What this site collects, and why.

The short version

• There are no accounts, no newsletter and no analytics apart from one optional marketing tracker, the Meta Pixel: no Google Analytics, no session recording and no heatmaps.
• The Meta Pixel loads only after you choose Allow in the cookie banner. Choose Decline and it never loads.
• Messages sent through the contact form are emailed to us through Resend and arrive in our inbox at admin@hack-tech.org.
• We do not sell personal data or use it to make automated decisions about you, and we use what you send only to reply to you and to scope work you ask about.
• You can see, correct or delete what we hold about you by emailing admin@hack-tech.org.

Who is responsible

This website is run by Hack Tech, an offensive security firm based in Israel. We decide how the personal data described here is used, so we are responsible for it under Israeli law and, for visitors in the European Union and European Economic Area, under the GDPR. Questions about this policy go to admin@hack-tech.org.

When you contact us

The contact form asks for your name, your email address and your message, and optionally your company and the service you are interested in. When you send it, our server adds the IP address your request came from. The form collects nothing else.

• Delivery. Your message is sent by Resend, an email delivery service, to our inbox at admin@hack-tech.org, with your address set as the reply-to so we can answer you directly.
• Abuse prevention. Your IP address is included in the email we receive, and the form limits how many messages one address can send in a short period. That limit is kept in the memory of the server that handled your request: it is never written to a database and disappears when that server instance is recycled.
• Spam filtering. A hidden field that people never see catches automated submissions.
• Honest failures. If delivery is not working, the form says so and gives you our email address instead of pretending your message was sent. In that case your email address may be recorded in our hosting provider's server logs so the fault can be traced.

If you email or call us directly, we receive what you send or say, and the same rules on use and retention apply.

Cookies and the marketing pixel

We use one marketing tracker, the Meta Pixel, to measure how people find us through Meta's platforms such as Facebook and Instagram. Nothing loads until you choose Allow in the cookie banner, and without JavaScript it cannot load at all.

Once you allow it, your browser loads Meta's script from connect.facebook.net and reports each page you view to Meta, together with details your browser sends with any request, such as your IP address, browser type and the page you came from. Meta's script can also record interactions such as button clicks, depending on settings in our Meta account. Meta may connect this information to a Facebook or Instagram account you are signed in to, and uses it under its own privacy policy (opens in a new tab).

Changing your mind

Your choice is kept in your browser under the local storage key ht-cookie-consent, as the word granted or denied. It is not a cookie and is never sent to us. Declining stores only that word: no tracker loads and no cookies are set. You can change your choice at any time with Cookie settings in the footer of every page.

If you withdraw permission after allowing it, the site tells Meta's script to stop and deletes the _fbp and _fbc cookies. That cannot recall information Meta has already received; Meta's own privacy tools cover that. This site sets no other cookies of its own.

Hosting, DNS, email and fonts

• The site is hosted by Vercel (opens in a new tab). Like any web host, Vercel processes technical details of each request, such as your IP address, browser type and the page you asked for, to deliver the site and protect it from abuse.
• Our domain's DNS is run by Cloudflare (opens in a new tab), which answers the lookups that point your browser to Vercel. Cloudflare Email Routing also receives mail sent to our address, including contact form messages and anything you email us directly, and passes it on to our mailbox.
• Fonts are bundled into the site when it is built, so your browser never contacts Google or any other font service when you visit.
• Images and video on the home page are served from our own domain, not from a third-party media service.

Why we are allowed to use it

Who else handles it

• Vercel hosts the site and processes request data.
• Resend delivers contact form messages to our inbox, under its own privacy policy (opens in a new tab).
• Our email provider stores the messages we send and receive.
• Cloudflare runs DNS for our domain and, through Cloudflare Email Routing, receives mail sent to our address, including contact form messages, and passes it on to our mailbox.
• Meta receives pixel data only if you allow it, and handles it under its own terms.

Some of these providers process data outside Israel and the EU, including in the United States, under their own terms. The European Commission recognises Israel as providing an adequate level of protection for personal data, so personal data can be sent to us from the EU without any specific authorisation.

How long we keep it

• Enquiries that do not lead to an engagement are deleted within 24 months of our last exchange.
• Engagement correspondence is kept for as long as the contract and our legal obligations require. Engagement data itself is destroyed when the engagement closes, or on a schedule the client sets.
• Your cookie choice stays in your browser until you clear it or change it.
• Rate-limit records exist only in server memory and disappear when the server instance is recycled.
• Hosting logs are kept by Vercel for its own limited retention periods.

How the form protects what you send

Your message travels over HTTPS to our server and on to Resend. The server checks every field before anything is sent, strips line breaks from the values used in email headers so the form cannot be turned into a spam relay, and escapes your text before it is placed in the email. It reports success only when Resend has accepted the message for delivery.

Your rights

Under Israel's Privacy Protection Law, 5741-1981, as amended by Amendment 13, which came into force on 14 August 2025, you can ask to see the information we hold about you, and ask us to correct or delete it if it is wrong, incomplete, unclear or out of date. You can also complain to Israel's Privacy Protection Authority.

If you are in the EU or EEA, the GDPR also gives you the right to access your data, have it corrected or erased, restrict or object to how we use it, receive it in a portable format and withdraw consent at any time. You can complain to the data protection authority (opens in a new tab) where you live or work.

How to use them

1. 1

   Email us

   Write to admin@hack-tech.org, ideally from the address you used to contact us, and say what you would like us to do.

2. 2

   Confirm it is you

   We may ask you to confirm your identity before releasing or deleting anything, so your data never goes to someone else.

3. 3

   Get an answer

   We reply within one working day to confirm we have your request, and complete it within one month, telling you what we did or, if we cannot do something, why not.

Changes to this policy

If what this site collects changes, we update this page and its effective date. This version takes effect on 9 November 2026.