Privacy Policy

Effective date: 29 October 2026. This policy explains what personal information the PenBot PHP2Shell Check collects, why, and the choices you have. The service is operated by Nikivox t/a Swarm Digital PTY, operating PenBot at penbot.ai. It applies to the PHP2Shell Check: the single outside-in check for CVE-2026-109618 and CVE-2026-109619. There are no customer accounts on this service.

1. What we collect

• Check data: the site address you submit, the check results, and the evidence behind them: public responses your own site sends to any visitor, such as HTTP response headers, error pages, and version fingerprints.
• Report email address: the address you give us so we can send you the report link and the report itself.
• Consent receipts: verification method, policy version, timestamp, and source IP, logged for every check.
• Payment data: when payments are active, a gateway transaction reference and status. We never see or store card numbers. During the free-for-2026 pause the payment gateway is switched off, no payment is taken, and no payment data exists.
• Analytics data: aggregated usage measurements via Google Analytics, collected only if you accept them. See the Cookies section below.

We do not sell personal information. We do not run advertising trackers.

2. Why we process it

To run the check you asked for, to send your report, to prevent fraud and abuse, to comply with law, and, only if you accept, to measure how the site is used in aggregate.

3. Processors

• Postmark: transactional email delivery (the report link and the report)
• The payment gateway (hosted checkout): transaction processing, only when payments are active
• Report storage: rendered reports and evidence held on our storage (Cape Town region)
• Cloudflare: content delivery and protection
• Google: Analytics measurement, only if you accept

4. Retention

Check records live in the running service. Rendered reports stay in our report storage so your report link keeps working. You can ask us to delete a check, its report, and its artifacts at any time: [email protected]. Consent receipts are retained as required for legal purposes.

5. Security

Encryption in transit for all connections, read-only public requests from the probe (no agent, no credentials, nothing installed on your server), and a self-identifying scanner so your admins always know who asked.

6. Your rights

You may request access, correction, or deletion of your personal information, and may object to or restrict certain processing. South African users have rights under POPIA sections 11 and 14. EU users have rights under GDPR articles 15 to 22.

Requests: [email protected]. We aim to respond within 14 days.

7. Cookies

This site works without cookies: there are no accounts, no sessions, and no essential cookies. The only cookies that can ever be set are optional:

• Google Analytics cookies (optional): loaded only if you press Accept on the consent banner. They measure aggregate site usage (pages viewed, rough location, device type) so we can improve the service. Google sets and reads its own cookies under its own privacy terms. If you press Reject, or never choose, none of these cookies are ever set.

No marketing or advertising cookies, ever. Your consent choice is stored in your browser (localStorage, not a cookie) and respected on every visit. To reject: press Reject on the banner, or use the button below to reopen the choice at any time, or block cookies in your browser settings. The site keeps working either way; only the optional analytics stop.

8. Changes

We may update this policy and will notify you of material changes.

9. Contact

Nikivox t/a Swarm Digital PTY. [email protected].