Privacy policy

Who we are

AppSecNews (https://appsecnews.com) is run by AppSecNews ("we", "us"). We decide how the personal information described here is used, which makes us its controller under data protection laws such as the GDPR and the UK GDPR. You can reach us at our contact form.

What we collect and why

When you read the site

We count page views ourselves, without cookies. For each counted view we store the page, the site that referred you (the host name only) and a visitor code. The visitor code is a one way hash of your IP address and browser details mixed with a random value that changes every day and is deleted after two days, so we cannot turn it back into an address or link your visits across days. We never store your IP address for this. Raw page view records are deleted after 90 days; daily totals with no visitor level data are kept. If your browser sends a Do Not Track or Global Privacy Control signal, your visits are not counted at all.

Like every website, our hosting provider handles technical data such as your IP address to deliver pages, and keeps short term logs for security and troubleshooting.

Advertising and measurement

Public pages may show Google ads, and we measure which pages lead to a demo request with Google's tags. Where consent is required, nothing from Google loads until you choose "Accept all" in the banner; if you choose "Reject", Google's scripts are not loaded at all. If you accept, Google may set cookies and collect data about your device and browsing for ad delivery, personalisation and measurement under its own policies. The cookie policy explains how to change your choice.

When you contact us

The contact form asks for your name, email address, optionally your company, the topic and your message. We use them to read and answer your message. To fight spam and abuse we keep a keyed hash of your IP address, never the address itself.

When you subscribe to the newsletter

We store your email address and when you confirmed it. Sign up is double opt in: nothing is sent until you confirm by email. Every issue has a one click unsubscribe, and issues carry no tracking pixels.

When you request a demo or download a vendor document

A demo request asks for your name, work email, company, optionally your job title, your company size, your role, your buying timeline and an optional message. You send it so that the vendor of that tool can contact you, so we pass it to that vendor. Downloading a compliance document that a vendor has gated asks for your name and work email, which go to that vendor in the same way. We store these details encrypted. Identifying details of a demo request are overwritten after 24 months, or sooner if you ask. Once a vendor has your details, its own privacy policy also applies to what it does with them.

When you endorse a tool

Endorsements are signed in with LinkedIn, so that each one comes from a real professional. We receive basic profile details from LinkedIn when you sign in, and we store your job title, company and seniority at the time you sign, and your statement. Approved endorsements are shown publicly on the tool's page with those details. We keep a keyed hash of your IP address to spot abuse.

When you have a vendor account

Vendor accounts hold your name, work email address, company, your password (stored only as a one way hash), your two factor sign in secret, your team's roles, and a record of sign ins and important actions for security. You can sign in with Google instead of a password; we then receive your name and email address from Google. Paid packages are billed through Stripe on Stripe's own pages: we never receive or store card details. We keep invoices and billing records for as long as tax and accounting law requires.

Our API and MCP server

The public API and the MCP server are read only and need no account. Their logs record which tool was called and how it went, not your IP address or a session.

Legal bases

Where the GDPR or the UK GDPR applies, we rely on:

• Consent for Google advertising and measurement cookies and for the newsletter. You can withdraw consent at any time.
• Contract, or steps you ask us to take before one, for vendor accounts, billing, and passing your demo request or document request to the vendor you chose.
• Legitimate interests for cookieless statistics, keeping the site secure, preventing spam and abuse, answering messages and publishing endorsements you submit. We have weighed these against your interests and kept the data to the minimum.
• Legal obligation for invoices and billing records.

Who we share it with

We do not sell personal information. We share it only as follows:

• Vendors, only the demo requests and document requests you send to them.
• Service providers that process data for us under contract: Microsoft Azure (hosting and database), our email delivery provider, Stripe (payments), Cloudflare (a bot check on sign in forms), and Google and LinkedIn when you choose to sign in with them.
• Google for advertising and measurement, only if you accept them.
• Authorities when the law requires it, or to protect our rights and the safety of others.
• A successor if the site is sold or reorganised, under the same protections.

International transfers

Some of our providers process data outside your country, including in the United States. Where data leaves the UK or the European Economic Area, we rely on adequacy decisions or on safeguards such as the standard contractual clauses.

How long we keep it

Data	Kept for
Page view records	90 days, then only daily totals
Contact messages	As long as needed to deal with them; deleted on request
Newsletter subscription	Until you unsubscribe
Demo request details	24 months, then overwritten
Endorsements	While the endorsement is published, or until you ask us to remove it
Vendor accounts	While the account is open, then deleted unless the law requires us to keep records
Invoices and billing records	As long as tax and accounting law requires

Security

Pages are served only over HTTPS. Passwords are stored as one way hashes, staff and vendor administrators use two factor sign in, demo requests and download requests are encrypted at rest, and IP addresses used against abuse are stored as keyed hashes. No system is perfectly secure, but we design for the data we hold to be of as little use as possible to anyone who should not have it.

Your rights

Depending on where you live, you can ask to see the personal information we hold about you, correct it, delete it, restrict or object to how we use it, or receive a copy to take elsewhere. You can withdraw consent at any time without affecting what happened before. To use any of these rights, contact us at our contact form; we may need to confirm it is you, and we answer within the time the law sets. You also have the right to complain to your data protection authority, such as the Information Commissioner's Office in the UK or the authority where you live in the EU.

If you are a California resident: we do not sell your personal information, and we do not use it for anything other than the purposes above. You have the right to know, delete and correct it, and we will not treat you differently for using those rights.

Children

The site is written for professionals and is not directed at children. We do not knowingly collect personal information from anyone under 16.

Changes to this policy

When we change this policy we update the date at the top of the page. If a change materially affects how we use information you have already given us, we will tell you before it takes effect, by email where we have your address.