Your information

Privacy notice

Updated October 22, 2026

BOLD BYTES DEV LLC, operating as Zybee Labs ("we," "us"), is responsible for the personal information described here. This notice covers this website, the Zybee Exposure Report service, and communications about general business security and WordPress security inquiries before any separately agreed hands-on work. Contact hello@zybee.ai with privacy questions or requests.

Preparing and sending a request

When you send the report request form, your website URL, name, email address, authorization confirmation, and the page language are sent to us and stored with your request, together with your IP address and browser details to prevent abuse. We email you a confirmation and notify our inbox. If sending fails, the form offers an email draft instead; contact links also open an email draft. If you open a draft in an email app or service, that provider handles it under its own privacy practices, including any draft storage.

Once you have entered a website and a valid email address, the form saves them and your name while you type, so you can continue later. A random identifier for this is kept in your browser’s local storage. Unsent entries are deleted after 24 hours, or 7 days after a reminder. On the English page, we send one reminder email if the request stays unsent for 15 minutes. On the German and French pages, we send that reminder only if you tick the reminder box. Sending the request, or an earlier request from the same address, cancels the reminder. To have unsent entries deleted sooner, email hello@zybee.ai.

The PHP help forms on the PHP update check and under our blog posts are the exception: when you submit one, your email address, optional name and message, and, if you ran a check or entered a website, its domain and the result are sent to our inbox through our hosting and email providers. We use this information only to answer your request, under the same purposes, legal bases, and retention described in this notice. We do not add you to a mailing list.

When you run the PHP update check, the domain you enter is sent to our checking service, which requests that site’s start page once. We keep the domain, the result shown to you, the wording you confirmed, and a pseudonymised form of your IP address (a keyed hash, not the address itself) for 90 days, to see which sites were checked and to prevent abuse of the check. After 90 days these records are deleted automatically.

If you sign up for security alerts on the PHP update check or the hoster status page, we store your email address, the website you entered (optional), the page language, the wording you agreed to, the time, and your IP address and browser details to prevent abuse. We first email you a confirmation link (double opt-in); only after you confirm do we send alerts, and only about critical PHP or WordPress security flaws. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the unsubscribe link in every email or by writing to hello@zybee.ai. Unsubscribing deletes your entry. Unconfirmed signups are deleted after 7 days.

When you contact us, we receive the information you send, such as your name, email address, website URL, authorization confirmation, details about your inquiry, and correspondence. Please do not include credentials, API keys, customer records, or other sensitive application data.

Information used for reports and inquiries

We use request and correspondence information to confirm your authority and scope, answer questions, perform the agreed public checks, deliver the report, and handle service concerns. We also process report findings and invoice and payment-status information to provide the service and keep necessary business records. We do not need access to private accounts or application data, and we do not download your data as part of the report service.

For general and WordPress security inquiries, we use the information you send to understand your needs, respond, and discuss a possible scope of work. An inquiry does not give us access to your systems or authorize hands-on work. Before any hands-on website security work begins, required access and data-handling arrangements must be agreed separately, alongside the scope, price, and terms.

Where a legal basis is required, we use information to take steps at your request and fulfill our agreement, meet legal obligations, and pursue legitimate interests in running and protecting the service, subject to applicable law and your rights.

Website hosting, logs, and cookies

Cloudflare hosts this website and processes technical request information, which can include IP addresses, requested URLs, timestamps, browser details, and security or error information. Technical request logs support website delivery, reliability, and protection against abuse. Visiting the site therefore involves this technical processing even if you never send a request.

We use PostHog, an analytics service hosted in the EU (Frankfurt), to understand how visitors use this site and the request form, for example which pages are viewed and where a request was abandoned. Analytics requests pass through our own domain. PostHog stores a random visitor identifier in a cookie and in your browser’s local storage, so it can recognise a returning visitor across pages and visits. When you send a request form, the email address you entered is used to identify you in PostHog, which links your earlier visits in this browser to that request. PostHog also records the approximate location (country, region, city) it derives from your IP address; the address itself is not stored for this. Our server also reports to PostHog when a request form is started or sent and when a reminder is sent, with the email address and website entered and the location Cloudflare derives from your IP address, so we can see which requests are completed. This analytics is based on our legitimate interest in understanding and improving the service, and you can object to it at any time by writing to hello@zybee.ai. We do not use advertising trackers, sell your personal information, or use it for targeted advertising.

Service providers and disclosures

Hosting, email, analytics, and invoicing or payment providers process information needed for their respective functions. Email providers handle correspondence and report delivery. Invoice and payment providers handle billing and the payment details you enter through their services; this website does not collect card or bank details. Their services may process information in countries other than your own, subject to applicable data-protection requirements.

We use these providers for functional service delivery, not advertising. We may also disclose information when required by law or where necessary to protect legal rights or the security of the service. We do not publish your report as marketing material.

Payment processing (Airwallex)

For card payments, we use Airwallex as our payment provider. Airwallex processes your name, email address, the amount due, and the payment details you enter directly with Airwallex; we do not see or store your full card details. Our invoices are issued by our US company, so payments are processed through Airwallex US, LLC, part of the Airwallex group.

This can involve processing your information in the United States and other countries where Airwallex operates. Where this happens, it is based on the necessity to perform our contract with you (Art. 6(1)(b) GDPR) and, for transfers outside the EU/EEA, recognized safeguards such as standard contractual clauses (Art. 49(1)(b) and Art. 46 GDPR, as applicable).

Email (Zoho Mail)

Our hello@zybee.ai mailbox is hosted by Zoho Mail, operated by Zoho Corporation B.V. in the Netherlands, using an EU data centre. Zoho processes the correspondence, request, and form-notification information described in this notice so that we can receive and answer it.

Zoho support staff may access mailbox data from outside the EU, for example from India, to provide technical support. Where this happens, it is safeguarded by measures such as standard contractual clauses.

Appointment booking (cal.com)

The contact page links to cal.com, operated by Cal.com, Inc. in the United States, to schedule a call. If you book a time, cal.com processes your name, email address, the time you choose, and any notes you add.

This involves transferring your information to the United States. We rely on recognized safeguards such as standard contractual clauses for this transfer.

Retention and safeguards

We retain information only as long as necessary to respond to inquiries, provide the service, address questions or disputes, and meet applicable legal, accounting, and recordkeeping obligations. When it is no longer needed for those purposes, we delete it or remove identifying details.

We use reasonable safeguards appropriate to the information and limit access to what is needed for the service. No method of transmission or storage is completely secure, so we cannot promise absolute security.

Your choices and rights

Email hello@zybee.ai to request access to, correction of, or deletion of your personal information. Depending on the law that applies, you may also have rights to restrict or object to processing, obtain a portable copy, or complain to a data-protection authority. We may need to verify your identity before acting. Some information may need to be retained to meet legal obligations or resolve an ongoing matter; we will explain any applicable limits when responding.

This notice may be updated to reflect changes in our practices. The date above identifies the current version. Our report terms of service explain the report’s scope, delivery, and payment conditions.