Privacy Policy

Welcome to the Xposer partner portal

This Privacy Policy explains how Xposer ("We," "Us," or "Xposer") collects, uses, stores, and protects information when you use the Xposer partner portal at https://partner.xposer.io (the "Services"). The Services include host search, picks, claims, outreach tools, and related partner-program features.

The public Xposer site at https://www.xposer.io has its own privacy policy. This policy covers the partner portal only.

Questions: [email protected]

1. Our role and commitment

We are the Data Controller of your personal information under the General Data Protection Regulation (GDPR) and applicable law in the Netherlands. We process personal data responsibly, transparently, and in line with legal requirements.

2. Information we collect

We collect:

  • Account information you or we record for your partner login: name, email address, locale, password (stored as a hash), two-factor authentication secrets and recovery codes, and Non-Disclosure Agreement acceptance (time and version).
  • Program activity: hosts you pick or claim, notes you write, outreach material you generate, claim status changes, pick exports, Partner API access to full pick exports, host search queries (filter fingerprint and result counts, not full result lists in the audit log), saved search watchlists (filter metadata, alert counts, and sample host URLs in notifications, not full watchlist target lists in the audit log), survey data, API token creation and revocation, and similar actions. We keep an audit log of partner actions (metadata such as action type and timestamps, not full export file contents).
  • Usage counters: monthly and burst quota meters per account (picks, claims, probes, API calls) stored in partner_usage_monthly and cache-backed rolling windows for enforcement and 80% warnings.
  • Usage data collected automatically: Internet Protocol (IP) address, browser type, date and time, pages requested, and similar log data needed to run and secure the Services.
  • Cookies and similar storage: used to keep you signed in, protect forms, remember language, and operate the session. See Cookies below.
  • Host index data shown in the portal: software types and versions, vulnerability information, rank, and related records about websites in the Xposer index. That data describes third-party sites. It is not used to identify you, except where it appears in your picks, claims, or notes.

We do not collect payment card details in the partner portal. Partner accounts are created by Xposer; there is no public sign-up form.

3. Legal basis for processing

We process personal information on these bases:

  • Contract: to provide the partner program as agreed, including login, search, picks, claims, and related tools.
  • Consent: where you agree, such as accepting these terms at login, or where cookie consent is required.
  • Legitimate interests: to secure the portal, prevent abuse, keep an audit trail, and improve the Services, provided this does not override your rights.
  • Legal obligation: to comply with law, resolve disputes, or enforce our policies.

4. How we use your information

We use this information to:

  • Authenticate you (including two-factor authentication) and keep your session secure.
  • Provide host search, picks, claims, outreach tools, and the rest of the partner workflow.
  • Record Non-Disclosure Agreement acceptance and other program compliance.
  • Keep an audit log of partner actions.
  • Communicate with you about the partner program.
  • Protect the Services, investigate misuse, and meet legal duties.

We do not use partner-portal personal data for advertising.

5. Cookies

  • We use cookies and similar technologies for authentication, security (including CSRF protection), language preference, and session operation.
  • You can disable cookies in your browser. The portal will not work correctly without session cookies.
  • We do not use advertising cookies on the partner portal.

6. Host index data

  • The portal displays records from Xposer's host index so you can evaluate sites and contact owners as part of the partner program.
  • That index is produced by Xposer's public detection and monitoring services. It is not personal data about you, except where you attach it to your account through picks, claims, or notes.
  • Treat host records as confidential. The Non-Disclosure Agreement governs how you may use and share them.

7. Data retention

  • We keep account and program data for as long as your partner account is active and as long as we need it to run the program, keep an audit trail, or meet legal duties.
  • After an account ends, we may retain records for a reasonable period to resolve disputes, prevent abuse, or comply with law, then delete or anonymize them where we no longer need them.

8. Your data protection rights

If you are in the European Economic Area (EEA) or otherwise covered by GDPR, you have the right to:

  • Access the personal information we hold about you.
  • Rectify inaccurate or incomplete data.
  • Erase personal information in certain cases.
  • Object to processing based on legitimate interests.
  • Restrict processing in certain cases.
  • Port your data in a structured, machine-readable format.
  • Withdraw consent where processing relies on consent. Withdrawal does not affect processing already carried out. If you withdraw consent required to use the portal, we may not be able to provide the Services.

To exercise these rights, email [email protected]. We will respond within 30 days, subject to legal exceptions.

9. Sharing and third parties

  • Service providers: we may share data with trusted processors (for example hosting, email delivery, and error reporting) solely to run the Services. They are bound by contracts to protect the data.
  • Legal requirements: we may disclose data if required by law, or to protect the rights, safety, or property of Xposer, our partners, or others.
  • No sale: we do not sell your personal information.
  • This policy does not cover third-party sites you visit from the portal. Their own policies apply.

10. Security

  • We use reasonable technical and organizational measures to protect personal data, including hashed passwords and required two-factor authentication.
  • No online system is completely secure. We cannot guarantee absolute security.

11. Scope

This policy applies to personal data collected through the partner portal. It does not cover the public Xposer site, offline activity, or data collected through other channels.

12. International transfers

If you use the Services from outside the Netherlands, your data may be transferred to and processed in the Netherlands or another jurisdiction. We use GDPR-compliant safeguards, such as standard contractual clauses, where required.

13. Changes

We may update this Privacy Policy to reflect changes in our practices or the law. The current version will be posted on https://partner.xposer.io. You will be asked to accept the current policy when you log in.

14. Contact

For questions, concerns, or to exercise your rights:

Last updated: 9 September 2026