RootBounty is not a registered company yet. For now it is a website run by its founder as an individual. When the company is incorporated, this document will be updated with its legal name, tax ID and registered office, and you will be asked to accept the new version. Until then, the rights and obligations described here are those of the person who runs RootBounty.
This agreement is between Pau Valls Peleteiro (“RootBounty”) and the person signing it (“the researcher”). It completes the terms of use and applies to everything the researcher does on RootBounty. Each program's scope and guidelines also bind the researcher; where they are stricter than this agreement, they prevail.
1. Eligibility
The researcher declares that they:
- are of legal age and have the capacity to sign this agreement;
- are not an employee, contractor or relative living with an employee of a company whose program they test, nor were in the last 6 months, unless that company allows it in writing;
- are not subject to sanctions that forbid receiving payments, and are not resident in a country to which payments are prohibited;
- act in their own name and not on behalf of someone else without declaring it.
2. Rules of engagement
The researcher will:
- test only the assets listed in scope, in the ways the program's guidelines allow, and stop as soon as the issue is proven;
- use only their own accounts, or test accounts the program provides;
- not access, copy, modify or delete data of other people beyond what is strictly needed to prove the issue; if they come across personal data they stop, do not keep it and say so in the report;
- not carry out denial of service, social engineering, phishing, physical attacks or anything that degrades the service for others;
- not use automated tools in a way or at a rate the guidelines forbid;
- report each issue through RootBounty, with enough detail to reproduce it, and not report it to the company through other channels in a way that avoids the program.
3. Confidentiality and disclosure
Everything about a report — the issue, the company's systems, its data and the conversation — is confidential. The researcher will not disclose it to anyone, except to the people who sign the report with them, until the company publishes it or both parties agree to publish it under the disclosure policy. This obligation continues after the account is closed.
4. No extortion
The researcher will never make the delivery, deletion or non-publication of a finding conditional on a payment or any other benefit outside the program, nor threaten the company in any way. Doing so ends this agreement immediately and may be reported to the authorities.
5. Safe harbor
Companies commit, in their agreement, not to take legal action against research carried out in good faith within the scope and guidelines of their program, and to state that it is authorised. This protection does not cover actions outside the scope, against the guidelines or against the law, and it cannot bind third parties that are not part of the program. RootBounty will support the researcher where it can if a dispute arises from research done in good faith.
6. Rights over reports
The researcher keeps the authorship of their reports. They grant the company running the program a free, non-exclusive, perpetual and worldwide licence to use, reproduce and adapt the report as needed to understand, fix and prevent the issue, and grant RootBounty the licence it needs to run the platform. The researcher declares that the report is their own work, or that of the people who sign it, and does not infringe anyone's rights.
7. Bounties
- A bounty is due only when the company awards it under its program for a valid, in-scope issue. The company decides on validity, severity and amount according to its published rules; RootBounty may mediate but does not decide for it.
- Duplicates are rewarded only to the first valid report, unless the program says otherwise.
- When several researchers sign a report, the bounty and the reputation points are split by the shares they agreed on the platform, and the company and RootBounty pay accordingly.
- Bounties are paid by RootBounty on behalf of the company to the payout details the researcher gives, or, if the researcher allows it, directly by the company to the researcher's bank account. The researcher must keep their details correct; a payment sent to the details they gave is valid.
- The researcher confirms on the platform whether a direct transfer arrived. They must not confirm a payment that did not arrive.
8. Taxes
Bounties are income. The researcher is responsible for declaring them and paying the taxes that apply to them where they are tax resident. RootBounty or the company may ask for the tax details the law requires, apply withholdings where the law obliges them, and report the payments to the tax authorities when the law requires it, including under the rules for digital platform operators (Council Directive (EU) 2021/514, “DAC7”).
9. Personal data
Each party processes the other's personal data only to perform this agreement, under the privacy policy. Personal data of third parties that the researcher sees while testing is handled as section 2 says.
10. Duration and termination
This agreement applies from its signature until the researcher's account is closed. Either party may end it at any time; RootBounty may end it immediately if the researcher breaks it. Sections 3, 4, 6, 8 and 9 survive its end. Bounties already awarded for valid reports are still paid.
11. Electronic signature
The parties agree to sign this agreement electronically on the platform, by drawing a signature or uploading a signed copy. The signature, together with the date, the IP address, the browser and the fingerprint of the exact text signed, is recorded as evidence and is valid as an electronic signature under Regulation (EU) No 910/2014 (eIDAS). The researcher can see what they signed and when in Settings → Agreements.
12. Law and jurisdiction
Spanish law applies. Disputes go to the courts of the owner's domicile, except that a researcher acting as a consumer keeps the right to go to the courts of their own domicile.
Parties
RootBounty:
- Owner: Pau Valls Peleteiro
- Legal form: an individual; RootBounty is not a registered company yet
- Contact: pauvalls@rootbounty.com
The researcher: the person identified by the signature below.