Last updated 24 September 2026
Privacy & Cookie Policy
This policy explains what personal data CVSS Guru (https://cvss.guru) processes, why, and what your rights are under the EU General Data Protection Regulation (GDPR). The calculator, converter, CVE search and documentation work without an account.
Who is responsible
The data controller is CVSS Guru. For any privacy question or request, write to info@cvss.guru.
What we process and why
- Account data (only if you register): username, email address, password (stored as a bcrypt hash, never in clear), sign-up and last-login dates, your API key (stored only as a SHA-256 hash plus its first 8 characters), whether and when you confirmed your email address, and a monthly count of your API calls. Legal basis: performance of the service you asked for (Art. 6(1)(b)). Kept until you delete your account from your profile page, which removes all of it immediately. Accounts whose email address is never confirmed are deleted automatically after 7 days.
- Service emails, sent through our email provider: the link to confirm your address (a one-time token valid for 48 hours), password reset links (valid for 30 minutes) and a confirmation when you delete your account. No newsletters or marketing. Legal basis: Art. 6(1)(b).
- AI Scorer: the vulnerability description you submit is sent to OpenRouter, which forwards it to the selected AI model provider, to compute the score. The description and the result are stored for up to 90 days (linked to your account if you are signed in) to investigate abuse and improve the prompt, then deleted automatically. Please do not include confidential or personal information in descriptions. Legal basis: Art. 6(1)(b) and our legitimate interest in preventing abuse (Art. 6(1)(f)).
- Abuse protection: your IP address (and, for failed logins, the username tried) is kept for at most 24 hours to limit repeated login, sign-up and AI requests. The sign-in, sign-up, password reset and AI Scorer forms use Google reCAPTCHA v3, which analyses technical information about your browser and interaction. Legal basis: legitimate interest in protecting the service (Art. 6(1)(f)).
- CVE Search: the CVE identifier you look up is requested from the NIST National Vulnerability Database. No personal data is included in that request.
- Usage statistics, only if you accept analytics cookies: Google Analytics 4 collects pages visited, the features you use (e.g. calculator version, converter) and approximate location derived from your IP address, which Google does not store. Advertising features are disabled. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time.
- Technical logs: our application logs record requested pages, status codes and timings, without IP addresses; our hosting infrastructure may keep standard access logs for a short time for security and troubleshooting.
We do not sell personal data and we do not use it for advertising.
Cookies and local storage
| Name | Purpose | Duration | Type |
|---|---|---|---|
cvss_session | Keeps you signed in | 30 days | Necessary |
ai_scorer_used | Limits the free AI analysis for visitors without an account | 1 year | Necessary |
theme, cve_recent | Light/dark theme and your recent CVE searches (stored only in your browser) | Until cleared | Preferences |
cvssguru-consent | Remembers your analytics choice (stored only in your browser) | Until cleared | Necessary |
_ga, _ga_* | Google Analytics statistics | Up to 2 years | Analytics (consent) |
| reCAPTCHA | Bot protection on the sign-in, sign-up, password reset and AI Scorer pages | Session / set by Google | Necessary for that feature |
You can change your analytics choice at any time: cookie settings.
Who receives data
Our hosting provider (servers and database), our email provider (service emails), OpenRouter and the AI model provider (AI Scorer descriptions), and Google (Analytics, only with consent, and reCAPTCHA). Some of these providers may process data outside the European Economic Area; in that case the transfer relies on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
Your rights
You can ask to access, correct, delete or export your data, object to or restrict its processing, and withdraw consent at any time, without affecting processing done before. You can delete your account yourself from the profile page. For anything else write to info@cvss.guru. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in your country of residence.
Changes
We will update this page when the way we process data changes; the date at the top shows the latest version.