Privacy
Last updated 4 November 2026. In short: we keep your e-mail address only to tell you when VulnTicket launches, we count visits without storing IP addresses or using cookies for analytics, and we delete everything on request.
Who we are
VulnTicket is operated by Jan Lilák, Alešova 339/7, 370 01 České Budějovice (IČO 88707652), the controller of your personal data.
Privacy questions and requests: [email protected].
Your e-mail address
When you join the launch list we store your e-mail address, when you signed up, when you confirmed it, and
the UTM tags of the link that brought you here (for example utm_source=linkedin), so we know
which channels work.
Why: to e-mail you when VulnTicket launches. The legal basis is your consent (GDPR Art. 6(1)(a)), which you give by confirming your address. You can withdraw it at any time.
How long: until 12 months after launch, or until you unsubscribe, whichever comes first. Addresses that are never confirmed are deleted after 30 days. Unsubscribing deletes the address immediately; we don’t keep a copy.
Visit statistics
We count visits ourselves, without third-party tools. For each page view, click on the price or signup buttons, or when you copy a ticket from an advisory, we record the page, the website you came from (its domain only), UTM tags, and whether you use a phone, tablet or computer.
We never store your IP address and we use no cookies for analytics. To count unique visitors, we combine your IP address and browser identifier with a random key that changes every day, and keep only the resulting one-way hash. The key is thrown away at the end of each day, after which the hash can’t be linked back to you, not even by us.
Why: to learn whether people want VulnTicket, based on our legitimate interest (GDPR Art. 6(1)(f)). How long: 12 months.
Cookies
The site sets one session cookie and one security cookie (XSRF-TOKEN) that protect the signup
form from forged submissions. They are strictly necessary, contain no tracking data, and expire after two
hours of inactivity. There are no advertising or analytics cookies.
Who else processes your data
These providers process data on our behalf and only on our instructions. We don’t sell or share your data with anyone else.
Hetzner Online GmbH (Germany) hosts this site on a server in Falkenstein, including the database with your e-mail address. The web server keeps access logs, including IP addresses, to keep the service secure; they are deleted after 14 days.
Cloudflare, Inc. (USA) is the network every request to this site passes through, including your IP address. It also forwards e-mail sent to our @vulnticket.com addresses. Cloudflare may process data outside the EU, under the EU-US Data Privacy Framework.
Scaleway SAS (France, Paris region) delivers the e-mails we send you, so it processes your e-mail address and the content of those messages.
Your rights
You can ask for a copy of your data, its correction or deletion, restrict or object to its processing, and receive it in a portable format. You can withdraw consent at any time, most easily with the “Remove me from the list” link in every e-mail. You also have the right to complain to a data protection supervisory authority, for example the one where you live.