Who is responsible

This site is run by an independent security auditor operating under the name LaaTortueJaune, based in France. For anything in this notice, including erasure requests, reach me through the Discord contact given on therequest page.

What is collected, and only when you send it

Browsing this site collects nothing. There is no analytics script, no advertising, and no tracking cookie. The only data collected is what you type into the audit request form:

• the Roblox place link you submit;
• your Discord username;
• your email address, if you choose to give one — it is optional;
• the message you write;
• the two-letter country your request came from, derived from your IP by Cloudflare. Your IP address itself is not stored.

Why, and on what basis

To answer your request and, if we work together, to run the audit and reach you about it. The legal basis is the steps taken at your request prior to entering a contract. That is the only use — your data is never sold, never shared with a third party for their own purposes, and never used to contact you about anything you did not ask about.

Where it is stored

In a Cloudflare D1 database provisioned in Western Europe, so the data stays in the EU. The administration page that displays it is behind Cloudflare Access and reachable only by me, after authentication.

How long it is kept

Requests that do not lead to an audit are deleted within 12 months. Requests that do are kept for the duration of the engagement and for 3 years after it ends, which is the ordinary limitation period for a commercial dispute in France. You can ask for erasure sooner at any time.

Your rights

Under the GDPR you can ask to access your data, correct it, have it erased, or object to its use. Ask me and I will act on it — erasure is a permanent delete, not a flag. If you believe I have handled your data improperly, you can complain to the CNIL, the French data protection authority.

Anti-bot check

The form is protected by Cloudflare Turnstile, which confirms a human sent it. Turnstile does not profile you and does not track you across sites.

Audit reports

Reports are delivered to the client and are not published. The work section of this site names audited games only where the developer agreed in writing to be named, and the vulnerability count shown there is an aggregate total that is never attached to a named game.