Privacy Policy

Last updated: October 10, 2026

1. Introduction

SERVBG Tools ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you visit servbg.com, whether you use the site as an anonymous visitor, a tool user, or a registered account holder.

This policy applies to all users of the platform including anonymous tool users and registered accounts who use IT-knowledge assessments, survival quizzes, and related features.

2. Data Controller

The data controller responsible for your personal data is:

• Site: servbg.com
• Contact e-mail: [email protected]

2a. Co-Controller Arrangement, Employer-Invited Candidates

When a company registered on servbg.com (an Employer) invites a candidate to complete an IT assessment, a co-controller arrangement applies under GDPR Article 26:

• The Employer (inviting company) is a co-controller for the candidate's personal data (name, email address, assessment scores, and archetype). The Employer determines the purpose of processing, evaluating the candidate for a specific role, and is responsible for its own data-handling obligations, including notifying candidates of its privacy practices.
• servbg.com acts as a processor for assessment-engine data (question delivery, answer recording, score computation) on behalf of the Employer, and retains limited aggregate scores under its own legitimate interest in platform integrity.

Candidate right to erasure: If a candidate exercises their right to erasure (GDPR Article 17), servbg.com will anonymise the candidate's name and email address in all invitation records (candidate_email replaced with [deleted], candidate_name set to NULL, magic link invalidated). Aggregate assessment scores (IT accuracy, archetype, AI-risk percentage) are retained in the Employer's hiring records under the Employer's legitimate interest, these scores contain no personally identifying information after anonymisation.

Candidates who have not consented will never have an assessment row created on their behalf. Consent is recorded explicitly (candidate_consented = 1, consented_at timestamp) before any assessment data is collected.

For questions about data held by a specific Employer, candidates should contact that Employer directly. For questions about data held by servbg.com, contact [email protected].

3. Information We Collect

Anonymous / Tool Users:

• IP address (for tool functionality, geolocation country checks, and abuse prevention)
• Browser type and version
• Operating system
• Pages visited and time spent
• Referral source
• Domain names, IP addresses, or other data you input into our tools
• Files you upload to our secure upload service (encrypted at rest)

Registered Accounts:

• E-mail address (used solely for magic-link authentication)
• Nickname (chosen at registration)
• IT-knowledge assessment answers and computed scores
• Personality assessment responses and computed axis scores
• AI-risk telemetry (aggregate timing and behavioural signals, no message content is sent to any AI provider)
• Survival-quiz answer history and leaderboard scores
• Session metadata (creation timestamp, last-seen timestamp, approximate country)
• Terminal Academy data (when you use the learning terminal while signed in): learning progress (XP, level, completed missions, unlocked tracks), written-exam sessions (track, your answers, score, pass/fail, timestamps) and issued certificates (track, issue date, and a random verification code)

Certificate verification pages: each Academy certificate has a verification page reachable only by its unguessable code (the link you choose to share). That page shows the certificate's track, issue date and the nickname on the account, share the link only if you want those details visible to the recipient. Academy data is included in your data export and permanently removed when you delete your account.

4. How We Use Your Information

• To provide and operate our network diagnostic and IT tools
• To authenticate registered users via magic-link e-mail
• To run and score IT-knowledge assessments and survival quizzes
• To compute AI-risk scores from anonymised behavioural telemetry
• To prevent abuse and enforce rate limits
• To enforce geographic access restrictions where required
• To display aggregated, anonymous statistics on the platform

5. Data Retention

6. Data Security

We implement industry-standard security measures including:

• AES-256 encryption for uploaded files
• HTTPS encryption for all connections
• CSRF token protection on all state-changing requests
• Rate limiting and abuse prevention
• Regular security audits

6a. Threat Board

servbg.com runs its own network sensors on the servers it operates. They record the traffic attacking those servers, which is the same traffic that hits servers like yours: credential stuffing, exploit attempts, brute-force logins and scanner probes. We publish the blocked addresses, a page for each one and an open, signed list at /threats. This is a dataset about attacking addresses and what they did, never about tenants, visitors, or any content of a hosted site.

• An address is blocked at its first attack that can only be an attack, or at three less certain events within ten minutes. The same rule applies to every kind of network, hosting, home or mobile. A score ranks addresses and never decides a block.
• We keep a block for as long as the evidence stands. Only we lift it, when the holder writes to us and has fixed the cause. Blocked addresses go into the open list, IPv4 first and then IPv6 by /64, so that others can block them too.
• For each blocked address we keep its record and the evidence behind the block for as long as the block lasts: the address, the times and the kind of attempt, counts and dates, never more. Raw attack events are deleted after 90 days. The record of an address that was never blocked is deleted 365 days after its last activity.
• Abuse-report records are kept 2 years.

We record the address and the time, nothing else about a person, and we keep no record of who writes to ask for a block to be lifted. Our legal basis is legitimate interest in the security of our systems and of the people we host. We never publish tenant or visitor data, email-like usernames, a password in clear tied to an address, or a guess about who operates an address, only what we observed. Where we show a location, it is the country only. Full policy and the retention table are in /threats/about. Every listing carries its evidence on its page.

6b. Uninvited visitors

Our aim is to block anyone who attacks our servers or our friends' sites, and to publish the evidence so that others can block them too. We did not invite them; they try to slide under the door. We record the address, the time and the kind of attempt. We do not record names, and we do not look for persons. We may do this because we have a legitimate interest in the security of our systems and of everyone we host, which the law recognises. We keep a block for as long as the evidence stands. We lift a block ourselves when the holder writes to us and has fixed the cause. Where we show a location, it is the country only. If you were blocked and have fixed the cause, write to [email protected]. A person reads it and answers.

7. Third-Party Data Processors

We use the following third-party services to operate the platform. Each processor receives only the minimum data necessary for its function.

• MaxMind GeoLite2 (local): Geolocation lookups (country, city, ISP/AS organisation) are performed against locally hosted MaxMind GeoLite2 database files. Your IP address is not transmitted to any third party for geolocation. Database files are downloaded from MaxMind under the GeoLite2 End User Licence Agreement and refreshed weekly.
• Anthropic (Claude): Powers the console AI assistant: the text you type after ai or claude in the terminal is sent to Anthropic under our subscription account to generate the reply. No account data, e-mail address or IP address is included in that request. Assessment AI-risk scores are computed on this server and never leave it. See their privacy policy at https://www.anthropic.com/privacy.
• 4EMX (mx.4emx.com): Transactional e-mail provider used to deliver magic-link authentication e-mails. Your e-mail address is transmitted to 4EMX solely to deliver the authentication message.
• Cloudflare: Content-delivery network and web-application firewall in front of servbg.com. Cloudflare sees every request to the site (IP address, headers, request path) in order to serve, cache and filter traffic before it reaches our origin. Basis: Cloudflare's Data Processing Addendum and Standard Contractual Clauses. See their privacy policy at https://www.cloudflare.com/privacypolicy/.

We do not use Google Fonts or any other external font CDN. All typefaces are self-hosted on servbg.com.

8. Cookies and Local Storage

Cookies set by this site:

• servbg_consent: Stores your cookie-consent choice (accepted / essential only). Expires after 1 year. Essential.
• csrf_token (sent as servbg_csrf HTTP cookie): CSRF protection token tied to your PHP session. Expires when the browser session ends. Essential.
• PHPSESSID: PHP session identifier for server-side security state. Expires when the browser session ends. Essential.

Browser localStorage keys set by this site (registered accounts only):

• sessionToken: Bearer token used to authenticate API requests without repeated page loads. Cleared on logout.
• userEmail: Cached e-mail address for UI display. Cleared on logout.
• userNickname: Cached nickname for UI display. Cleared on logout.
• claimDismissed_<email>: Records that you have dismissed the leaderboard-claim prompt. Stored locally; not transmitted to the server.

We do not use advertising cookies, third-party tracking cookies, social-media cookies, or analytics cookies that identify you personally.

9. Your Rights (GDPR)

Under the General Data Protection Regulation (EU) 2016/679, you have the following rights:

• Article 15: Right of access: You may request a copy of all personal data we hold about you.
• Article 16: Right to rectification: You may request correction of inaccurate personal data.
• Article 17: Right to erasure ("right to be forgotten"): You may request deletion of your account and all associated personal data. You can delete your account yourself from your profile settings; deletion takes effect immediately. You can also submit a request to [email protected] and we will process it within 30 days.
• Article 18: Right to restriction of processing: You may request that we restrict processing of your data in certain circumstances.
• Article 20: Right to data portability: You may request an export of your personal data in a structured, machine-readable format. You can download an export of your data from your profile settings at any time, or submit a request to [email protected].
• Article 21: Right to object: You may object to processing based on legitimate interests.
• Article 77: Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority (see section 10).

10. Supervisory Authority

As servbg.com is operated from Bulgaria, the competent supervisory authority is:

• Commission for Personal Data Protection (CPDP / КЗЛД)
  Website: https://www.cpdp.bg/
  Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria

You also retain the right to lodge a complaint with the supervisory authority of your EU member state of habitual residence.

11. Contact Us

For privacy-related inquiries or to exercise any of the rights described above, contact us at: [email protected]