Privacy

Last updated: 14 November 2026.

Who is responsible

HackZoneLabs is an independently owned business based in Pakistan. It operates HackZoneLabs News at news.hackzonelabs.com and is responsible for the personal data we process for this news service. Contact news@hackzonelabs.com about privacy or your information. This policy covers the News service; other HackZoneLabs services have their own notices.

What we do not do

• Our public application sets no cookies and uses no local storage, session storage or advertising identifiers. See our cookie notice.
• Reading pages do not run advertising or analytics scripts, and fonts are served by this site. Newsletter signup alone permits Cloudflare Turnstile for anti-abuse verification; it requires JavaScript. Clearance cookies are disabled.
• Some stories show a photo from Unsplash. Unsplash requires that its photos load from its own servers, so your browser fetches that image from images.unsplash.com, which receives the same technical request details as any web server (your IP address, the image address, details of your browser and our site’s address, not the page you are reading). Unsplash counts how often its photos are viewed. We send it nothing else about you.
• We do not run advertising or visitor trackers.

What happens when you visit

Like any website, ours is delivered through Cloudflare and our own web server. To deliver and protect the site they process, and may log, technical details of each request: your IP address, the address you asked for, and details of your browser. We use these records to keep the site running and secure, not to build profiles of readers.

Public application and web-server request logging is disabled on our host. Cloudflare still processes requests to deliver and protect the site; its processing is separate from our application database. Loading an Unsplash photo also sends technical request data to Unsplash. Not subscribing therefore does not mean that no personal data is processed anywhere.

Why we use information

We use your consent to send the newsletter lists you request. You can withdraw that consent at any time. Where data-protection law requires a lawful basis, we rely on our legitimate interests in delivering and securing the site, preventing abuse, answering correspondence and handling corrections. We keep only the information needed for those purposes and consider the effect on readers. We may also retain information where necessary to meet a legal obligation or establish, exercise or defend legal claims.

Providing an email address is optional unless you want a reply or a subscription. We do not sell personal information, build reader profiles or make automated decisions about readers that have legal or similarly significant effects.

Aggregate reporting

Aggregate analytics, when enabled, count requests by public page and broad referrer category without storing IP addresses or visitor identifiers. Origin counts include bots and miss requests served from Cloudflare’s cache.

Search-demand reporting is enabled. It keeps only reviewed security-topic labels and result-count buckets, not your search wording or a hash of it. Sensitive-looking and unrecognized text is discarded. Private temporary aggregate files are deleted within 24 hours under normal operation. Scrubbed search aggregates expire after 30 days; page-request aggregates, if enabled, expire after 90 days. Reports hide topic labels with fewer than five requests in the selected range. These are approximate request counts, not counts of different people; interruptions and discarded observations can cause gaps.

Encrypted recovery backups may retain older aggregates for up to 30 additional days. They are not used for reporting; expiry controls must be reapplied when restoring them.

Email

If you write to us, we keep your message and address so we can reply and, where it is a correction, so we can handle it properly. We do not sell correspondence or use it for advertising. Our email provider processes messages to deliver and store them.

We retain correspondence for as long as needed to resolve your enquiry, maintain a relevant correction record or handle a legal obligation or dispute. Please avoid sending sensitive information that we do not need.

Newsletter

Newsletter signup, when enabled, is optional. Choose the weekly digest and/or rare alerts and confirm your mailbox. We store your email, selected lists, consent-text version and request, confirmation and removal times. Amazon Web Services processes confirmation and newsletter delivery through SES, from news@hackzonelabs.com, and delivery feedback through private SNS/SQS queues. Friday 18:00 Pakistan time prepares a digest draft; a person reviews each send.

We do not collect per-reader opens or clicks for analytics. Delivery, unsubscribe, bounce and complaint feedback keeps mailing lists accurate. The signup check processes technical data through Cloudflare; short-lived keyed abuse identifiers help limit repeated requests without storing raw IP addresses in the newsletter database.

Confirmation links expire after 48 hours. Scheduled cleanup removes unconfirmed mailbox addresses after seven days, abuse identifiers after 48 hours, and normalized delivery-event metadata after 90 days. Active subscription information remains while needed to deliver your choices. After leaving all lists, scheduled cleanup removes the newsletter address once its record is at least seven days old. We retain necessary consent evidence and a keyed suppression identity so imports cannot silently subscribe you again.

Use an email’s unsubscribe link to leave immediately, or its preferences page to remove one list. Adding a list or changing your address requires fresh confirmation. Mail already queued for delivery may still arrive. Contact news@hackzonelabs.com for access or verified erasure requests; we aim to remove unnecessary app-held personal data within 30 days. Private feedback queues retain messages for up to four days, or seven days in the failed-message queue; messages may contain delivery headers. SNS may retry forwarding an undelivered notification for up to 23 days before it reaches a queue. Resolved delivery-attempt metadata expires after 90 days; unresolved keyed delivery records remain while needed to reconcile an uncertain send. Provider erasure and retention are reviewed separately from app-held records.

Providers and international processing

We use Cloudflare for site delivery, security, Turnstile and encrypted recovery-backup storage; AWS for newsletter delivery and feedback; and Unsplash to serve selected photos. Our email provider handles correspondence. These services may process information outside your country. Newsletter SES and its feedback queues are configured in Stockholm, Sweden; that does not mean all provider processing stays in Sweden.

Provider terms describe their international processing and any transfer safeguards, which can include standard contractual clauses where applicable. Contact us for information about the arrangements relevant to your data. Provider notices explain their own processing: Cloudflare privacy, Turnstile privacy, AWS privacy and Unsplash privacy.

Private newsletter records are included in encrypted recovery backups, which may retain older records for up to 30 additional days. Backups are restricted to recovery; deletion and suppression controls must be reapplied when restoring them.

Your choices and rights

You can unsubscribe without contacting us. You can also ask to access, correct or erase your personal information. Depending on the law that applies, you may have rights to restrict processing, object to processing based on legitimate interests, receive a portable copy of information you provided, or withdraw consent without affecting earlier lawful processing.

Email news@hackzonelabs.com. We may need proportionate proof that the information belongs to you. We normally respond within one month, subject to applicable legal time limits and permitted extensions. Some information must remain to honour an opt-out, investigate uncertain delivery or meet legal requirements; we explain any relevant exception.

You may complain to the data-protection authority competent for your location or the processing where applicable. UK readers can contact the Information Commissioner’s Office; EEA readers can find their authority through the European Data Protection Board. You can contact us first, but do not have to do so to exercise a right to complain.

Changes

We update the date above when this notice changes and explain material new uses of personal information before starting them. A policy update does not subscribe you to a list or replace consent where it is required.

Questions

Write to news@hackzonelabs.com.