Privacy policy

1. Who is responsible

Rootpanther Ltd is responsible for your personal data when you use rootpanther.com, app.rootpanther.com and the labs. Under data protection law we are the controller.

Write to us about privacy at privacy@rootpanther.com, or at registered office address. We follow the UK GDPR and the Data Protection Act 2018, and the EU GDPR when it applies to you. We have not appointed an EU representative.

2. What we collect

Your account

• Your name, email address, handle and country, whether your email address is verified, and when you accepted our terms and which version.
• If you sign in with Google, Microsoft or GitHub: your account ID there, and the name and email address they share with us.
• Your settings: default Onyx help level, terminal font and theme, which emails you want, how your labs connect and close, and any public SSH key you add.

Sign-in and security

• Your password, stored only as a strong one-way hash. We never know your password.
• Your two-factor secret, stored encrypted, and your recovery codes, stored only as hashes.
• For each signed-in device: the device type and browser, its IP address, an approximate city and country worked out from that address, and when it signed in and was last active.
• A record of changes to your account security, such as a new password, two-factor turned on or off, providers linked or removed, and confirmations of who you are, with the IP address and device used.
• Counts of failed sign-in attempts against an email address, so we can stop password guessing.

Your labs and progress

• The sessions you run: scenario, start and end times, how you connected, the help level you used and the most help you used, and whether the run stayed exam clean.
• The flags you capture and when. Every flag you submit is checked and recorded with its result. We keep a keyed fingerprint of what you typed, never the text itself.
• What you discover in a lab, such as open ports, operating systems and the routes between machines.
• Your progress on My Path: attempts, best times and your tier.
• Records of connections to and from your lab, kept to protect the platform and other learners.

Your work

• Your notes, evidence, reports and debriefs.
• Text and screenshots you put in the paste pad, to share with Onyx.
• Your conversations with Onyx (section 4).

Billing and support

• Your plan, its status and billing period, invoices, billing country and address, and your card's brand and last four digits. Card numbers go straight to Stripe and never reach us.
• Messages and attachments you send to support or billing, and any diagnostics you choose to attach.

The website

rootpanther.com sets no cookies, runs no analytics and loads nothing from other companies. Our hosting provider may keep short-lived access logs, such as IP address, page and time, to protect the site.

3. Why we use it

Data protection law asks us to name a lawful basis for each use. Ours are:

• To provide what you signed up for (contract): running your account, your labs, Onyx and your progress; taking payments; answering support and billing requests; and sending the emails you need, such as security notices, receipts and lab expiry warnings.
• To keep Rootpanther safe and working well (legitimate interests): protecting accounts and stopping password guessing; keeping the platform and other learners safe; enforcing our terms and acceptable use policy; and improving Rootpanther using totals and trends of how it is used.
• Because the law requires it (legal obligation): keeping billing records for tax, and answering lawful requests.
• Because you asked for it (consent): optional emails, such as news about new scenarios. These are off unless you turn them on.

Our legitimate interests are running a secure training service, protecting our content and improving the product. We have weighed them against your rights. You can withdraw consent to optional emails at any time in Settings.

Your tier on My Path is worked out by rules that look at your lab results and the help you used. It has no legal or similarly significant effect on you, and you can ask us to review it.

4. Onyx and AI

When you ask Onyx for help, we send your question, the recent conversation and context from your lab to Anthropic, which provides the AI models behind Onyx. The context includes the scenario, your help level and any output you choose to share through the paste pad or tether. Anthropic processes it to produce the answer, as our processor.

• Under Anthropic's commercial terms, data sent through its API is not used to train its models.
• We do not use your notes, reports, lab activity or Onyx conversations to train AI models.
• We keep your Onyx conversations on your account, so you can read them again and so your debriefs can refer to them.
• Tether shares one terminal with Onyx, read-only, and you can pause or stop it at any time.
• To stop Onyx being used against systems outside Rootpanther, we automatically check what you share with it against the machines in your lab. When something falls outside your lab, Onyx declines and we record it, and our staff may review those conversations. This is to enforce our acceptable use policy, which is in our legitimate interests and yours.

5. Who can see it

• Our providers. Companies that run parts of Rootpanther for us, such as hosting and email, process data on our instructions. The subprocessors page lists them.
• Stripe. Stripe acts as the merchant of record for your payments and handles the payment data it collects under its own privacy policy.
• Sign-in providers. Google, Microsoft or GitHub, only if you choose to sign in with them.
• Your team. If you are on a Team plan, the person who manages the team can see your name, email address, tier, labs and reports.
• Our staff. People who help you with support can see your account. They use their own accounts with two-factor sign-in, and what they do is recorded.
• Others when required. Professional advisers, the police or a regulator when the law requires it, or a company that takes over Rootpanther, which would have to keep to this policy.

We never sell your personal data.

6. Where it is stored

Rootpanther runs on Microsoft Azure in the Netherlands (the West Europe region). Some providers, such as Anthropic and Stripe, process data in other countries, including the United States. When data leaves the UK or the European Economic Area, we rely on adequacy decisions or on standard contractual clauses with the UK addendum.

7. How long we keep it

• Account, progress, lab history and your work: while your account is open.
• After you close your account: we delete or anonymise your personal data within 30 days, except for the records below.
• Billing records: 6 years, because tax law requires it.
• Security records such as sign-ins and security changes: 2 years.
• Paste pad text and screenshots: 30 days.
• Support requests: 2 years after they close.
• Expired sign-in sessions: 90 days.

8. How we protect it

• All traffic to Rootpanther is encrypted. Our database has no public address and is reachable only from our own network.
• Passwords and recovery codes are stored only as one-way hashes, two-factor secrets are encrypted, and flags are kept as keyed digests, never as text.
• Changes to how your account is protected need a fresh confirmation and trigger an email to you.
• Each lab runs on its own network, separate from other learners and from our systems.
• Staff use their own accounts with two-factor sign-in, and what they do is recorded.

9. Your rights

You can ask us to:

• give you a copy of your personal data, including in a format you can take elsewhere;
• correct data that is wrong;
• delete your data, or restrict how we use it;
• stop using it where we rely on legitimate interests, unless we have strong reasons to continue.

You can update your profile and settings, turn off optional emails and sign out other devices yourself in Settings. For a copy of your data or to delete your account, email privacy@rootpanther.com until these are available in Settings. We reply within one month and may ask you to confirm it is you.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office in the UK at ico.org.uk, or to the data protection authority where you live.

10. Age, changes and contact

Rootpanther is for people aged 18 and over. We do not knowingly collect data from anyone younger.

Cookies are covered by our cookie notice. If we change this policy in a way that affects you, we email you before the change takes effect. The date at the top of the page shows the last change.

Questions about privacy go to privacy@rootpanther.com.