Privacy Policy

_Last updated: 8 September 2026_

This policy explains what personal data Pentest Market ("we") processes and why.

Data we collect

• Account data: email address, a hashed password, display name, and role

(buyer, researcher or company).

• Order data: the target hostname, the buyer's contact email, the selected

tier, status timestamps, and — at the moment escrow releases — a snapshot of the researcher's payout wallet address.

• Payment data: the on-chain transaction hash, network, asset and amount. We

do not collect or store card or bank details, because the Platform does not accept them.

• Content: bug bounty reports and reviews as submitted; forum posts, which

are public by design.

• Technical data: standard server logs (IP address, user agent, timestamps)

for security and abuse prevention.

Why we process it

• To operate accounts, orders, escrow and payouts (performance of a contract).
• To verify target ownership and confirm payments (legitimate interest and

contract).

• To prevent fraud, abuse and unauthorised testing (legitimate interest, legal

obligation).

• To communicate about your orders and account (contract).

Sharing

We share order-relevant data between the buyer and the researcher on that order. We use infrastructure providers (hosting, database, block-explorer / RPC endpoints) that process data on our behalf under contract. We do not sell personal data. We disclose data where legally required.

Retention

Account and order records are retained while your account is active and for a period afterwards as needed for tax, accounting and dispute-resolution purposes, then deleted or anonymised. Public forum content persists as part of the record.

Your rights

Depending on your jurisdiction you may have rights to access, correct, delete or export your personal data, and to object to certain processing. Contact us to exercise them; we may need to verify your identity first.

International transfers

Data may be processed in countries other than yours. Where required we use appropriate safeguards for such transfers.

Changes

We will post material changes to this policy on this page and update the date above.