How we handle the information you send us.

Last updated 2026-05-20

This notice explains how Unhacked (operated by Korabay Ltd, an Ontario corporation) handles information you submit when you contact us or engage us for a WordPress incident response.

What we collect

When you contact us by email, we receive whatever you choose to include in your message. This typically covers:

• Your name and email address
• The URL of the affected website
• Symptoms, warnings, or behavior you have observed
• When the issue started and any earlier remediation attempts

During an engagement, we collect technical information necessary to perform the remediation. This may include hosting provider details, access credentials you provide to us, files retrieved from your site, server logs, and the contents of WordPress core, plugins, themes, uploads, and the database.

When you pay through our Stripe Payment Links, Stripe collects your payment details directly. We do not see or store your card information. We receive transaction metadata (amount, email address, transaction reference) so we can match the payment to your engagement.

How we use it

• To respond to your inquiry and scope the work
• To perform the remediation engagement you have purchased
• To deliver the written remediation report
• To meet legal, accounting, and tax obligations of Korabay Ltd

We do not use the information you send us for marketing or send promotional messages.

How we share it

We do not sell or rent any information you send us.

We rely on a small set of service providers to operate the service:

• Stripe for payment processing
• Zoho for email
• Cloudflare for DNS and edge delivery
• Our hosting provider for the website itself

We share information with these providers only as needed to deliver the service. We may also share information where required by law, court order, or to respond to a regulatory request.

How long we keep it

• Email correspondence is retained for up to 24 months for support and dispute reference.
• Engagement evidence (preserved snapshots, copies of malicious files, scan output) is retained for up to 12 months unless you ask us to delete it sooner.
• Invoices, receipts, and other accounting records are retained for the period required by Canadian law (currently six years from the end of the relevant tax year).

Your rights

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and comparable laws in other jurisdictions (including the UK GDPR and EU GDPR where applicable), you have rights to access, correct, or request deletion of your personal information, to withdraw consent for further processing, and to lodge a complaint with the Office of the Privacy Commissioner of Canada or your local supervisory authority.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

Security

Engagement materials are stored encrypted at rest on infrastructure we control. Access is limited to the specialist handling your case. We are not a SOC and we do not provide ongoing monitoring; once your engagement closes and the retention period ends, materials are deleted.

Contact

Unhacked is operated by Korabay Ltd, a corporation incorporated in Ontario, Canada. For privacy questions, contact [email protected].