Privacy Policy

Last updated Nov 6, 2026.

This site is operated by Redbit S.r.l.s., Viale della Grande Muraglia 494, 00144 Roma, Italy (VAT IT15237911001) ("we", "us"). We are the data controller. BreachCostLab serves a US audience but is operated from the EU, so we apply the GDPR to all visitors regardless of location.

What we collect

The calculators run entirely in your browser. The figures you enter — records, turnover, revenue, security posture and any other inputs — are not sent to us or stored on our servers. We collect only standard technical data, analytics data (with your consent where our consent banner appears; by default in the United States, where you can object) and, with your consent, advertising data:

  • Server logs (IP address, user agent, requested URL, timestamp) for security and abuse prevention — legitimate interest.
  • Analytics (e.g. Google Analytics 4) — only after you consent wherever our consent banner appears (every country except the United States); in the United States from your first visit, with the right to object (see "Cookies & consent"). Used in aggregate to understand which calculators and guides are useful.
  • Advertising (e.g. Google AdSense) — only after you consent. Ads may use cookies to limit repetition and measure performance.
  • Contact form — if you write to us, the name, email and message you provide, used solely to reply.

Legal bases

Technical operation and security: legitimate interest (Art. 6(1)(f)). Advertising cookies, and analytics cookies wherever our consent banner appears: your consent (Art. 6(1)(a)), which you can withdraw at any time via "Cookie preferences" in the footer. Analytics in the United States: our legitimate interest in measuring how the site is used (Art. 6(1)(f); the controller is an Italian company), with the right to object at any time (Art. 21). Responding to a contact-form message: our legitimate interest in answering you, or steps taken at your request.

Cookies & consent

We use InMobi Choice (InMobi Technology Services Pte. Ltd., Singapore), a consent management platform certified under IAB TCF v2.4, and Google Consent Mode v2. The consent banner appears in every country except the United States. Until you accept, advertising storage stays denied; where the banner appears, analytics storage stays denied too, so Google Analytics 4 does not run if you reject or make no choice.

In the United States there is no consent banner: Google Analytics 4 is active from your first visit, with Google Signals and ad personalization turned off and IP addresses anonymized. You can object at any time:

  • a Global Privacy Control (GPC) signal from your browser is honored automatically: Google Analytics 4 does not start;
  • on your first visit InMobi opens the "Do Not Process My Personal Information" panel. Object there by opting out of the sale or sharing of personal information or of targeted advertising, or switch off the Google consent for statistics (analytics storage) in its "Google consents" section. "Cookie preferences" in the footer reopens that panel.

Once you object, the _ga cookies are deleted and Google Analytics 4 is no longer loaded on the following pages. See the cookie policy for the categories and how to change your preferences.

Third parties

Analytics and consent-gated advertising (Google) act as independent or joint controllers for the data they collect; see Google's policies. We do not sell personal data. US visitors can exercise "Do Not Sell or Share" in InMobi's "Do Not Process My Personal Information" panel, which opens on the first visit and again via "Cookie preferences" in the footer. In the United States, statistics (Google Analytics 4) are active by default; you can object at any time with Global Privacy Control (GPC) or in that panel (see "Cookies & consent").

Retention

Server logs are kept for a limited period for security, then deleted or anonymized. Contact-form messages are kept only as long as needed to handle your request. Analytics and advertising retention follows the respective provider's settings.

Newsletter (double opt-in)

If you sign up for our newsletter, we process the email address you provide to send you occasional updates about new and updated calculators and guides. The legal basis is your consent (Art. 6(1)(a) GDPR).

We use a double opt-in procedure: after you submit the form we send a confirmation email, and your address is added to the list only after you click the confirmation link. If you never confirm, the request is discarded. We retain the date and time of your sign-up and of your confirmation as proof of consent.

The newsletter is managed with self-hosted software (Listmonk) running on our own infrastructure in the EU. Newsletter emails contain no tracking pixels and no tracked links: we do not record whether messages are opened or which links are clicked. Your email address is not shared with, or sent to, any third party for marketing purposes.

You can withdraw your consent at any time by clicking the unsubscribe link included in every email. This stops all further messages and does not affect the lawfulness of processing carried out before the withdrawal.

Your rights

You have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data, and to lodge a complaint with a supervisory authority. To exercise these rights contact [email protected].