Privacy Policy
Last updated: October 2, 2026
This notice covers the personal information that reaches PentestProviders USA through this website: what it is, what we do with it and how you can control it. The PentestProviders brand and this site belong to BugFoe Private Limited, an Indian private limited company ("we", "us"). Send any privacy question to sales@bugfoe.com.
1. The company responsible
BugFoe Private Limited is accountable for the personal information collected here. India's DPDP Act, 2023 calls that role a Data Fiduciary; US state laws and European rules use terms such as business or controller for the same position.
2. What we collect
- Details you give us: name, business email, employer, job title, the applications or networks you'd like tested, any compliance or insurance date you mention, and whatever you write in a form or an email to us.
- Request data from your browser: IP address, browser and device details, the page that referred you, the pages you open and when. This keeps the site working and helps us stop bots and misuse.
- Cookies: each one is described in our Cookie Policy.
Keep credentials, API keys, vulnerability details and third parties' personal data out of our forms. When scoping needs sensitive technical material, we'll set up a protected way to exchange it.
3. How we use it
| Purpose | Why we're allowed to |
|---|---|
| Replying to you, scoping a test and writing a proposal | You asked us to; pre-contract steps |
| Delivering a signed engagement | The contract with your organization |
| Protecting the website from spam, fraud and attacks | Our legitimate interest in a safe site |
| Measuring readership in aggregate, if we turn analytics on | Consent in places that demand it; legitimate interest elsewhere |
| Displaying adverts on guide pages, if we turn ads on | Consent in places that demand it |
| Bookkeeping, tax and other legal duties | Legal obligation |
4. Google advertising
Guide pages may display adverts delivered by Google AdSense. Service pages, pricing, the quote form and the contact page stay ad-free.
- Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites.
- Google's use of advertising cookies enables it and its partners to serve ads to our users based on their visit to this site and/or other sites on the Internet.
- To turn off personalized ads from Google, open Google Ads Settings. For many other ad vendors, the industry opt-out page at www.aboutads.info does the same job.
- Google describes its own handling of this data in its explanation of data use on partner sites and apps.
Visitors from places where prior consent is mandatory, including the European Economic Area, the UK and Switzerland, first see a Google-certified consent banner, and can reopen it later from the privacy settings link on any page carrying ads.
5. Site analytics
If turned on, Google Analytics 4 tells us in aggregate which pages people read and how they found us. With Google Consent Mode, no analytics cookie is stored for visitors who must opt in until they do. Analytics reports are never used to single out a person.
6. Recipients
Nobody pays us for your personal information. We pass it only to:
- Hostinger, which hosts the site, and the mail services that deliver our email, each working under our instructions;
- Google, for the ad and analytics features above, whenever those are live;
- lawyers, accountants and tax advisers who work for us, and government bodies where a law compels disclosure.
7. US state privacy rights
Residents of California (under the CCPA, as amended by the CPRA) and of a growing number of other states hold rights over their personal information. Depending on your state, you can ask what we hold, receive a copy, have errors corrected or have the data erased. You can also tell us not to use your data for cross-context behavioral advertising. On this site, the only activity that might fall into that category is Google ad cookies on guide pages, which you can switch off with Google Ads Settings or by blocking third-party cookies in your browser. Exercising a right never changes how we treat you.
Email sales@bugfoe.com and put "Privacy request" in the subject line. Before acting we may ask you to verify that the request is yours. We answer within the period your state sets, and never later than 45 days. Someone you authorize in writing can make the request for you.
8. Visitors outside the US
People contacting us from the European Union, the United Kingdom or India have similar rights under the GDPR, the UK GDPR or the DPDP Act, among them withdrawing consent and complaining to their national regulator or to India's Data Protection Board. The email address above handles those requests too.
9. International processing
Our team is based in India. Anything you send us from the United States therefore travels to India for handling, and may also be stored in the countries where our hosting and email suppliers operate. The safeguards described here go with it.
10. Retention
If an inquiry does not lead to work, we delete it within two years of our final exchange. Engagement records are kept for the period set in your contract. Web server and security logs are deleted after a year at most.
11. Protecting your information
Every page is delivered over HTTPS. Submissions are screened for spam, stored under access restrictions and opened only by staff responding to them.
12. Children
We built this site for business buyers. It is not directed at children, and we do not knowingly gather information from anyone younger than 18.
13. Changes to this notice
Each revision updates the "Last updated" line above. If a change is significant, we will point it out on this page for a reasonable time.