This page explains how ZVM Labs handles privacy, data, external services, and content. It is written in plain language for a personal technical blog, while following the structure of a basic privacy notice: who runs the site, what data may be processed, why it may be processed, on what basis, and how you can contact ZVM Labs about your data.
This is not legal advice. If you need a formal legal review for an organization, regulatory audit, or contractual compliance, consult a qualified legal professional.
Short Version
- ZVM Labs does not require user accounts.
- The site does not provide payments, private dashboards, or comments.
- The feedback form does not store messages on the website server: it prepares an email in your email client.
- If you send an email, you voluntarily provide your name, reply address, and message content.
- The site uses GoatCounter for privacy-friendly article view counts and may use browser technical data, localStorage, or server logs for functionality and security.
- ZVM Labs does not sell personal data and does not share it for cross-context behavioral advertising.
- Blog content is educational and is not legal, financial, or professional security advice.
Legal Framework and References
ZVM Labs is a personal blog and does not claim formal certification or full regulatory compliance for every jurisdiction. However, this policy is prepared with reference to general principles from:
- Law of Ukraine “On Personal Data Protection” No. 2297-VI - the main Ukrainian law on personal data protection.
- California Consumer Privacy Act / CPRA - a reference for California resident rights where applicable.
- Regulation (EU) 2016/679, GDPR - the EU data protection regulation, where applicable.
- Directive 2002/58/EC, ePrivacy Directive - privacy rules for electronic communications, including cookies and similar technologies.
- Article 8 of the Charter of Fundamental Rights of the European Union - the right to personal data protection.
- Council of Europe Convention 108 / 108+ - an international reference for automated processing of personal data.
- Regulation (EU) 2024/1689, EU Artificial Intelligence Act - the EU legal framework for AI systems; used here as a reference point for responsible AI-related content.
- NIST AI Risk Management Framework - a voluntary AI risk-management reference.
- ISO/IEC 29147:2018 Vulnerability disclosure - a reference for responsible vulnerability reporting.
These links are provided as professional references. Whether a specific document applies depends on jurisdiction, data type, user location, hosting setup, and the specific processing scenario.
Who Runs This Site
ZVM Labs is a personal blog by Vasyl Zozulia.
For privacy, content, or deletion requests, contact:
For email communication with ZVM Labs, the privacy contact point is Vasyl Zozulia via [email protected].
Privacy at a Glance
| Question | Answer |
|---|---|
| Who is responsible for the site | Vasyl Zozulia, ZVM Labs |
| Privacy contact | [email protected] |
| User accounts | No |
| Payments on the site | No, public transfer details are not currently published |
| Comments | No |
| Sale of personal data | No |
| Main data | email messages, technical logs, localStorage, aggregated analytics |
| Main purposes | replying to requests, site operation, security, site-structure improvement |
| User rights | access, correction, deletion, restriction, objection, or other rights where applicable |
This table does not replace the full policy, but it helps readers quickly understand the main points.
Purposes and Legal Bases
Where privacy laws such as the GDPR or Ukrainian personal data protection law apply, processing may have the following purposes and legal bases:
| Scenario | Purpose | Possible basis |
|---|---|---|
| Replying to email or feedback | Communication, answering questions, clarifying ideas | User consent or legitimate interest in responding |
| Hosting technical logs | Site operation, troubleshooting, security | Legitimate interest in site availability and security |
| localStorage for theme or menu state | Interface convenience | Technical necessity or legitimate interest |
| GoatCounter analytics | Aggregated article view statistics and site structure improvement | Legitimate interest in understanding site use without advertising profiling |
| Spam and abuse prevention | Communication and site security | Legitimate interest |
| Legal request handling | Responding to a lawful authority request | Legal obligation, where applicable |
ZVM Labs does not sell personal data, does not share it for cross-context behavioral advertising under California privacy laws, and does not use it for advertising profiling.
Retention
Data is kept no longer than necessary for the relevant purpose:
- emails - for the time needed to reply, preserve communication context, or protect against spam;
- technical logs - according to hosting policies and security needs;
- aggregated analytics data - according to GoatCounter settings and policies;
- localStorage - until you clear browser data or change browser settings;
- security report records - as long as needed to verify, fix, and document the issue.
If a specific message or request is no longer needed, you may ask for its deletion.
What Data May Be Processed
Data You Voluntarily Send
If you contact ZVM Labs by email, through the Feedback page, or by sending an email newsletter request, the following data may be processed:
- name or preferred way to address you, if provided;
- reply email address;
- message topic;
- preferred newsletter format or interests, if provided;
- message content;
- any other information you choose to include.
Do not send passwords, private keys, access tokens, identity documents, employer-confidential information, or third-party personal data unless you have a lawful basis to do so.
The newsletter page uses mailto: and does not store emails on the website server. If you send a subscription request, your email may be used to send the requested ZVM Labs updates. You can unsubscribe by emailing [email protected].
Technical Data
Like most websites, ZVM Labs may indirectly involve technical data through hosting, browsers, or system logs:
- IP address;
- browser User-Agent;
- request date and time;
- requested URL;
- server response code;
- basic access error information.
This data is used for site operation, troubleshooting, and basic security.
Cookies and localStorage
ZVM Labs does not use cookies for advertising or tracking profiles.
The site may use browser localStorage for technical convenience:
- saving the selected visual theme;
- saving menu scroll position;
- supporting interface behavior.
This information stays in your browser and is not intended to identify you personally.
More details about the current cookies, localStorage, GoatCounter, and browser controls are available on the separate Cookies and Local Storage page.
Analytics
ZVM Labs uses GoatCounter as a privacy-friendly analytics provider for article view counts. In the site configuration, the counter is enabled only for publication pages in the posts section.
GoatCounter is used for aggregated statistics, not advertising, remarketing, or behavioral profiling. According to GoatCounter documentation, the service does not store IP addresses, the full User-Agent, or a tracker ID. During technical request handling, the analytics provider may receive request metadata such as page URL, referrer, browser-related data, or shortened/derived information needed to count views.
The GoatCounter script loads from https://gc.zgo.at/count.js, and statistics are associated with https://vasiazozulia.goatcounter.com.
If other analytics or advertising technologies are added in the future, this page should be updated to explain:
- which service is used;
- what data is collected;
- why it is collected;
- how tracking can be limited or disabled.
External Services and Links
The site links to third-party platforms, including GitHub, LinkedIn, Discord, X, Bluesky, Mastodon, TryHackMe, HackTheBox, pwn.college, Telegram, and Facebook. GoatCounter may also be used for analytics.
When you open an external site, that platform’s privacy and security rules apply. ZVM Labs does not control how third-party services process your data.
International Data Transfers
Because email, hosting, social platforms, and external services may rely on infrastructure in different countries, your data may technically be processed outside your country of residence.
ZVM Labs does not organize a separate commercial transfer of personal data to third parties, but email providers, hosting providers, and external platforms may conduct their own international processing under their own policies.
Feedback and Email
The Feedback page prepares an email through mailto:. This means:
- the message is not stored in a ZVM Labs database;
- sending happens through your email client or email provider;
- after sending, the message is stored in the sender’s and recipient’s email systems.
Emails may be retained as long as needed to reply, discuss ideas, keep agreed context, or protect against spam and abuse. If you want a message deleted, contact [email protected].
Content Policy
ZVM Labs publishes educational material about cybersecurity, programming, systems and network administration, AI workflows, GRC, risk management, and technical management.
Content principles:
- explain context and scope;
- show evidence where appropriate;
- do not encourage illegal activity;
- do not publish private data, secrets, tokens, or access credentials;
- do not present learning notes as professional consulting;
- separate facts, assumptions, and personal conclusions.
Cybersecurity materials are intended for learning, defense, risk analysis, and responsible practice.
Legal, advertising, affiliate, copyright, user submissions, and disclosure rules are described separately on the Legal, Ethics, and Disclosures page.
AI Policy
AI tools may be used for learning, note structuring, text editing, idea analysis, or draft preparation.
ZVM Labs principle: AI may assist, but it does not replace author responsibility. Technical claims, practical conclusions, and recommendations should be checked before publication.
The separate AI Use Policy explains boundaries, verification, AI-assistance disclosure, data protection, and professional references, including the EU AI Act and NIST AI RMF.
Accessibility and Privacy
Accessibility modes may store technical preferences in your browser through localStorage, such as selected theme or vision mode. This data is used for interface convenience, stays in the browser, and is not intended to identify a person.
More details are available in Accessibility.
Security Policy
If you find a technical issue on the site, report it to [email protected]. Full scope, allowed testing, prohibited activity, reporting process, and site security model are described on the Security page.
Your Requests
You may contact ZVM Labs to request:
- clarification about data you sent by email;
- correction of contact information;
- deletion of a previous message;
- withdrawal of consent for further communication;
- review of a specific publication or mention;
- restriction of further communication;
- objection to further processing, where applicable.
Contact: [email protected]
Depending on applicable law, you may also have rights of access, correction, deletion, restriction, objection, and data portability.
The practical request process, recommended email subject, possible verification, and related limits are described on the Privacy Rights page.
If you are a California resident and California privacy laws apply to a specific interaction, you may have the right to know which categories of personal information are processed, request deletion or correction, limit the use of sensitive personal information, and opt out of sale/share. ZVM Labs does not sell personal data and does not share it for cross-context behavioral advertising.
Children
ZVM Labs is not directed at children and is not intended to knowingly collect children’s data, including data from children under 13 in the United States under COPPA.
Changes to This Page
This policy may be updated if the site functionality, communication methods, analytics, hosting, or content policy changes.
Last updated: June 18, 2026.
