Website Privacy Notice
In short
pwn-all.com sets no cookies and uses no analytics, advertising or tracking. Our web application keeps no access logs. Your IP address and browser headers are used to deliver the page you request and, in the narrow cases described in section 4, to protect our systems.
Our free tools run in your browser. Files and text you process are never uploaded to us. A few tools contact third-party services directly from your browser, and only when you use them (section 5.3).
If you contact us, we use your details only to reply. We delete the conversation within 30 days of the last message, unless an engagement follows, we need it for a legal claim, or it is a privacy request (section 9). We do not sell personal data or share it for advertising; we share it only with the providers listed in section 7.
You can access, correct or delete your data and object to how we use it (section 10). Questions: our data protection officer, dpo@pwn-all.com.
1. Who we are
PWN-ALL Auditing, Reviewing & Testing Cyber Risks CO. L.L.C ("PWN-ALL", "we", "us"), licensed in Dubai, United Arab Emirates (DET licence 1324553), 145, Al Mustaqbal street, Iris Bay Tower 2101-11, Business Bay, Dubai, UAE, is the controller responsible for the processing described in this Notice. Full registration details are on our Company details page.
Data protection officer: Eugen Stelmakh, dpo@pwn-all.com. You can contact our data protection officer about any question on this Notice or on how we handle your personal data. For other legal matters: legal@pwn-all.com.
Our processing is governed by the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, "PDPL"). Where the EU General Data Protection Regulation ("GDPR"), the UK GDPR or the Swiss Federal Act on Data Protection applies to our processing, you also have the rights those laws give you (section 10).
2. Scope
This Notice covers the website at https://pwn-all.com, including its language versions, blog, product pages, free browser tools and read-only public API endpoints, and enquiries you send us through the contact options listed on it. www.pwn-all.com redirects to pwn-all.com.
It does not cover:
- Subdomains of pwn-all.com. Each is a separate service with its own privacy notice.
- Our mobile apps. Their privacy policies are published at pwn-all.com/app/<app>/privacy/ and govern the apps. This Notice covers only your visit to those pages.
- Contracted engagements. Data we process while performing an engagement is governed by the signed agreement (Statement of Work) and its data-handling terms. Section 6.5 explains how we handle the business contact details of client representatives.
3. What we process, why, and on what legal basis
| Activity | Personal data | Purpose | Legal basis: GDPR / UK GDPR (where applicable) | Legal basis: UAE PDPL | How long |
|---|---|---|---|---|---|
| Delivering the website, tools and public API | IP address, requested URL, request headers (such as browser type, language and accepted formats) | To send you the page or file you request | Legitimate interests (Art. 6(1)(f)): providing the website you visit | Art. 4(9): providing the website you request under our Terms of Use | Only while the request is handled; not stored |
| Network protection by our hosting provider | IP address, ports, traffic metadata | To detect and mitigate denial-of-service attacks | Legitimate interests: keeping the website available | Art. 4(3): defending our rights against attacks | Kept by Hostinger only to detect and mitigate attacks. Hostinger has not published a fixed period, and we do not receive these records |
| Server security logs | IP address, port, attempted username, time and result of attempts to log in to server administration (SSH); addresses temporarily blocked after repeated failures | To protect our server against unauthorised access | Legitimate interests: security of our systems | Art. 4(3): defending our rights against unauthorised access and related legal claims | Up to 14 days on the server; backup copies are overwritten within about 14 further days |
| Admin-login lockout | A keyed hash of the IP address (for IPv6, of its /64 network) of anyone who enters a wrong password on our password-protected publishing interface | To stop password guessing | Legitimate interests: security of our systems | Art. 4(9) (our Terms of Use prohibit unauthorised access); Art. 4(3) | Server memory only: 15 minutes to count failed attempts, or up to 48 hours if the address is blocked |
| Enquiries (email, call booking, messengers, phone, video calls) | Name, contact details, company and role, message content and attachments, booking or call details | To reply, answer your questions and scope potential work | Enquiries from individuals about our services: steps taken at your request before a contract (Art. 6(1)(b)). Other enquiries, and enquiries from business contacts: legitimate interests in responding (Art. 6(1)(f)) | Art. 4(9): steps you ask us to take about our services or possible work. For other enquiries: your consent, given when you write to us asking for a reply (Arts. 4 and 6). If you withdraw it, we stop replying and delete your messages | Deleted within 30 days of the last exchange (section 6.6) |
| Call or meeting recordings (only if you agree) | Your voice, your image on video calls, and what is said | To keep an accurate record of what was discussed | Consent (Art. 6(1)(a)), which you can withdraw at any time | Consent (Arts. 4 and 6) | Up to 12 months after the call or meeting |
| Information about other people in an enquiry | Whatever you include (for example names of colleagues or IP addresses involved in an incident) | To understand and answer your enquiry | Legitimate interests: responding to your enquiry | Art. 4(3) where the enquiry concerns an incident or a claim; Art. 4(7) where it protects that person's interests | Deleted together with the enquiry |
| Tool features that contact third-party services (section 5.3) | IP address, request headers and the data listed in section 5.3 | To provide the feature you use | Legitimate interests: providing the tool features you choose to use | Art. 4(9) | Not stored by us |
| Client representatives after an engagement starts | Business contact details and correspondence | To manage the engagement | Legitimate interests: managing our business relationship | Art. 4(10) for records UAE law requires; otherwise your consent, given by working with us on the engagement (Arts. 4 and 6) | For the engagement, then 5 years (correspondence) or 7 years after the tax period (contracts, invoices) |
| Published client reference letters | Name and position of the person who signed the letter (signatures are blurred) | To show references from our clients | Consent of the signatory (Art. 6(1)(a)), which can be withdrawn at any time | Consent (Arts. 4 and 6) | Until consent is withdrawn |
| Privacy requests and complaints | Your request, contact details and our reply (identity documents are deleted once we have verified you) | To handle your request and show that we did | Handling your request: legal obligation (Art. 6(1)(c)). Keeping a record of it: legitimate interests in demonstrating compliance and defending claims (Art. 6(1)(f)) | PDPL Arts. 13–19 (handling your request); Art. 4(3) (defending a complaint) | 12 months after the request is closed |
| Legal claims | Only records relevant to a specific dispute | To establish, exercise or defend legal claims | Legitimate interests | Art. 4(3) | Until the matter is resolved |
Our legitimate interests are: providing the website and tools you choose to use; keeping our systems available and secure; responding to enquiries and managing business relationships; and establishing, exercising or defending legal claims. You can object to processing based on legitimate interests (section 10.2).
Do you have to provide data? No. Browsing only involves the technical data your browser sends. If you contact us without contact details or enough information, we may not be able to reply.
Data that tools save in your browser stays on your device and is not sent to us (section 5.2).
4. Browsing the website
- No cookies, no tracking. This website sets no cookies. It uses no analytics, advertising, social-media plugins, tracking pixels or device fingerprinting, and loads no third-party scripts, fonts or other resources when you open a page.
- Hosting. The website runs on a virtual server rented from Hostinger International Ltd (Cyprus) in a data centre in Frankfurt, Germany. We operate our own web application on it, with no content-delivery network or proxy in front. Hostinger is our processor under a data processing agreement. As part of its service it applies network-level protection against denial-of-service attacks, which may analyse traffic metadata such as IP addresses and ports.
- Request data. To deliver a page, our web application processes your IP address and request headers. It keeps no access logs and does not store this data. As with any website, the full page address you open (including anything after "?") is part of the request.
- Security records. There are two narrow exceptions, and ordinary visitors trigger neither. (1) The server's operating system logs attempts to log in to server administration (SSH) and automatically blocks, for a short time, addresses that keep failing. (2) If someone enters a wrong password on our publishing interface, a keyed hash of their IP address (for IPv6, of its /64 network) is held in server memory for 15 minutes to count failed attempts, or for up to 48 hours if the address is blocked. It is not written to logs or files.
- Public API endpoints (such as /api/status, /api/agent/*, /openapi.json and /.well-known/*) return fixed public information. They need no account and store nothing about the caller.
- Links to other sites. When you follow a link to another website (for example our profiles on LinkedIn, YouTube or GitHub, or a subdomain), that site's privacy notice applies. We send other sites at most our domain name as the referrer. Some tools offer links that carry data in the address, such as a block-explorer link with a public wallet address or a VirusTotal link with a file hash; that data reaches the linked site only if you click the link.
5. Free tools
5.1 Local processing
Our free tools run in your browser. Files and text you open or enter in them (for example in the archive viewer, email viewer, image, PDF and hash tools) are processed on your device and are never uploaded to our servers. The question box on our homepage also works entirely in your browser.
5.2 Data saved in your browser
Some tools keep data in your browser so it is there when you need it. It is not sent to us.
| Tool | What is kept | When | Where and for how long |
|---|---|---|---|
| OTP Generator | Accounts you add, including their secret keys (not encrypted) | When you click Save or import a backup (and updated when you use Next or Delete) | Browser local storage, until you delete them in the tool or clear this site's data |
| Invoice Generator | Your own company, contact and bank details and logo | Only when you click Save company | Browser local storage, until you click Clear or clear this site's data |
| NDA Generator, Privacy Policy Generator | Your form entries | Once you start typing (nothing is stored when you only open the page) | Browser session storage, cleared when the tab's session ends (normally when you close the tab) |
| Manforge | Which tools' authorised-use notice you accepted | When you accept a notice | Browser session storage, cleared when the tab's session ends |
| Publishing interface (/blog/editor, for our staff) | Article drafts and a text-size setting; after staff sign-in, the session password | When the page is opened (drafts and setting) and at sign-in (password) | Drafts and setting: browser local storage, until cleared. Password: browser session storage, cleared when the tab's session ends |
Browser storage is not encrypted and is shared by all pages of pwn-all.com. Don't save secrets on shared or untrusted devices, and export an encrypted backup of your OTP accounts before clearing site data. This website sets no cookies and uses no other browser storage. We store data on your device only for functions you actively use.
5.3 Tools that contact third-party services
The tools below send requests directly from your browser to a third-party service, and only when you use the feature. We decide which service your browser contacts and are responsible for that request (for the Subdomain Checker and Email Signature Generator, you choose the hosts). Each service receives your IP address, standard request headers and the data listed, and processes them as an independent controller under its own privacy policy. Nothing is routed through our servers.
| Tool | Service | What it receives | When |
|---|---|---|---|
| BTC Tracer | mempool.space (privacy policy) | Transaction IDs and addresses you trace | When you run a trace |
| Subdomain Checker | The hosts you enter, and any hosts they redirect to | A connection request to each host | When you start a check |
| Email Signature Generator | The host of any remote image in your signature | A request for that image | When you add an image address, or paste or import signature HTML that contains one |
6. Contacting us
6.1 Channels
| Channel | Provided by | Role |
|---|---|---|
| Email: hello@, dpo@, legal@ and clients@ (security reports) pwn-all.com | Proton AG, Switzerland (privacy policy) | Our processor |
| "Book a call" booking page (you enter your name, email, chosen time and an optional message) | Proton AG, Switzerland | Our processor |
| Phone +971 58 594 6337 | Mobile network operators | Independent providers. Our phone keeps a call log for 30 days |
| Signal, Telegram, WhatsApp (same number) | Signal, Telegram, WhatsApp (Meta) | Independent providers, under their own privacy policies (Signal, Telegram, WhatsApp) |
| Video calls | Proton or Signal by default, or another service you choose (for example WhatsApp) | Proton: our processor. Signal, WhatsApp and any other service you choose: independent providers; the call then runs under that provider's terms and privacy policy, outside our control |
Email from a Proton Mail address, or email you encrypt with our PGP key (hello@pwn-all.com), is end-to-end encrypted. Other email is encrypted in transit but not end-to-end. Signal is end-to-end encrypted. Telegram chats are not end-to-end encrypted by default.
We do not record calls or meetings by default. If a recording would be useful, we ask first and record only with the participants' agreement. The recording is stored only on our own devices, is never transcribed or processed by AI tools, and is deleted within 12 months of the call or meeting. You can withdraw your agreement at any time, and we will then delete the recording.
6.2 How we use your enquiry
We use your details and message only to reply, answer your questions and scope potential work. We do not use them for marketing or newsletters, we do not put them into a CRM or mailing list, and we do not share them with AI services or use them to train AI models. Only our own staff read enquiries.
6.3 Sensitive material
Please do not send passwords, credentials, confidential evidence, incident data or special-category data (such as health or biometric data) in a first message, and never over Telegram or WhatsApp. For sensitive matters use PGP-encrypted email or Signal. A contracted engagement defines its own secure transfer channel.
6.4 Information about other people
If your enquiry includes information about other people (for example colleagues, customers or IP addresses involved in an incident), we use it only to understand and answer your enquiry, and we delete it together with the enquiry. Please include only what we need.
6.5 If an engagement follows
Engagement data is governed by the signed agreement. We keep the business contact details of the client's representatives and our correspondence for the duration of the engagement and afterwards for the periods UAE law requires: business correspondence for 5 years from when it was sent or received (Commercial Transactions Law), and contracts, invoices and other tax records for 7 years after the end of the tax period they relate to (Corporate Tax Law).
6.6 Retention
Our messenger chats use disappearing messages set to 4 weeks by default, so each message is deleted 4 weeks after it is sent. If a chat's timer is turned off or changed, we delete the history ourselves within 30 days of the last exchange. Enquiry emails are deleted within 30 days of the last exchange, bookings within 30 days of the meeting, call-log entries within 30 days of the call, and any agreed recordings within 12 months. Encrypted backup copies kept by our email and calendar provider (Proton) expire within a further 30 days.
There are three exceptions: an engagement follows (section 6.5); we need specific records to establish, exercise or defend a legal claim; or your message is a privacy request or complaint, which we record as described in section 3. Messaging and telephone providers keep their own records under their own policies.
7. Who receives personal data
- Hostinger International Ltd (61 Lordou Vironos Street, Larnaca 6023, Cyprus): server hosting in Frankfurt, Germany, as our processor.
- Proton AG (Switzerland): email, calendar and video calls, as our processor. Data is stored in Switzerland and other European data centres.
- Signal, Telegram, WhatsApp (Meta), telephone operators and any video service you choose: only if you contact us that way, as independent providers.
- The services listed in section 5.3: only when you use those features.
- Professional advisers, courts and authorities: only where the law requires it or it is needed for a legal claim.
Recipients inside the UAE are our mobile operator and, where required, UAE advisers, courts and authorities. All other recipients listed above are outside the UAE. We do not sell personal data, share it for advertising or pass it to data brokers.
8. International processing
Our server is located in Frankfurt, Germany (EU). Our email, calendar and video-call provider, Proton AG, is in Switzerland, which the European Commission and the UK recognise as providing an adequate level of data protection. Our team is based in the United Arab Emirates and accesses these services through our company VPN, so personal data held in Germany and Switzerland is made available to us in the UAE. The UAE is not covered by an adequacy decision of the European Commission, the UK or Switzerland. Access is limited to our authorised staff and protected by the measures in section 12. Messaging services (section 6.1) and the third-party tool services (section 5.3) may process data in other countries under their own policies.
Under the UAE PDPL, keeping data on our server in Germany and with Proton in Switzerland and other European countries is cross-border processing. These countries have comprehensive data protection laws enforced by independent regulators. Our providers process the data only on our instructions, under data processing agreements that require them to keep it secure, and we use them only to provide the website and to reply to you (PDPL Articles 22 and 23). The UAE authorities have not yet published a list of approved countries.
9. How long we keep data
| Data | Retention |
|---|---|
| Request data (IP address, headers) | Not stored |
| Server security logs (SSH) | Up to 14 days on the server; backup copies overwritten within about 14 further days |
| Admin-login lockout | Server memory only: 15 minutes, or up to 48 hours if blocked |
| Messenger chats | Disappearing messages, 4 weeks by default; otherwise within 30 days of the last exchange (section 6.6) |
| Enquiry emails and bookings | Within 30 days of the last exchange (bookings: of the meeting); provider backup copies expire within about 30 further days |
| Call-log entries | Within 30 days of the call |
| Agreed call and meeting recordings | Up to 12 months after the call or meeting |
| Client representatives' business contact details and correspondence | Engagement duration, then 5 years (correspondence) or 7 years after the tax period (contracts, invoices) |
| Published reference letters | Until the signatory withdraws consent |
| Privacy requests and complaints | 12 months after closure |
| Records needed for a legal claim | Until the matter is resolved |
| Data saved in your browser | On your device, until you delete it (session storage: until the tab's session ends) |
10. Your rights
10.1 What you can ask for
Depending on the law that applies to you (PDPL; GDPR or UK GDPR; Swiss FADP), you can ask us to: give you access to your personal data and information about how we use it; correct it; delete it; restrict its use; give you data you provided (such as your enquiry correspondence) in a portable format; and stop processing it. You can also object to decisions made by automated processing and ask for a person to review them. Where we rely on consent, you can withdraw it at any time.
10.3 How to make a request
Email our data protection officer at dpo@pwn-all.com or write to our address in section 1. For sensitive requests use PGP-encrypted email to hello@pwn-all.com or Signal. To confirm it is you, we will normally ask you to write from the email address or messenger account you used with us. We ask for identity documents only if we cannot otherwise be reasonably sure, and delete them once you are verified.
We respond without undue delay and within one month (for access requests under Swiss law, within 30 days). If a request is complex or we receive many, we may extend this by up to two further months and will tell you why, and by when, within that first period. Requests are free. Because we keep very little data, the answer will often be that we hold no personal data about you; we will tell you so.
10.4 Complaints
You can complain to us first at dpo@pwn-all.com or by post to the address in section 1. We acknowledge complaints within 30 days, look into them and tell you the outcome without undue delay.
You can also complain to a supervisory authority: in the UAE, the authority responsible for the PDPL: the Federal Authority for Artificial Intelligence and Data, which the UAE established in June 2026 and which brings together the functions of the former UAE Data Office; in the EU/EEA, the authority in the country where you live or work or where the issue occurred (list of authorities); in the UK, the Information Commission (ICO); in Switzerland, you can report a violation to the Federal Data Protection and Information Commissioner (FDPIC).
11. Automated decisions
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. During denial-of-service attacks, our hosting provider automatically filters traffic, which can briefly block traffic from the addresses involved. Our own automated measures are the temporary blocks described in section 4, which affect only server administration and our publishing interface. You can object to any of these automated blocks and ask for a person to review it: contact dpo@pwn-all.com.
12. Security
- HTTPS only, with HTTP redirected to HTTPS. HSTS is enabled and pwn-all.com is on browsers' HSTS preload list.
- A restrictive Content Security Policy and no third-party scripts.
- No database of visitor data. We keep only the records described in this Notice.
- SSH access to the server uses keys only, with automatic blocking of repeated failed logins. Our hosting control panel account is protected by two-factor authentication. Access to the server and mailboxes is limited to authorised staff.
- Our email provider stores mailboxes encrypted at rest, and the backups we make ourselves are encrypted. The website itself stores no personal data of visitors; the only personal data on the server are the short-lived security logs described in section 4.
If a personal data breach is likely to affect you, we will notify the competent authority and you where applicable law requires it (for example, where the GDPR applies, the authority within 72 hours of becoming aware of the breach).
13. Children
The website is intended for professionals and is not directed to anyone under 18. We do not knowingly collect personal data from children, including children under 13 in the United States. If you believe a child has sent us personal data, contact us and we will delete it.
14. United States
We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of the sale or sharing of your personal information, which we do not do for anyone. We do not track visitors over time or across other websites, and no third party collects information through our pages about your activity over time or across websites; a browser Do Not Track signal therefore requires no change in how this website works. If a US state privacy law gives you rights, contact dpo@pwn-all.com. We will not treat you differently for exercising them.
15. Changes to this Notice
We post updates on this page with a new effective date. Before a change that adds a new purpose or new recipients takes effect, we announce it on this page, and if we are in contact with you about an open enquiry, we tell you directly.
16. Language
The website is available in several languages for convenience. This Notice is published in English. The English version governs and applies to all language versions of the website.