Privacy Policy

We are ZERODAY REAPERS (SMC-PRIVATE) LIMITED, a company registered in Pakistan (SMC-Private Limited), operated by Ali Raza. You can reach us about any privacy matter at [email protected].

This policy governs the ZeroDay Reapers website and portal. Our services are offered to users internationally, except where prohibited by law — we do not offer the service to users located in Israel. This policy is governed by the laws of Pakistan, without prejudice to any mandatory data- protection rights you have under your local law (see Section 9).

We collect the following categories of personal data:

• ▸Account & profile — email address, name, display name, country and phone number, member ID, department, role, an optional avatar, and any LinkedIn/GitHub links you choose to add.
• ▸Program activity — task submissions and files you upload, grades and feedback, milestones, and in-portal messages and direct messages you send.
• ▸Security & sign-in data — IP address, approximate location, device/browser details, and sign-in times. We use this to send new-device / new-location sign-in alerts and to prevent abuse.
• ▸Communications — messages you send us and information you submit through our contact or inquiry forms.
• ▸Technical & cookies — see Section 5.

We use personal data to:

• ▸Provide and operate the website, portal, internships, and training;
• ▸Create and secure your account and authenticate sign-ins;
• ▸Grade submissions and issue completion certificates;
• ▸Send transactional emails and, where enabled, an optional weekly digest;
• ▸Protect the service — detecting, preventing, and investigating abuse or security incidents;
• ▸Measure and improve performance and reliability; and
• ▸Comply with legal obligations.

If you are in the European Economic Area or the United Kingdom, we process your data on these bases: performance of a contract (to provide the portal and internship), legitimate interests (security, abuse prevention, and improving the service), consent (for advertising cookies and any optional marketing), and legal obligation where the law requires it.

We use a small number of cookies and similar technologies:

• ▸Essential — required to keep you signed in and to run core features. These cannot be turned off.
• ▸Analytics — we use Vercel Web Analytics, which is cookieless and does not track you across sites. When enabled, we also use our self-hosted Umami service for cookieless aggregate traffic measurement.
• ▸Advertising — public pages may show ads via Google AdSense (publisher ID ca-pub-4661416076527631). Google and its partners may set cookies to serve and personalize ads and measure their performance. You can manage or opt out of personalized ads at Google Ad Center and optout.aboutads.info.

You can also block or delete cookies through your browser settings.

We do not sell your personal data. We share it only with the service providers (processors) that help us run ZeroDay Reapers, under agreements that require them to protect it:

Supabase

Database, authentication, and realtime — stores your account, submissions, and activity.

Cloudflare

CDN, WAF/DDoS protection, Turnstile (bot check), and R2 object storage for files you upload.

Resend

Transactional and (optional) digest email delivery.

Discord

Optional sign-in/community linking if you connect a Discord account.

Vercel

Website and application hosting, plus cookieless web analytics.

Umami (self-hosted)

Cookieless aggregate website analytics operated on our own infrastructure.

Google AdSense

Advertising on public pages (publisher ID ca-pub-4661416076527631); may set advertising cookies.

Sentry

Error and performance monitoring to keep the service reliable; may process technical/diagnostic data.

We may also disclose data where required by law, to enforce our terms, or to protect the rights and safety of our users and the public.

We operate internationally, and our providers process data in various countries. When we transfer personal data across borders, we rely on appropriate safeguards and the protections offered by these providers. By using the service, you understand your data may be processed outside your country of residence.

We keep your personal data while your account is active and for as long as needed to provide the service and meet legal, security, and accounting requirements. When an account is deleted, we remove your personal data, except a minimal set of records we must retain — for example, markers used to enforce bans and prevent abuse, and records relating to certificates already issued.

Subject to your local law, you have the right to:

• ▸Access & portability — signed-in users can download their data (profile, submissions, activity, feedback, and messages) at any time from the portal dashboard using "Download my data".
• ▸Deletion — request deletion of your account by emailing [email protected]. We process deletions manually to honour the retention rules in Section 8.
• ▸Correction, restriction, objection, and withdrawal of consent at any time.

EEA/UK residents may lodge a complaint with their local data-protection supervisory authority. California residents have the right to know, delete, and opt out of the "sale" or "sharing" of personal information (we do not sell your data), without discrimination for exercising these rights. To exercise any right, email [email protected].

We use HTTPS everywhere (with HSTS), encrypt data in transit and keep encrypted backups, enforce row-level security on the database, require two-factor authentication for administrators, and offer optional passkey (WebAuthn) sign-in. No system is perfectly secure, but we work continuously to protect your information and respond to incidents.

The service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy from time to time. When we do, we will revise the effective date above, and for material changes we will provide a more prominent notice. Your continued use of the service after an update means you accept the revised policy.

ZERODAY REAPERS (SMC-PRIVATE) LIMITED
Attn: Ali Raza
Email: [email protected]