Privacy policy

This Privacy Policy explains how V-Formation collects, uses, and protects your personal data in accordance with the General Data Protection Regulation (GDPR).

1. Who We Are

MB DK Cyber Solutions (registration code 307002380), Girulių g. 10-201, LT-12112 Vilnius, Lithuania, is the data controller. Contact: [email protected].

2. What We Collect and Why

• Account data — name, surname, email address, phone number, nationality, and (for researchers) skills and IBAN — to provide the service, pay bounties, and verify payout and sanctions eligibility (contract; legal obligation for compliance screening).
• Platform activity — submitted reports, communications, messages to our V-Bot AI assistant (processed within our EU AWS infrastructure and never used to train AI models), and usage history — to operate programs and support you (contract).
• Technical data — IP address, browser and device information, and logs — for security, fraud prevention, and misuse detection (legitimate interests).
• Compliance data — payment and identity records — for accounting, tax, and sanctions screening (legal obligation).
• Website statistics — on v-formation.io we collect aggregated page views, referral and campaign sources, device type, and click/scroll interactions using a privacy-focused, EU-hosted, cookieless analytics tool (legitimate interests). No session recordings are made, typed input is never captured, and IP addresses are not stored; a random identifier is kept in your browser's local storage. Opt out at any time via the "Privacy choices" link in the website footer; we also honor the Global Privacy Control (GPC) browser signal, which opts you out automatically.
• Marketing and waitlist emails — only with your consent (confirmed by double opt-in), which you can withdraw at any time via the unsubscribe link.

3. Cookies

The V-Formation platform (app.v-formation.io) uses only strictly necessary authentication cookies — no tracking or advertising cookies. Our website uses no cookies and shows no cookie banner. Cloudflare Turnstile provides bot protection and is strictly necessary for security.

4. Storage, Security & Retention

All data is stored at rest in the EU (AWS, Frankfurt region) and protected with encryption, access controls, and monitoring. Account data is kept while your account is active; bounty payment records are kept for the period required by Lithuanian accounting and tax law (generally 10 years); security logs are kept for a limited period proportionate to their purpose. Data past its retention period is deleted or anonymized.

5. Processors & International Transfers

We use a small number of processors bound by data processing agreements: AWS (hosting, storage, and email — EU, Frankfurt), Cloudflare (network security and content delivery), and VulpaSoft (EU-hosted website analytics). Where transfers outside the EU/EEA occur, we rely on Standard Contractual Clauses, adequacy decisions (including the EU-U.S. Data Privacy Framework), or equivalent safeguards — copies available on request.

6. Your Rights

You may access, correct, delete, or receive a copy of your data (portability); object to or restrict processing; and withdraw consent at any time. To exercise these rights, email [email protected]. You may also lodge a complaint with the Lithuanian State Data Protection Inspectorate (vdai.lrv.lt) or the supervisory authority of your EU country of residence.

7. Vulnerability Reports Submitted to Customer Programs

Our customers run vulnerability disclosure programs hosted on the V-Formation platform. When you submit a report to such a program, including through a public form without creating an account, your report and any contact details you choose to provide are shared with the organisation that owns the program so it can review and respond to your submission. That organisation is the data controller of your report data and its own privacy policy applies; we act as its processor, retaining the submission for as long as the program owner requires the report. To exercise your data protection rights over a submitted report, contact the organisation running the program, or contact us and we will forward your request to it.

8. Changes

Updates are posted on this page with a new effective date.