Privacy notice

Last updated: July 2026

This notice explains how d4vinder Ltd (trading as d4) collects, uses and looks after your personal data when you visit d4vinder.com, contact us, or use our free tools. We build privacy in by default: no advertising trackers, no analytics cookies, and no selling of data, ever.

Who we are

d4vinder Ltd is the data controller. We are a company registered in England and Wales (company number 17149864), with our registered office at 352 Bearwood Road, Birmingham, B66 4ET.

For anything about your personal data, contact privacy@d4vinder.com.

The short version

• We only hold personal data you actively give us: a message through our feedback form, or your email address if you subscribe to the Decrypted newsletter or ask for product announcements.
• The newsletter is double opt-in: nothing is sent until you confirm from your own inbox, and every issue has an unsubscribe link.
• Our public tools (the CIDR calculator, DNS lookup, email-security and CVE tools) run in your browser or make lookups on your behalf; we do not keep a record of what you look up.
• We set no tracking cookies. The only cookie is a strictly-necessary session cookie in our admin area, which you never see.
• You can ask us to show, correct or delete your data at any time.

What we collect, why, and our lawful basis

What	Why	Lawful basis
Website feedback & support Name, email address, message content, page URL, browser user-agent, hashed IP address.	Receive and respond to feedback and support messages from visitors.	Legitimate interests
Product announcement emails (broadcasts) Email address, subscription status.	Send occasional product announcements to people who asked to receive them.	Consent
Administrator account Username, password hash, TOTP secret, login timestamps, hashed IP of attempts.	Authenticate the site operator and secure the admin area.	Legitimate interests
Privacy-preserving analytics Aggregate page counts and salted-hash unique counts. No cookies, no raw IPs, no profiles.	Understand aggregate traffic without tracking individuals.	Legitimate interests
Security & audit logging Admin username, action, affected record, hashed IP, timestamp.	Keep a record of administrative actions and security events.	Legal obligation
Decrypted newsletter Email address, subscription status, sign-up and confirmation timestamps, hashed IP at sign-up and confirmation.	Email each new Decrypted post to people who subscribed and confirmed (double opt-in).	Consent
CVE alerts Email address, subscription status, sign-up and confirmation timestamps, hashed IP at sign-up and confirmation.	Email people who subscribed and confirmed (double opt-in) a short digest whenever new vulnerabilities are added to CISA's Known Exploited Vulnerabilities catalogue.	Consent

Where we rely on legitimate interests, we have weighed those against your rights; you can object at any time (see below). Where we rely on consent (the Decrypted newsletter and announcement emails), you can withdraw it at any time.

The Decrypted newsletter

If you subscribe to Decrypted, our news commentary email, this is exactly what happens:

• Double opt-in. Entering an address only triggers a confirmation email. Nobody is subscribed, and nothing else is ever sent, until the link in that email is used. Unconfirmed sign-ups are deleted automatically after 7 days.
• What we store. Your email address, the subscription status, and the consent evidence: when you signed up, when you confirmed, and a one-way salted hash of the IP addresses used (never the raw IP).
• What we send. One email per newly published Decrypted post, usually a few times a week. No tracking pixels and no per-recipient link tracking; we count how many messages were sent, not who opened them.
• Leaving. Every issue has an unsubscribe link (including one-click unsubscribe in supporting mail apps), and there is a form at /decrypted/unsubscribe/. Withdrawing consent is immediate; the record itself is deleted within 90 days.

Decrypted is the personal opinion of its author. It is general commentary, not professional or security advice.

What we deliberately do not do

• No advertising or cross-site tracking, no analytics cookies, no fingerprinting.
• We never store your raw IP address. Where an IP is needed for rate-limiting or abuse prevention it is stored only as a one-way salted hash.
• We do not sell, rent or share your data for marketing.
• We do not use automated decision-making or profiling that has legal effects on you.

Who we share it with

We keep the number of processors small and UK/EU-based where we can:

• IONOS: our web and email hosting provider (UK/EU data centres).
• Postmark: sends our transactional emails, the Decrypted newsletter and announcement emails, and keeps a suppression list so unsubscribed addresses stay unsubscribed.
• Cloudflare: protects some of our sites and provides the anti-bot check on our sign-in and the newsletter sign-up form.

Each acts only on our instructions under a data processing agreement. We do not transfer your personal data outside the UK or EEA.

How long we keep it

We keep personal data only as long as we need it, and our systems enforce this automatically:

• Feedback and support messages: anonymised 24 months after the matter is closed.
• Newsletter subscriptions: until you unsubscribe. Unconfirmed sign-ups are deleted after 7 days, and unsubscribed records after 90 days.
• Announcement email list: until you unsubscribe.
• Security and audit logs: 24 months.

Your rights

Under UK data protection law you can ask us to: give you a copy of your data (access); correct it (rectification); delete it (erasure); give you a portable copy; restrict how we use it; or object to our use of it. You will not be charged, and we will respond within one calendar month.

Make a data request

Complaints

We hope to resolve any concern directly, so please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator, at ico.org.uk or on 0303 123 1113.

Cookies

We use one strictly-necessary cookie, only in our admin area, to keep the operator signed in. There are no other cookies and nothing that needs a consent banner. See our cookie statement for detail.

Changes

If we change this notice we will update the date above and, for significant changes, tell subscribers by email.