========================================================== VFT ENGINEERING - PRIVACY POLICY ========================================================== Last Updated: October 12, 2026 Effective Date: October 11, 2026 INTRODUCTION VFT Engineering ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information. 1. INFORMATION WE COLLECT 1.1 Information You Provide: • Name and email address (via contact form) • Service inquiry details • Email address (newsletter sign-up, only with your consent) • Security scanner: your email, the domain you scan, the scan result, your confirmation that you are authorized to scan it, and whether you opted in to security tips • Scanner account (optional): your email address, your plan and the scans linked to your account • Any information voluntarily submitted 1.2 Automatically Collected Information: • IP address and browser information • Pages visited and time spent • Device type and screen resolution • Referral source • Contact form, newsletter and scanner requests: a salted one-way hash of your IP address, used only for rate limiting and abuse prevention 1.3 Cookies and Tracking: • Browser storage for sign-in sessions (administrators and scanner account holders only; signed out after 30 minutes of inactivity) • Vercel Analytics and Umami (cookieless, anonymized usage data) • No third-party advertising cookies 2. HOW WE USE YOUR INFORMATION We use collected information to: • Respond to inquiries and service requests • Show you your security scan report and follow up about it • Improve website performance and user experience • Analyze usage patterns (aggregated, anonymized) • Maintain website security We do NOT: • Sell or rent your personal information • Share data with third parties for marketing • Track you across other websites 3. DATA STORAGE & SECURITY 3.1 Storage Location: • Contact form, newsletter and scanner data: Supabase (encrypted at rest and in transit, readable only by the site administrator) • Admin data: Supabase (encrypted at rest and in transit) • Analytics: Vercel (Edge Network, anonymized) 3.2 Security Measures: • HTTPS encryption (TLS 1.3) • Supabase Row-Level Security (RLS) • Multi-factor authentication required for administrator access • Content Security Policy (CSP) headers • Regular security audits 3.3 Data Retention: • Contact form submissions: 1 year • Security scan records: 1 year • Analytics data: 90 days (anonymized) • Admin session data: 7 days 4. THIRD-PARTY SERVICES This website uses the following third-party services: 4.1 Vercel (Hosting & Analytics): • Privacy Policy: https://vercel.com/legal/privacy-policy • Collects: Anonymized usage statistics • Location: Global Edge Network 4.2 Supabase (Backend & Authentication): • Privacy Policy: https://supabase.com/privacy • Collects: Authentication data, admin content • Location: Cloud infrastructure (encrypted) 4.3 Umami (Analytics): • Privacy Policy: https://umami.is/privacy • Collects: Cookieless, anonymized page views 4.4 Cloudflare DNS (Scanner domain verification): • Used to look up the public DNS TXT record you add to verify a domain for a full scan. No personal data is sent. 5. YOUR RIGHTS You have the right to: • Access your personal data • Request data correction or deletion • Opt-out of analytics tracking • Withdraw consent at any time To exercise these rights, contact: vft.venus@gmail.com 6. AUTHENTICATION 6.1 Admin Access: • Authorized access requires authentication • Sessions expire after inactivity for security • All administrative actions are logged 6.2 Data Security: • Content management is access-controlled • User contact form submissions are isolated • Authentication uses industry-standard JWT tokens 7. CHILDREN'S PRIVACY This website is not intended for individuals under 18 years of age. We do not knowingly collect data from children. 8. INTERNATIONAL DATA TRANSFERS Data may be processed in different countries. We ensure appropriate safeguards are in place for international data transfers. 9. DO NOT TRACK When your browser sends a Do Not Track (DNT) signal, Umami analytics does not record your visit. Vercel Analytics is cookieless and collects only anonymized, aggregated data. 10. CHANGES TO THIS POLICY We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. Continued use of the website after changes constitutes acceptance of the updated policy. 11. CONTACT INFORMATION For privacy-related questions or requests: Email: vft.venus@gmail.com Website: https://vft369.com For data deletion requests, please include: • Your name and email address • Specific data you want deleted • Approximate date of submission We will respond to requests within 30 days. 12. POPIA (South Africa) VFT369 processes personal information in line with the Protection of Personal Information Act, 2013. We collect only what each feature needs, use it only for the purpose stated when you provide it, and you may ask for access, correction or deletion at any time using the contact details above. 13. SECURITY SCANNER The scanner performs an automated, non-intrusive check of a website's public security configuration. It is not a penetration test. • Only scan sites you own or have written permission to test; you confirm this before every scan and that confirmation is recorded. • Quick scans read only what any browser can see. Full scans, which also check for publicly exposed sensitive files, are available only after you prove control of the domain. • We use your email to send or discuss your report and, only if you opt in, occasional security tips. You can unsubscribe at any time. • Scanner accounts are optional. You sign in with a one-time code sent to your email; there is no password. Your account lets you see your own recent scans and gives a higher scan allowance. Ask us via the contact page to delete your account and its scans at any time. 14. GDPR COMPLIANCE (EU Users) If you are in the European Union, you have additional rights under GDPR: • Right to data portability • Right to object to processing • Right to lodge a complaint with a supervisory authority Legal basis for processing: • Consent (contact forms) • Legitimate interests (analytics, security) 15. SECURITY BREACH NOTIFICATION In the unlikely event of a data breach affecting your personal information, we will notify you within 72 hours via email and provide details about the nature of the breach and steps being taken. ========================================================== © 2025-2026 VFT Engineering - All Rights Reserved Your privacy is important to us. We are committed to transparency and protecting your data. ==========================================================