This Privacy Policy explains what personal data expose.ac collects, why, how long we keep it and what rights you have. It applies to the expose.ac website, dashboard, Discord webhook integration and PC scanner. "expose.ac", "we" and "us" refer to the team that runs them.
1. Who is responsible
expose.ac is the controller of account, payment and website data. Contact: [email protected].
[Decide with your lawyer how responsibility for scan data is split between you and the server that requests a scan, for example whether you act as a controller, a joint controller or a processor, and describe it here.]
2. Data we collect
Account data: username, email address, your plan and license status, and your messages to support.
Scan data, collected only when a player runs the scanner with a PIN:
- basic system information, such as the Windows version;
- hashed hardware identifiers, used to recognise the same computer across scans;
- names, paths, hashes and timestamps of files and programs that are relevant to cheat detection, including deleted or renamed files;
- records of connected storage devices and relevant Windows logs;
- if the player links Discord, the IDs and names of the Discord servers they are a member of, compared against servers known for cheats;
- the PIN, the requesting server and the result of the scan.
The scanner does not collect the contents of personal documents, photos, browser history, passwords or messages.
Technical data: IP address, browser type and server logs when you use the website or dashboard.
3. Why we use it and our legal basis
- To provide the Service, create PINs, run scans and show reports (performance of a contract).
- To detect cheating and keep game servers fair, and to protect the Service from abuse and attacks (legitimate interests).
- To process payments and keep invoices (legal obligation).
- To answer support requests (performance of a contract or legitimate interests).
- To use optional analytics cookies (consent, which you can withdraw at any time).
5. International transfers
We store data in the European Union where possible. If a provider processes data outside the EU or EEA, we rely on safeguards such as the European Commission's standard contractual clauses or an adequacy decision.
6. How long we keep data
- Scan data: [X] days after the scan, then it is deleted or anonymised. If a ban based on a scan is being appealed, we may keep that report until the appeal is closed.
- Account data: for as long as your account is open, and deleted within [X] days after you close it.
- Invoices and payment records: for as long as tax law requires.
- Server logs: up to [X] days.
7. Security
We protect data with encryption in transit, access controls, hashing of hardware identifiers and regular reviews of who can access what. If a breach puts your rights at risk, we will notify the data protection authority within 72 hours and inform you without undue delay where the law requires it.
8. Your rights
Under the GDPR you can ask to:
- access the personal data we hold about you;
- correct data that is wrong;
- delete your data;
- restrict or object to how we use it;
- receive your data in a portable format;
- withdraw consent you have given.
Write to [email protected]. We answer within one month. If a request is about a scan, we may involve the server that requested it. You can also complain to the Romanian data protection authority (ANSPDCP, www.dataprotection.ro) or the authority in your country.
9. Children
The Service is not meant for anyone under 16. If you believe a child under 16 has given us personal data without consent from a parent, contact us and we will delete it.
11. Changes to this policy
We will update this policy when our practices change and show the date of the latest version at the top. If a change is significant, we will tell you in advance.
12. Contact
Privacy questions and data requests: [email protected]. General questions: [email protected].