Who this covers

This policy covers kazasec.com, the marketing site, the free security tools, and the security news and advisories archive. KazaSec is a cybersecurity consultancy; if you engage us for a paid assessment or consulting work, that engagement is governed separately by the contract you sign with us, not this page.

Questions about anything below, or a request to access or delete your data: email [email protected].

Cookies and local storage

• Strictly necessary, no consent required: a kzs_vid cookie, a random identifier with no personal information in it, set the first time you visit. It exists only to enforce the free tools' daily usage limit per visitor and expires after one year. Cloudflare Turnstile and Google reCAPTCHA (used on the Contact/Collab forms and the Domain Reputation tool, to keep bots from abusing them) may also set their own cookies as part of that check.
• Analytics: Google Analytics, if and when it's turned on, only loads after you acknowledge the cookie banner. Not answering means its script never loads at all. Your acknowledgment is remembered in your browser's local storage (not a cookie) so you're not asked again every visit, clearing your browser's site data resets this and shows the banner again.

Information collected through forms

The Contact and Let's Collab forms collect whatever you type into them, typically your name, email address, and message. Submissions are saved so we can respond, and (when our email service is configured) trigger a notification to us. We don't sell, rent, or share this with any third party for their own marketing. We keep a submission for as long as it's useful for responding to you and maintaining a record of that conversation, then delete it on request, see Your rights below.

The free security tools

Tools like IP Info, Breach Check, CVE Lookup, and the others under /tools work by taking whatever you submit, a domain, an IP, an email address, a password to check, and querying it against the relevant public or third-party data source to produce your result. Specifics:

• Breach Check sends the email address you enter to Have I Been Pwned's API to check it against known breaches. We don't store the address ourselves.
• Password Strength Checker never sends anything anywhere , the check runs entirely in your browser and nothing you type is transmitted to us or anyone else.
• Domain/IP-based tools (IP Info, Blacklist Checker, Subdomain Finder, Domain Reputation, Domain Doppelganger Finder, and similar) query public DNS resolvers, RDAP registries, and comparable public data sources with whatever you submit, the same kind of lookup those tools' names describe.
• Your IP address is used briefly to rate-limit abusive request volume. It's held in server memory only, is never written to a database, and is automatically discarded within minutes.
• Which tools you've used and how many times today (tied to the anonymous kzs_vid identifier, not your identity) is kept for 30 days to enforce the daily usage limit, then automatically deleted.

Who we share information with

We use a small number of service providers to run this site, each only for the purpose described: Cloudflare (DNS, CDN, DDoS/bot protection, and the Turnstile widget), Microsoft Azure (hosting), Resend (delivering form-notification emails), Google (reCAPTCHA, and Analytics only once you've consented), and Have I Been Pwned (for the Breach Check tool specifically, as described above). Our news and advisories archive is built from newsdata.io and CISA's public Known Exploited Vulnerabilities catalog, neither of those ever receives any information about you; we only fetch public content from them.

Several of these providers are based outside the country you're visiting from, including the United States, and may process data there as part of delivering their service. Where that happens, we rely on the safeguards each provider has in place for international transfers (standard contractual clauses or an equivalent mechanism); see that provider's own privacy documentation for the specifics of how they handle it, that part isn't something we control.

What we don't do

We don't have user accounts, logins, or payment processing on this site, there's nothing to register for and nothing to buy directly through it. We don't sell personal information, and we don't use any of the data described above for advertising or ad targeting.

Your rights

If you're in the EU, UK, or anywhere else with a similar right, you can ask us what information we hold about you, ask us to correct it, or ask us to delete it, email [email protected] and we'll act on it. You can also withdraw analytics consent at any time by clearing your browser's local storage for this site, which brings the cookie banner back on your next visit. If you're not satisfied with how we've handled a request, you also have the right to lodge a complaint with your local data protection authority.

Changes to this policy

If what this site actually does changes, a new tool that handles data differently, a new subprocessor, we'll update this page and the date at the top, rather than leaving it to describe practices we've since moved away from.