Privacy Policy

Who we are

This site is operated by Rinto Ismail trading as exit codes (ABN 58 712 323 217), an independent security practice based in Sydney, New South Wales. In this policy, "we" and "us" mean that business.

This policy covers this website at exit.codes, its enquiry forms, our business correspondence and the personal information we handle when working with clients. The former Exit Tools service has been retired. The tools now at sec.team are outside the scope of this website policy.

We are a small business, and businesses under the Privacy Act's turnover threshold are not always covered by it. We have chosen to comply with the Australian Privacy Principles anyway, and we treat the commitments on this page as binding on us. Handling other people's data carefully is the service we sell, so applying a lower standard to our own collection would be difficult to justify.

What we collect

When you visit this website

We use Google Analytics, loaded through Google Tag Manager, to understand which pages people read. That records things like the pages you view, roughly where you are, and what kind of device and browser you use. It also records when you click certain links, specifically when you click through to our enquiry form, click an email address, or open one of the free tools, along with the link text and destination. We use that to see which parts of the site actually lead anywhere. Our content delivery provider, Cloudflare, also records standard request logs including your IP address, which it uses to serve the site and to block abuse.

We do not use advertising or cross-site tracking, and we do not sell or rent personal information to anyone.

When you send us an enquiry

Our enquiry forms ask for your business or trading name, a short description of what you do, your name, email address and what you need help with. The website-project form also asks for project details; optional fields can include your ABN, phone number, preferred contact method and links you choose to share.

When you submit the form, your enquiry is emailed straight to our business mailbox through Microsoft 365. The website does not keep a separate copy or database of enquiries. We do not send an automatic email to the address you enter; we reply to you ourselves.

We use Cloudflare Turnstile to tell humans from bots on those forms, and we apply rate limits based on IP address to prevent abuse. Both involve Cloudflare processing your IP address and basic request information.

Drafts saved in your browser

The form saves your draft in this browser while you type, so you can return to it. It is stored on your device, separately from submitted enquiries, and is cleared after a successful submission. You can also remove it by clearing this site's data in your browser. On a shared device, clear the draft before leaving.

When we work with you as a client

Security work often involves access to systems that contain personal information about your staff, your customers or third parties. During an engagement we may collect logs, forensic images, configuration and account data. What we may access, what we do with it, how long we keep it and how it is destroyed are all set out in the written agreement for that engagement, which takes precedence over this page.

We apply data minimisation as a matter of practice: we take what the engagement needs and no more, and limit access and distribution to the agreed work.

How we use it

• To answer your enquiry and, if it goes further, to scope and deliver work for you
• To reply to you and for ongoing business correspondence
• To keep our systems secure and available, including blocking abuse
• To meet our legal, insurance and record keeping obligations

We do not send marketing email to people who have not asked for it. If we ever add a mailing list it will be opt-in and separately unsubscribable.

Who else handles your information

We use a small number of service providers to run the business:

• Cloudflare for website hosting, processing enquiry form submissions, bot protection and rate limiting
• Microsoft 365 to deliver enquiries to our mailbox, and for business email and correspondence
• Google for website analytics and Search Console
• Notion for internal business records, project notes and client portals

These providers may store or process information outside Australia, including in the United States. We share information with them only so they can perform those functions for us. We do not otherwise disclose your personal information, except where we are required to by law, or where you have asked us to.

Where it is stored

Website content and short-lived rate-limit data are hosted with Cloudflare. Enquiries and business email are held in Microsoft 365. These services may process or store information outside Australia. Client engagement material is handled in the locations and systems agreed for that engagement; we do not assume all business data stays on infrastructure we operate in Australia.

How long we keep it

• Enquiries: kept in our mailbox while the opportunity or relationship is live, and afterwards only as long as we need for our business and legal records
• Rate-limit data: counters keyed to your IP address or email address expire automatically within two hours
• Historical Exit Tools records: any retained archive is restricted to recovery, business records and other retention needs. Contact us about information held from the retired service
• Client engagement material: per the written agreement for that engagement. Our standard terms are 90 days after the final report for forensic images, acquired data and working notes, then secure destruction with written confirmation; devices returned on request or within 30 days of the final report; and the final report and chain of custody records kept for 7 years for professional, insurance and regulatory purposes

Retention is extended where a client tells us in writing that a legal hold applies, or where we reasonably believe something must be preserved for a legal proceeding, an insurance claim, or a law enforcement or regulator request.

How we protect it

Website traffic is encrypted in transit. The website sends enquiries using a Microsoft 365 account that can send only from one dedicated mailbox, and holds no enquiry data itself. Access to client material is limited to the people doing the work, and credentials are held in a password manager rather than in code or documents. Retired-estate backup archives are encrypted.

No system is perfectly secure, and we will not claim otherwise. If a data breach occurs that is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme.

Cookies and analytics

This website uses cookies set by Google Analytics to distinguish visitors and sessions. Enquiry drafts use browser storage, as described above, and so does remembering that you dismissed a security advisory notice. You can block or delete cookies in your browser, and you can opt out of Google Analytics using Google's browser add-on. Blocking analytics cookies does not affect anything on this site.

Accessing or correcting your information

You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it. Email contact@exit.codes and we will respond within a reasonable period, normally within 30 days. We may need to verify who you are before acting on a request.

Complaints

If you think we have mishandled your personal information, tell us first at contact@exit.codes. We will investigate and write back to you. If you are not satisfied with how we handle it, you can escalate to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

We will update this page when what we do changes. The date at the top tells you when it was last revised. If a change materially affects people who have already given us information, we will tell them directly rather than relying on this page.