Privacy Policy

Last updated: 9 November 2026

CVE Hawk (cvehawk.com) is run by Bobble Solutions Ltd, trading as Bobble Solutions (registered in England and Wales, company no. 10371802, registered office Ossington Chambers, 6-8 Castle Gate, Newark-on-Trent, Nottinghamshire, NG24 1AX). We are the data controller for this website and its emails. Contact: [email protected].

In Short

• If you sign up, we keep your email address and the software you picked, and use them only to send the alerts you asked for.
• We don't sell or share your data, and every email has a one-click unsubscribe link.
• We set cookies only if you agree.

Alert Emails

When you sign up we store your email address, the software, WordPress plugins and themes you picked, whether you want the extra alerts for critical flaws, the page you signed up from, the date and the IP address you signed up from (to stop abuse). Nothing is sent until you click the link in the confirmation email. Lawful basis: your consent, which you can withdraw at any time with the unsubscribe link in every email.

We keep your details while you're subscribed. If you unsubscribe, we keep your address marked as unsubscribed so we never email it again by mistake; email us and we'll delete it completely.

Our alert data comes from Bobble Pulse, our own monitoring service. Your email address is never sent to it: we only ask it which flaws affect a list of software.

Site Check and Browser Extension

"What's my site running?" When you check a site, we read what that site shows to every visitor and keep the result (the site's address and the software found) for 30 days so its link works. Your IP address is passed to Bobble Pulse, which runs the check, only to limit each visitor to five checks an hour; it isn't stored with the result.

The CVE Hawk browser extension does one thing: it runs this check for the site you're on (or the link you right-clicked) and shows the result. The only thing it sends is that site's host name, to cvehawk.com, and only when you press Check or choose the menu item. It doesn't read the pages you visit, track your browsing, or store anything.

Visit Statistics and Cookies

We use Umami, hosted on our own server, to count page views and see which pages are useful. It doesn't use cookies or store your IP address, and it can't identify you. Lawful basis: our legitimate interest in knowing which pages are useful.

Google Analytics. If you agree to cookies (the bar at the bottom of the page), your browser loads Google Analytics, run by Google Ireland Limited, which sets cookies and sends Google the pages you view, your device type and your approximate location. Advertising storage stays off. If you say no, or say nothing, it isn't loaded at all. Lawful basis: your consent, which you can change at any time: Clear my choice.

Server logs. Our server records requests (IP address, date and time, page, browser type) to keep the site secure. We keep these logs for 14 days.

Other Companies Involved

• Amazon Web Services (Amazon SES, London region) sends our emails.
• Fastmail handles replies to our emails.
• Cloudflare sits in front of the website to protect and speed it up.
• Google runs Google Analytics, only if you agree to cookies.

Your Rights

Under UK data protection law you can ask for a copy of the personal data we hold about you, ask us to correct or delete it, or object to how we use it. Email [email protected]. If you're unhappy with our answer you can complain to the Information Commissioner's Office (ico.org.uk).

Changes

We'll update this page if anything changes, with a new date at the top.