HACKASTRA INFOSEC L.L.C-FZ ("we") operates hacking.community. This Privacy Policy explains what personal data we collect, why we collect it, how we store and share it, and your rights — including rights granted by the EU General Data Protection Regulation (GDPR) for users in the European Economic Area, the UK Data Protection Act 2018, and UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection.
1. Data we collect
Account & profile data — email address, username, hashed password (or Google OAuth identifier), display name, profile picture, bio, skills, certifications, social links, location, language preference.
Activity data — questions and answers you post, votes, lab submissions, CTF solves, karma and XP totals, badges, marketplace purchases and listings, job applications.
Messages — direct messages are end-to-end encrypted; we store the ciphertext only and cannot read the contents. Metadata (sender, recipient, timestamp) is retained for delivery and abuse-prevention purposes.
Technical data — IP address, browser type, device identifiers, session cookies, approximate location derived from IP, referring page, and pages viewed. Used for security, rate-limiting, fraud prevention, and basic analytics.
Payment data — purchase amount, currency, and a payment-processor reference. Full card details are handled by Stripe and never stored on our servers.
We do not knowingly collect data from anyone under 16.
2. Why we process your data (legal basis)
- Contract — to provide the Platform you signed up for.
- Legitimate interests — to keep the Platform secure, prevent abuse, analyse usage in aggregate, and improve features.
- Consent — for optional cookies, marketing emails, and any other consent-based feature. You can withdraw consent at any time.
- Legal obligation — to comply with applicable law, tax reporting, and lawful requests from authorities.
4. International transfers
Some of our service providers are based outside the UAE (including the EU and the US). Where personal data is transferred outside the UAE or the EEA, we rely on Standard Contractual Clauses, adequacy decisions, or equivalent safeguards as required by applicable law.
5. Retention
We keep personal data only as long as needed for the purposes described, or as required by law. Indicative retention:
- Account & profile data — until you delete your account.
- Public content (Q&A, writeups) — kept for thread integrity even after account deletion, anonymised on request.
- Direct-message ciphertext — 90 days after delivery, then purged.
- Payment & tax records — 7 years (UAE statutory retention).
- Security logs (IP, login events) — 12 months.
6. Your rights
Under GDPR, UK DPA, and UAE Personal Data Protection Law you have the right to:
- Access — request a copy of your data; you can export it at any time from /settings.
- Correct — fix inaccurate or incomplete data.
- Delete — delete your account and request erasure of associated personal data.
- Restrict / object — to certain processing, including direct marketing.
- Portability — receive your data in a structured, machine-readable format.
- Withdraw consent — at any time, where processing relies on consent.
- Complain — to your local data-protection authority (EU users) or to the UAE Data Office (UAE users).
To exercise any of these rights, email legal@hacking.community. We respond within 30 days.
7. Security
We use industry-standard measures: TLS for data in transit, encryption at rest for sensitive fields, hashed passwords (bcrypt), end-to-end encrypted DMs, mandatory 2FA for admins, and rate-limited APIs. No system is perfectly secure — please report vulnerabilities responsibly to legal@hacking.community.
8. Changes to this policy
Material changes will be announced on the Platform and, where appropriate, by email. The "Effective date" at the top of this page reflects the latest version.
9. Contact
Data-protection questions or requests: legal@hacking.community.