are retained for the period agreed with the client in the governing contract or NDA. Where no period is agreed, we retain them for the duration of the client relationship and for 2 years afterwards.
• Financial and tax records are retained for 8 years, as required of us under Indian law.

Once a retention period ends, the data is deleted. You can also ask us to erase your data sooner, as described below.

6. Your Rights

Under the Digital Personal Data Protection Act, 2023, you may ask us what personal data of yours we hold, ask us to correct it, ask us to erase it, or withdraw a consent you have previously given. To make any of these requests, or to raise a grievance about how we have handled your data, write to contact@xploitix.com. We will respond within 30 days.

7. Service Scope

We offer services including Penetration Testing, Vulnerability Management, and others as detailed in the services section of our website.

For any concerns regarding privacy or data handling, contact us at contact@xploitix.com or +91 8688443191.