Privacy Policy

1. Introduction

Host Engineering LTD ("we", "us", "our") operates KlaroSkope.com, a script deobfuscation platform for security professionals. We are committed to protecting your privacy and processing your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy explains how we collect, use, and protect information when you use our service.

2. No External AI Processing

3. Data Controller

The data controller for information collected through KlaroSkope.com is:

4. Information We Collect

4.1 Account Information

When you create an account, we collect:

• Email address
• Name (if provided)
• Authentication credentials (securely managed)
• Subscription tier and billing information

4.2 Submission Data

When you submit files or scripts for analysis, we process:

• The submitted content (scripts, files, code snippets)
• Analysis results (decoded content, IOCs, quality scores)
• Submission metadata (timestamp, file size, file type)

4.3 Technical Data

We automatically collect:

• IP address (for security and rate limiting)
• Browser type and version
• Device fingerprint hash (for anonymous usage limits)
• Usage patterns and timestamps

5. Anonymization and Engine Improvement

To improve our deobfuscation engine, we keep de-identified records derived from submissions. This works as follows:

• Identifiers removed: Your account identifier, email address, IP address, device fingerprint and file name are not copied into these records
• No submitted content: The content you submitted and the decoded output are not kept. A record holds a cryptographic hash of the content, the techniques the engine applied, how the analysis went, and the indicators it found
• One record per analysis: Each record describes a single analysis, so we can study individual results as well as trends. Records carry no link to your account
• Indicators kept: Indicator values (such as malicious URLs, domains, IP addresses and file hashes) are kept, with any email address inside them removed

You may opt out of contributing anonymized data to engine improvement by contacting contact@klaroskope.com. Opting out does not affect your access to the Service.

6. Air-Gapped Deployment (Operations Tier)

7. Legal Basis for Processing

We process your data based on the following legal grounds under UK GDPR:

8. Data Retention

We retain your data for the following periods:

• Account data: Until account deletion, plus 30 days
• Submitted samples: up to 90 days from the most recent submission of the same file, then automatically deleted
• Analysis results: 90 days, accessible via your dashboard, then automatically deleted
• Billing records: 7 years (UK legal requirement)
• Security logs: 12 months
• Anonymous usage fingerprints: 1 year
• Anonymized pattern data: Indefinitely (non-personal data)
• De-identified analysis statistics: may be kept longer than 90 days to improve the Service (see below)

Before an analysis result is deleted, we copy a de-identified statistical record of it to systems we control, so we can measure and improve how the engine performs over time. This record holds the date, whether the analysis came from an account or an anonymous visitor, the file type and size, a cryptographic hash of the submitted content, the techniques the engine applied, the quality score, the number of layers, how long the analysis took, the outcome and any reason it was declined, the number of indicators found and the indicator values themselves (such as malicious URLs, IP addresses, domains and file hashes, with any email address inside them removed), and our own review of the result. It does not hold your account identifier, email address, IP address, device fingerprint, the name of your file, the content you submitted, or the decoded output. If you have opted out of engine improvement (Section 5), only a marker that the record existed is kept, with no statistics.

You can request deletion of your personal data at any time by contacting contact@klaroskope.com. Anonymized data that has already been processed cannot be deleted as it is no longer associated with you.

9. Data Sharing and Processors

We use carefully selected third-party service providers to help deliver the Service. These providers are contractually bound to protect your data and process it only as instructed by us.

Our key processors include:

All providers listed above are committed to GDPR and UK GDPR compliance and maintain appropriate data protection measures.

Where data is transferred outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and Data Processing Agreements (DPAs).

We do not sell your personal data to third parties. We do not share individual submission data with any external parties under any circumstances.

10. Your Rights

Under UK GDPR, you have the following rights:

• Right of access: Request a copy of your personal data
• Right to rectification: Correct inaccurate personal data
• Right to erasure: Request deletion of your personal data
• Right to restrict processing: Limit how we use your data
• Right to data portability: Receive your data in a machine-readable format
• Right to object: Object to processing based on legitimate interests
• Rights related to automated decision-making: Not applicable (we do not make automated decisions with legal effects)

To exercise any of these rights, contact us at contact@klaroskope.com. We will respond within one month.

11. Cookies and Tracking

We use essential cookies for:

• Authentication session management
• Security tokens and CSRF protection
• User preferences

We do not use advertising cookies, third-party tracking pixels, or analytics platforms that share data with advertisers. We do not participate in cross-site tracking or data broker networks.

For traffic measurement we use Cloudflare Web Analytics, which is privacy-first and cookieless. It sets no cookies, uses no cross-site identifier, and does not share your data with advertisers or data brokers. Because it stores nothing on your device, it requires no cookie consent.

12. Security

We implement appropriate technical and organizational measures to protect your data, including:

• TLS encryption for all data in transit
• Encryption at rest for stored data
• Network isolation for analysis containers
• Rate limiting and DDoS protection
• Regular security audits
• Access controls and audit logging

If you discover a security vulnerability, please report it to security@klaroskope.com.

13. Children's Privacy

KlaroSkope is a professional security tool not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will delete it promptly.

14. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes by email or through a notice on our website. The "Last updated" date at the top of this policy indicates when it was last revised. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

15. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

16. Contact Us

For privacy-related inquiries or to exercise your rights, contact us at: