Privacy Policy

We sell security testing, so we have written this to be checked rather than trusted. Everything below describes what this website actually does today — including the parts that are not finished, which are listed openly at the end. If you find something here that does not match what the site does, tell us at [email protected] and we will fix the page or the behaviour.

Who we are

The controller of the data described below is LIMITED LIABILITY COMPANY "ShadowCore" (ТОВ «ШадоуКор»), a company registered in Ukraine under registration code 45495220. Company details are on our legal information page; our registered postal address is in Ukraine's state register under that code, and we will send it to you on request.

We are established in Ukraine, not in the European Union, and we have not appointed a representative in the Union. If you are in the EEA and that matters to you, write to us and we will tell you where that stands.

For anything in this policy — questions, requests, complaints — write to [email protected]. That address reaches a person, not a ticket queue.

What this policy covers

This policy covers this website, shadowcore.pro, and the enquiries you send through it. It does not cover the data we handle inside a paid engagement — that is governed by the contract and the non-disclosure agreement we sign with the client before any testing begins.

What you tell us

There are exactly three forms on this site, and they are the only places where you type something and we receive it.

The contact form asks for your name, your email address, your message, and optionally which service you are interested in. Name, email and message are required; without them we cannot reply.

The sample report request asks for your name, your work email address and your company name, all three required. We use that address to send you the redacted sample report and, if it seems useful, to follow up on it once. There is no newsletter on this site and we do not have one to add you to.

The detailed scoping questionnaire, reached from our pricing calculator, is the long one — around seventy fields. Required: your name, work email and company. Optional: job title and phone number. The rest describes the systems you want tested, and some of it is sensitive enough that we would rather name it explicitly than hide it behind "technical details":

• counts and structure — applications, user roles, pages and API endpoints, hosts and network segments, Active Directory domains, cloud accounts and regions;
• security controls you run — your authentication and multi-factor method, whether a WAF or bot protection sits in front of the application, whether you can allow-list our source addresses, your VPN and remote-access exposure, and which EDR, IDS or SIEM products you use;
• live identifiers — the URLs, domains and public IP ranges in scope, and your technology stack;
• unresolved findings from your last penetration test, and when that test was;
• scheduling and commercial context — your preferred start, report deadline, testing window, blackout dates, what is driving the test, your budget range, and your NDA position;
• a technical contact for the testing — a name and role, which may be someone other than you.

We will be blunt about what that list means: the questionnaire asks you to describe your own attack surface, including what is currently unpatched. Give us only what you are comfortable giving us. A partial answer still produces a useful estimate and we can cover the rest on a call under an NDA. We never need live credentials, and we will never ask for them through a web form.

Your answers produce an internal time-and-price estimate automatically. You are not shown a number on that page, and no decision about you is made by the calculation: a person reads the answers and writes the proposal. That internal estimate travels with your answers in the notification email we receive, and it may be written into the contact record described below.

What happens without a form

Serving a web page means receiving a request, and a request carries your IP address, the page you asked for, your browser's user-agent string and, where your browser sends one, the page you came from. Our hosting provider processes that, as every host does.

Our hosting provider asks your browser to report network errors it hits on our site back to the provider — the address you tried to load and the error. Successful requests are not reported.

The same provider also runs browser-detection code on the pages it serves, and on the three form pages it loads its bot-check widget when the page renders — not only when you submit. So it sees your IP address while you read, site-wide. When you do submit a form, our server additionally asks the provider to verify the widget's token and passes your IP address along with it, where our platform makes that address available to the code.

Two things on this site compute in your browser and send us nothing at all: the NIS2 applicability check, and site search — your query is matched against a file your browser has already downloaded and never leaves your device.

The quick price calculator also computes its number in your browser, with one exception worth knowing. If you click through from it to the detailed questionnaire, the calculator carries your six answers — target type, test mode, number of roles, endpoints, hosts and applications — in the link's web address. They therefore reach our server with that page request and appear in our hosting provider's request logs. If you would rather they did not, open the questionnaire from the menu instead of from the calculator's button.

Cookies and analytics

Our own code sets no cookies. It writes nothing to local storage or session storage either. There is no cookie banner on this site because our code gives us nothing to ask you about.

The bot-check widget on our forms is a provider component loaded in its own frame and may set storage of its own within that frame when it runs.

There is no working analytics on this site. Our hosting platform injects its own cookie-less page-view script into the pages it serves, but our content security policy does not allow that script's host, so your browser blocks it before it runs and no page views are counted. We have left it blocked deliberately. If we ever turn it on, this page will say so before it happens.

There is no advertising, no remarketing and no tracking pixel on this site.

Who else handles your data

We keep this list short on purpose. These are all of them.

Cloudflare (United States) hosts this website, runs the code behind the three forms, provides the bot check and the browser-detection described above, and handles network-error reports. It processes every request to the site.

Resend (United States) delivers the notification email that a form submission generates. The content of your submission is in that email.

Google Workspace (United States) hosts the mailbox that receives it, which is where your enquiry is read.

HubSpot (United States) is our customer relationship system. A submission from the contact form or the scoping questionnaire creates or updates a contact record there with your name and email address and the stage of the conversation. Depending on how that system is configured, the text you wrote and the service you selected may also be stored in it; where those fields are unavailable, only your name, email and stage are. A sample report request does not reach HubSpot at all.

We do not sell your data, we do not rent it, and we do not share it with anyone outside this list except where the law requires it of us.

Want the data-processing agreements we hold with these providers, or a current subprocessor list with locations? Ask, and we will send you what we have.

Where your data goes

Your data is handled in Ukraine, where we are, and by the providers above, which are established in the United States. Neither country has an adequacy decision from the European Commission covering this flow in general terms.

Each of those providers publishes data-processing terms that include the European Commission's standard contractual clauses. We are in the process of confirming, provider by provider, which of those terms we have actually executed, and we will tell you honestly where each one stands if you ask. We would rather write that than imply paperwork we have not checked.

How long we keep it

Straight answer: we do not yet have automated retention limits in place, and we are not going to pretend otherwise on this page. Today, an enquiry email stays in our mailbox and a contact record stays in our customer relationship system until someone removes it.

The criteria we apply, and what we are putting in place:

• enquiries that do not lead anywhere are kept while the conversation could plausibly resume, and we are configuring our mailbox to remove them automatically after 24 months;
• contact records are kept while we have an active commercial relationship or a reasonable prospect of one, and we are configuring our customer relationship system to remove them 36 months after our last exchange;
• where Ukrainian accounting or contract law requires us to keep a record, it is kept for the period the law sets and no longer.

Until those rules are enforced automatically, deletion happens when you ask — and that works today. See your rights. When the automatic rules are live, this section will say so plainly instead of describing a plan.

Why we are allowed to use it

We rely on legitimate interest under Article 6(1)(f) of the GDPR: you contacted a supplier about a commercial service, and our interest is in reading your message and answering it. We do not ask you for consent on these forms and we do not record any, because the processing does not rest on consent — which also means there is nothing for you to withdraw, and you can object to our legitimate interest at any time.

The bot check rests on the same basis: our interest in not drowning in automated submissions. If a conversation becomes an engagement, the basis for what follows is the contract between us.

Your rights

If the GDPR applies to you, you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to our handling it on the basis of legitimate interest, and ask for it in a portable form. Ukrainian data protection law gives comparable rights.

Write to [email protected]. We answer within 30 days and we do not charge.

We will verify who you are before we send anything. What we hold can include detail about your organisation's systems, so handing it to the wrong person is a security incident, not a customer-service lapse. Normally verification is simple: we reply within the thread that already exists, to the address that sent it. If we cannot establish that a request comes from the person it claims to, we will ask for something that establishes it, and we will not send the data until we are satisfied. If you think we are being unreasonable about it, say so and a human will look again.

If we handle it badly you can complain to a data protection authority — in the EEA, the one for the country you live in; in Ukraine, the Verkhovna Rada Commissioner for Human Rights.

Somebody else's details

The scoping questionnaire has a field for a technical contact for the testing. If you name someone other than yourself there, we receive their name and role from you rather than from them.

That puts the duty to tell them on us, not on you. When we first contact that person, we tell them we hold their details, that we got them from you, and that this policy applies to them — including the right to have their details deleted. If an enquiry goes no further and we never contact them, their name is removed along with the rest of the enquiry. Please still mention it to them before you submit, because being named to a supplier by surprise is unpleasant even when it is lawful.

Our own team

Our about page names members of our team by first name and surname initial, with their role and professional certifications. They have agreed to that. If a current or former colleague wants their entry changed or taken down, the same address works and we will do it.

How we protect it

The site is served over HTTPS only, with a content security policy that restricts what a page is allowed to load — the same policy that is currently blocking our own hosting provider's analytics script. Form submissions are checked for automation before they are processed. Access to the mailbox and the customer relationship system is limited to the people who need it. Our broader security practices are described in our Trust Center.

We will not claim this site is unbreakable. If you find a problem with it we would rather hear from you than not: [email protected]. We do not currently publish a formal breach-notification commitment for website data; if you need one in writing before you send us anything, ask and we will give you one.

What is still being built

A privacy policy that hides its gaps is worth less than one that lists them, so here are ours as of the date at the top of this page. Each is being worked on:

• automatic retention limits in our mailbox and customer relationship system;
• confirmation of which data-processing agreements and transfer safeguards we have executed with each provider;
• our position on appointing a representative in the European Union, and publishing a postal contact address;
• a written breach-notification commitment for data submitted through this site;
• a link to this policy from each of the three forms, next to the submit button.

If any of these matters to a decision you are making about us, ask and we will tell you where it actually stands rather than when we hope to finish it.

Changes to this policy

When what we do changes, this page changes with it, and the date at the top moves. We do not keep a public archive of previous versions; if you need to know what this page said on a particular date, ask and we will tell you.