In short. We ask for an email address, confirm it with one email, then send the checklist you asked for. The monthly letter and occasional news from us are optional: they start only if you ask for them and confirm, and every email ends with a link to unsubscribe. Resend, a company in the United States, delivers our email and keeps its records there. You can ask us at any time what we hold about you, and have it corrected or deleted.
1. Who keeps your data
H2 Labs is the name we work under. The company responsible for your data, the controller in the words of the GDPR, is:
- Company
- Deep Byte Studios S.R.L., a Romanian limited liability company (societate cu răspundere limitată)
- Registered address
- Nr. 370, 307285 Moșnița Nouă, Timiș, Romania, European Union
- Trade register
- Nr. Reg. Com. J35/1209/2011
- CUI
- 28511161; EU VAT number RO28511161, which the EU’s VIES confirms
- Privacy contact
- privacy@h2.io
We have not appointed a data protection officer. For anything in this notice, write to the privacy contact above.
2. What we collect, and why
Each part of the site asks only for what it needs. For each one, here is what we keep, why, the legal basis, and whether you have to give it.
The checklist
You type a work email address and press “Send me the checklist”. First we send one email with a link to confirm the address. The link works once, for 7 days, and opens a page with one button. When you press it, the checklist arrives by email. That email carries no offers.
We keep:
- the email address;
- the date and time of the request, of your confirmation, and of each email we send for it;
- the IP addresses the request and the confirmation came from;
- the version of the form’s wording, and whether you also ticked the box for the monthly letter.
Why. To send you the checklist. The IP addresses let us notice the form being used to send confirmation emails to people who never asked for them.
Legal basis. Sending you what you asked for (GDPR Article 6(1)(b)). For the IP addresses, our legitimate interest in keeping the form from being misused (Article 6(1)(f)).
Do you have to give it? Only the address: without it we cannot send the checklist.
If someone else typed your address, ignore the email: nothing more arrives, and we delete the address, with everything recorded about it, after 7 days. If you asked only for the checklist, we delete the address and its records 30 days after you confirm.
The monthly letter and news
The letter and news are optional. You ask for them in one of two ways: by ticking the box on the checklist’s form, which starts unticked (the checklist arrives whether you tick it or not), or with the letter’s own form, which has no box because asking for the letter is all it does; it sends the checklist first. Either way, the button that confirms your address starts them. Without that press within 7 days, nothing is sent.
For the letter and news we keep your email address, the record of your consent (section 3), the date of each email sent to you, and the date you unsubscribe.
Why. To send you one email a month (what attackers used that month, one thing worth checking, and a short line on the work we do, in case it helps) and, now and then, news from H2 Labs: a new checklist, tool or service of ours. The letter’s page shows what an issue holds. Consents given under an earlier version of the wording (v2026-11-05 or v2026-11-04) cover the monthly letter only, so those addresses receive no news.
Legal basis. Your consent (GDPR Article 6(1)(a), and Article 12 of Romanian Law 506/2004, which requires prior consent for commercial email). You can withdraw it at any time, from the link in any of our emails; one click stops the letter and the news together. Withdrawing stops them from that moment; emails sent before it remain lawful.
Do you have to give it? No. Nothing else on the site depends on it.
The contact form
The contact form asks for your name, work email and company and, if you choose, your role, the size of your organisation, what you need and a message. With them we keep the time you sent it, the IP address it came from, and where the conversation stands.
Why. To answer you, and to talk about working together if that is what you asked.
Legal basis. Replying to your request and taking the steps you ask for before any contract (GDPR Article 6(1)(b)). For a question about something else, our legitimate interest in answering the people who write to us (Article 6(1)(f)).
Do you have to give it? We need a name, an email address and a company to reply. Everything else is optional.
Each request reaches us by email, sent through Resend, and that email includes your IP address. Resend therefore holds a copy of it too (section 4).
A view from outside. If you ask for what the internet sees of you, we look up the domain you name in public sources only (public DNS, certificate logs, public scan databases and CISA’s catalogue) and send the report to an address at that domain. We keep the report with your request, for as long as the request (section 6).
Keeping out abuse
Each form keeps the IP address and time of every submission for at least an hour, to limit how many one address can send; for an IPv6 address the sign-up keeps only the network it belongs to. The sign-up deletes them within 10 minutes after that hour, and the contact form when it is next used. The web server also keeps a security log of requests that look like probing or that it refuses: the IP address, the time, the page asked for and the site name. That log has a fixed size: once it is full, the oldest entries are deleted. An address it refuses stays on its list for a day after it was last caught probing.
Legal basis. Our legitimate interest in keeping the site available and its forms free of abuse (GDPR Article 6(1)(f)). You can object to it (section 7).
3. The record of your consent
The law asks us to be able to show that you agreed to the letter and news (GDPR Article 7(1)). So when you send the checklist’s form with the box ticked, or the letter’s own form, and again when you press the confirmation button, we record:
- the date and time of each;
- the IP address each came from;
- the version of the wording you agreed to:
v2026-11-05.2for the checklist’s box andv2026-11-05.2-letterfor the letter’s own form, both under this notice’s version.
The wording recorded under v2026-11-05.2, beside the box:
Also send me the monthly letter and occasional news from H2 Labs: what attackers used each month, one thing worth checking, and now and then a new checklist, tool or service of ours. Every email has a one-click unsubscribe.
And under v2026-11-05.2-letter, beside the letter’s own button, “Send me the letter”:
The monthly letter and occasional news from H2 Labs: what attackers used each month, one thing worth checking, and now and then a new checklist, tool or service of ours. The checklist comes first. We email a link to confirm the address, and every email has a one-click unsubscribe.
The earlier versions, v2026-11-04 and v2026-11-05, read:
Also send me the monthly letter: what attackers used that month, and one thing worth checking. One email a month from H2 Labs, with a one-click unsubscribe in every letter.
We keep this record while you receive the letter, and for 3 years after you unsubscribe, the general limitation period for claims under Romanian law (Civil Code Article 2517). Then we delete it. The legal basis is that duty to show consent, and our legitimate interest in answering a claim (GDPR Article 6(1)(c) and (f)).
When you unsubscribe, or ask us to erase your data, we delete your email address at once. The consent record stays for the same 3 years, with the address replaced by a one-way code made from it with a secret key. It points to your address again only if that address is named to us, for example in a claim.
4. Who handles it for us
Resend (Plus Five Five, Inc., San Francisco, United States) sends our email: the confirmation, the checklist, the monthly letter, and the contact requests that reach us. To send a message, Resend receives the recipient’s address and the message itself.
Resend stores our account’s data, including its email logs and metadata, in the United States, whichever sending region we choose. It works for us under its Data Processing Addendum, which binds it to our instructions. Resend uses other companies to run its service and publishes its list of sub-processors.
The server that runs h2.io holds the sign-up and contact records in the site’s own database. It is our own server, in Romania. Visitors reach it through a relay server we rent from Hetzner Online GmbH, in Helsinki, Finland; what you send passes through the relay and is stored only on our server.
Our mailbox, where contact requests and mail to our h2.io addresses arrive, is hosted by Proton AG in Switzerland, whose SimpleLogin service forwards those addresses to it. The European Commission recognises Switzerland as protecting personal data to the standard of EU law.
Apart from these, and the companies Resend uses to run its service, nobody receives your data. We do not sell it, and we hand it to an authority only when the law obliges us to.
5. Transfers outside the EEA
Because Resend keeps our account’s data in the United States, your email address, the emails we send you, their delivery records and the contact requests that reach us through it are stored there. The United States is outside the European Economic Area.
The transfer rests on the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914, module two, controller to processor), which Resend’s Data Processing Addendum incorporates. The clauses’ text is in that decision; ask us for a copy of the agreement as it applies to us.
6. How long we keep it
No one can promise that stored data is never exposed. Keeping less of it, for less time, limits what could be exposed. So each record is kept only as long as its purpose needs, then deleted.
| Record | Kept for |
|---|---|
| An address you have not confirmed | 7 days after your last request. The confirmation link works for 7 days; then we delete the address and everything recorded about it. |
| An address that asked only for the checklist | 30 days after you confirm it: time to answer a question about the delivery and to notice misuse of the form. |
| The address of someone on the letter and news | Until you unsubscribe. Then we delete it at once. |
| The record of your consent | 3 years after you unsubscribe, the general limitation period for claims in Romania. |
| A contact form request, and a view-from-outside report sent in answer to one | 3 years after you send it, so a conversation can pick up where it stopped. |
| IP addresses for the forms’ limits | At least 1 hour. The sign-up deletes them within 10 minutes after that, the contact form within 6 hours. |
| The web server’s security log | Up to a fixed size. Once it is full, the oldest entries are deleted. A refused address stays on its list for a day after it was last caught probing. |
| Resend’s copies of our emails | 30 days: Resend keeps each email it sends for us, with its delivery record, for 30 days on our plan, then deletes it. If we close our account, Resend deletes its data within 90 days. |
The sign-up checks its records every 10 minutes and deletes each one once its period ends. The contact form clears the IP addresses for its limit when someone next uses it, so while it goes unused they can stay longer than an hour.
7. Your rights
Under the GDPR you can ask us to:
- show you the data we hold about you, and give you a copy (access);
- correct it where it is wrong (rectification);
- delete it (erasure);
- pause its use while a question about it is settled (restriction);
- send the data you gave us to you or to someone else, in a common machine-readable format (portability).
You can also object to any use that rests on our legitimate interest, and withdraw your consent to the letter at any time. The law sets limits on some of these rights: after erasure, for example, we keep the record of your consent for 3 years, as section 3 explains.
You can object to the letter at any time. It is free, needs no reason, and the letter stops at once. The unsubscribe link at the foot of every letter does it: it opens a page with one button.
8. How to use them
- To stop the letter, use the unsubscribe link at the foot of any letter and press the button on the page it opens. If your mail app shows its own Unsubscribe button for the letter, that works too. Either way it takes effect at once.
- To delete your address, unsubscribe the same way: it stops all email and deletes the address at once. Only the record of your consent stays, under a code, as section 3 explains. If you asked only for the checklist, write to us as below; if you do not, we delete the address 30 days after you confirm it.
- For anything else, write to privacy@h2.io from the address concerned, or use the contact form.
We answer within one month, free of charge. To make sure we give data only to the person it belongs to, we may ask you to confirm a request from the email address it concerns.
9. Complaints
If you think we handle your data wrongly, tell us first if you can, so we can put it right. You can also complain to Romania’s National Supervisory Authority for Personal Data Processing (ANSPDCP), or to the authority in the EEA country where you live or work, or where you think the law was broken.
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal
B-dul G-ral. Gheorghe Magheru 28–30
Sector 1, cod poștal 010336
București, România
anspdcp@dataprotection.ro
www.dataprotection.ro
The authority takes complaints through its complaints page.
10. What we do not do
- We do not track whether you open our emails or click their links.
- We make no automated decisions about you and build no profile of you.
- We do not sell your data or share it with advertisers.
- The site loads no analytics, advertising or tracking scripts, and serves its fonts itself.
On your own device. Your browser remembers your choice of light or dark theme. After you send the contact form, it also keeps your name, email address, company, the need you chose, a reference for your request and when you sent it, so the contact page can show the request again when you return. Both stay in your browser; clearing this site’s data there removes them.
11. Changes to this notice
This is version v2026-11-05.2, last updated on . When we change the notice, the version and the date here change with it. We keep every earlier version and send any of them on request, since each consent record names the version it was given under. If a change affects the letter, we tell subscribers in a letter before it applies.