Bugbop Privacy Policy

1. Information We Collect

1.1 Account Information

When you register for Bugbop, we collect:

• Name and email address
• Username and password
• IP address at the time of registration
• Profile information (optional)
• Payment information when applicable (stored securely through our payment processors)

1.2 Usage Data

We collect information about how you interact with our platform:

• Bug Reports submitted and their content
• Program participation history
• Comments and communications within the platform
• Log data including IP address, browser type, pages visited, and time spent

2. How We Use Your Information

We use your information to:

• Provide and improve Bugbop services
• Process Bug Reports and facilitate communication between Bug Hunters and organizations
• Process payments and manage accounts
• Send important notifications about your account or Bug Bounty Programs
• Analyze platform usage to improve features and user experience
• Prevent fraud and enforce our Terms & Conditions
• Review Programs and Bug Reports for moderation, policy compliance, and quality assurance
• Provide technical support and resolve disputes between users

3. Data Sharing and Disclosure

We may share your information with:

• Program Owners: Bug Reports and related communications are shared with the organization that owns the Bug Bounty Program.
• Service Providers: We use the third parties listed in section 3.1 to run the platform. Each one only receives the data it needs for its job.
• Legal Requirements: We may disclose information when required by law or to protect our rights, privacy, safety, or property.

We do not sell your personal information to third parties.

3.1 Subprocessors

These are the services that store or process your data on our behalf, and what each one sees.

3.2 AI Processing

When a Bug Report is submitted, we send its title, description, and the Program's scope text to OpenAI to help triage it. No Bug Hunter identity is attached. We have Zero Data Retention enabled with OpenAI, so this content is not stored by OpenAI after the request completes, and under OpenAI's API terms it is not used to train their models.

4. Data Security

We implement appropriate technical and organizational measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

All platform data, including backups, is hosted on Amazon Web Services in the us-east-1 (N. Virginia) region, encrypted at rest and in transit. Where your data lives, how it's backed up and how we protect access to it is described on our Security page.

5. Content Moderation and Platform Integrity

To maintain the integrity of our platform and ensure compliance with our policies, Bugbop reserves the right to:

• Review Program descriptions, scope documents, and other public-facing content
• Access and review Bug Reports and related communications when necessary to investigate potential misuse
• Monitor unusual activity patterns that may indicate fraudulent or abusive behavior
• Assist with technical support inquiries by examining specific Program or report data with your permission
• Moderate content that may violate our Terms & Conditions or community standards

This oversight helps us maintain a trustworthy platform while protecting both Bug Hunters and organizations from potential misuse or policy violations.

6. Your Rights and Choices

Depending on your location, you may have rights regarding your personal information, including:

• Accessing, correcting, or deleting your personal information
• Objecting to or restricting certain processing activities
• Data portability
• Withdrawing consent where processing is based on consent

To exercise these rights, please contact us at [email protected].

7. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience and understand how our services are used.

7.1 Website Analytics

We use Google Analytics and Ahrefs Web Analytics to analyze website traffic and user behavior on our marketing website. These services may collect information about your device, browser, IP address, the pages you visit, and how you interact with our site. This information is used to improve our website and services. These analytics run only on our public marketing pages, not on the authenticated pages where Bug Reports and Program data live.

7.2 Your Choices

You can control cookie settings through your browser preferences. Please note that disabling certain cookies may affect the functionality of our website. For more information about how Google Analytics collects and processes data, please visit Google's Privacy Policy.

8. International Data Transfers

Bugbop is based in Australia, but our services may involve transferring and storing your data in other countries. We ensure appropriate safeguards are in place to protect your information in compliance with applicable laws.

9. Children's Privacy

Bugbop is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on our website and, where appropriate, by email.

11. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at [email protected].