Defaults.Exposed › Privacy Policy

Privacy Policy

Last updated: 2026-09-27 · Version: 1.2

Privacy, the short version

• If you run a free scan, we log the domain, your rough location/IP, and where you came from, to run the check, prevent abuse, and understand our traffic. No account, no email needed. A completed scan is also reported to Meta, and to Reddit if you arrived from a Reddit ad (§4.2).
• If you ask for a Fix Guide or buy something, we collect your email and domain. There are no accounts and no passwords, you sign in with your email and a one-time code, and reach your deliverables through signed magic links.
• Payments go through our payment provider, Stripe. Your card details go straight to Stripe, we never see or store your full card number.
• We only email you marketing if you opt in, and every email carries an unsubscribe link. Service messages (receipts, the guide, alerts you asked for, renewal notices) are a closed set and carry no ads.
• Cookies: strictly necessary cookies, Google Analytics 4 for usage statistics, Lucky Orange for recording how pages are used, our own first-party visitor id and attribution cookies, and two advertising pixels, from Meta and Reddit, that measure our ad campaigns. These tags load when a page opens. We do not ask for consent first. You can switch Google Analytics and the pixels off for your browser at /optout; that does not stop Lucky Orange. Details in §4.
• We use a small set of processors (payments, email, analytics, hosting, and Cloudflare, which every request to the Site passes through), and we share website activity with two advertising platforms, Meta and Reddit. Several of these are in the United States (§7). We don’t sell your data.
• You have rights over your data, access, correction, deletion, opt-out. Being UAE-based doesn’t remove the rights you have under EU/UK law. Contact us and we’ll act.

1. Who is responsible for your data

The controller is Defaults Exposed FZ-LLC, a UAE free-zone company (“Defaults.Exposed”, “we”), registered office CWEP3805, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates · trade licence no. 47034427 · registration no. 0000004091879 (Ras Al Khaimah Economic Zone Authority). Privacy contact: privacy@defaults.exposed.

We serve EU and UK customers and keep our own database and logs on servers in the EU, so we operate as if GDPR/UK-GDPR applies to that data, and we also respect the UAE PDPL (Federal Decree-Law No. 45 of 2021) as a UAE entity. Some of the data goes to recipients outside the EU, listed in §7.

One part of the Site does not follow the consent model those rules expect. Google Analytics, the Meta Pixel and the Reddit Pixel (§4) load when you open a page, without asking for your consent first, and our server reports some of your actions to Meta and Reddit (§4.2). We do not show a consent banner. The control we offer is an opt-out: visiting /optout switches Google Analytics, the two pixels and the server reports off for your browser (§4.4).

1.1 Data Protection Officer / representative. We have not appointed a statutory DPO or EU representative; privacy questions go to privacy@defaults.exposed and are handled by the founder.

2. What we collect, why, and our lawful basis

Orders and entitlements are keyed to (email, domain) and stored in our application database on our EU servers.

2.1 We do not deliberately collect special-category data, and you should not send us any. The domain data we assess is publicly published DNS/web configuration, not private content. We never collect passwords or credentials. Not yours, not your registrar’s, not your DNS provider’s. Delegated access or guided change only; our intake rejects password-like content.

2.2 Card data. Payments are processed by our payment provider, Stripe. Your card details are submitted directly to Stripe; we never receive or store your full card number.

2.3 Legitimate-interest assessments (LIA). Where we rely on legitimate interest above (scan logging + IP/location, the third-party admin contact, non-marketing lead retention), we keep a documented balancing test (LIA) on file and will make its outcome available on request. We do not rely on legitimate interest in place of consent for marketing email (§5). The analytics and advertising tags in §4 are the exception described in §1: they do not wait for consent. The control we offer is the opt-out at /optout, which covers Google Analytics and the pixels.

2.4 Third-party contacts you give us. If you name your IT admin or a liaison so we can act on your behalf, we use their details only to coordinate the work you bought. On first contact we tell that person who we are, why we have their details, and point them to this Policy and their rights. When the job closes, we delete their details. You confirm you may lawfully share their details with us.

3. Who we share it with (processors and recipients)

We use a small set of providers. The processors below act on our instructions. The two advertising platforms, listed separately, process data under their own terms. We do not sell your personal data.

• Stripe (US/global), payments, subscriptions, tax, receipts.
• Resend (US), sending transactional and (consented) marketing email.
• Microsoft 365 (EU tenancy), receiving email sent to @defaults.exposed. Where a Fix Guide or other message is copied into a @defaults.exposed mailbox, that copy sits in the M365 store and is covered by the retention rules in §6.
• Google Analytics 4 (Google, US). Website analytics (see §4).
• Cloudflare (global network), in two roles. First, it sits in front of the whole Site as a reverse proxy: every request to the Site, with your IP address, browser details and the address you asked for, passes through Cloudflare’s network before it reaches our servers. Cloudflare also asks your browser to send Network Error Logging (NEL) reports to Cloudflare when a connection to the Site fails. Second, it is the DNS platform for service tiers where you delegate your domain’s nameservers to a zone we operate.
• Hosting / infrastructure. Our servers run with OVH in the EU (France/Germany); the primary database and the scan/IP logs sit on our own servers there, not a third-party SaaS database.
• Professional advisers / authorities. Only where legally required, or to establish or defend legal claims.

Advertising platforms (see §4):

• Meta Platforms (US), through the Meta Pixel and Meta’s Conversions API, to measure and attribute our ads on Meta’s platforms. Meta processes this data under its own terms and the Meta Privacy Policy.
• Reddit (US), through the Reddit Pixel and Reddit’s Conversions API, to measure and attribute our ads on Reddit and build Reddit ad audiences. Reddit processes this data under its own terms and the Reddit Privacy Policy.

4. Cookies and analytics

The Site uses first-party cookies of its own, Google Analytics 4, and two advertising pixels, from Meta and Reddit. The analytics tools and the pixels load when you open a page, without asking for consent first (see §1). /optout switches off Google Analytics and the pixels. What runs:

Google Analytics 4 gives us aggregate statistics about how the Site is used. The first-touch attribution cookie records the source of your first visit and travels with your scan or sign-up so we can attribute it.

4.1 Advertising pixels. Most pages load the Meta Pixel (Meta Platforms) and the Reddit Pixel (Reddit). Each reports your page views to its platform, along with its cookie, your IP address and your browser details. We use them to measure and attribute our ad campaigns. The platforms can also use these page views to build audiences for our ads, for example to show a Reddit ad to people who have visited the Site.

4.2 Server-side conversion reports. Our server also reports some actions directly to Meta and Reddit through their Conversions APIs: a completed scan, a view of the pricing page, the start of a checkout, a Fix Guide request (Meta only) and a completed purchase with its value. These reports can include your IP address, your browser’s user agent, the _fbp and _fbc values, the ad click id, and a SHA-256 hash of your email address if you have given it to us. Meta receives the IP address as is, and Reddit receives it hashed. Reddit only receives these reports when you arrived from a Reddit ad.

4.3 Third parties. Meta and Reddit process the data they receive under their own terms and privacy policies: the Meta Privacy Policy and the Reddit Privacy Policy.

4.4 Opting out. Visiting /optout sets the de_notrack cookie in your browser. While it is present, the Meta Pixel and the Reddit Pixel do not load, Google Analytics sends no data, and our server sends Meta and Reddit no reports of your scans, pricing page views, checkouts or Fix Guide requests. It only covers that browser, clearing your cookies removes it, and /optout?on undoes it. It does not stop de_vid, de_attr or de_src being set. If you buy something, our server still reports the purchase to Meta, and to Reddit if you arrived from a Reddit ad. With JavaScript turned off, a small Meta Pixel image still loads on most pages and reports a page view. You can also limit ads on each platform in Meta’s ad preferences and Reddit’s privacy settings. Browser tracking protection and content blockers stop the pixels from loading.

5. Marketing

5.1 We only send marketing email if you opted in (the consent flag on your lead/order). Every marketing email has an unsubscribe link, and you can opt out anytime by using it or emailing us. Opting out of marketing does not stop essential service messages.

5.2 Transactional messages are a closed set, sent on the basis that you asked for the service, not on marketing consent, and contain no promotional content: (a) your Fix Guide; (b) purchase receipts and invoices; (c) your Dossier / Deliverable; (d) monitoring/security alerts you subscribed to; (e) subscription renewal and cancellation notices required by law or by the Terms. A renewal notice states the renewal only; it will not up-sell. Anything beyond this list is marketing and needs your opt-in.

6. How long we keep it

• Scan data: scan results are kept as aggregate research data, they feed the Defaults.Exposed census. This is the retention counterpart to the census/aggregate carve-out in Terms §9.3.
• Leads (you asked for a free Fix Guide or opted into email): kept until you unsubscribe or ask us to erase you, then removed (minus anything we must keep for law/records).
• Orders, entitlements, and seal records: kept for 6 years as financial records.
• Delegated-zone data (service tiers where we operate your DNS zone): deleted 30 days after offboarding, matching the 30-day grace window in the offboarding process.
• Intake contact details (including any third-party admin/liaison details): deleted when the job closes.
• Verification codes: minutes. They expire and are deleted automatically.
• Evidence bundles / verification pages: your Dossier or certificate is a publicly verifiable artifact. The /verify page shows the domain, grade, and seal metadata (no personal emails), and anyone can check it, forever, without an account. If you exercise a valid erasure or withdrawal right, the verify page is dated and marked “withdrawn/refunded” rather than silently deleted. Your rights are honoured and the evidence chain stays honest.

7. Where your data is processed (international transfers)

Customer and scan data lives on our EU servers (OVH, France/Germany). Not all data stays in the EU. Every request to the Site passes through Cloudflare (global network), which also runs the DNS platform for service tiers. Email is delivered via Resend (US) and received via Microsoft 365 (EU tenancy). Payments run through Stripe (US/global). Website analytics run through Google Analytics 4 (Google, US). Advertising measurement runs through Meta Platforms (US) and Reddit (US), which process that data under their own terms.

Where Stripe, Resend, Cloudflare, Microsoft or Google processes data outside the EU/UK, transfers rely on that processor’s standard contractual clauses / EU-US Data Privacy Framework certification, which each of them publishes. As a UAE entity we also apply a PDPL cross-border transfer basis to the same flows.

8. How we protect it

We are a security company and name our controls rather than leaving them generic. Technical and organisational measures include: encrypted transport (HTTPS); access controls with multi-factor authentication on administrative access; least-privilege roles; access logging and review; secrets kept out of the codebase; and regular backups. Two things get stricter treatment:

• The signing key that seals Dossiers and certificates is kept outside the code repository and is managed under a documented incident-response and revocation procedure, with a defined rotation path; each verify page states the signing key’s validity window.
• Delegated access into client domains (service tiers) is logged and reviewed per client. We never hold your passwords: access is by NS delegation or guided change only.

No system is perfectly secure, but we design the Services around keeping your data minimal in the first place: no accounts, no passwords, no stored card numbers.

8.1 If something goes wrong (breach response). We keep an internal breach register. If we confirm an incident affecting your data or your delegated zone, we notify you by email without undue delay and within 72 hours of confirming it, and we notify regulators where the law requires. Our processor agreements require each processor to notify us of a breach without undue delay so we can meet these deadlines.

9. Your rights

Depending on where you are, you can ask us to: access the data we hold about you, correct it, delete it, restrict or object to certain processing, withdraw consent (e.g. for marketing), and receive a portable copy. To exercise any of these, email privacy@defaults.exposed; we’ll verify your identity and respond within 30 days. Our UAE seat does not limit the rights you have under GDPR/UK-GDPR (or your local consumer/ data-protection law) where those apply to you. You also have the right to complain to your data-protection regulator, for EU/UK individuals, that includes your home authority.

10. Children

The Services are for businesses and adults. We don’t knowingly collect data from children under 16. If you believe a child gave us data, contact us and we’ll delete it.

11. Changes

We may update this Policy. Material changes will be notified on the Site or by email. The “Last updated” date always reflects the current version.

12. Contact

Privacy questions or requests: privacy@defaults.exposed · Defaults Exposed FZ-LLC, CWEP3805, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates · trade licence no. 47034427 · registration no. 0000004091879 (Ras Al Khaimah Economic Zone Authority).