Privacy Notice

1. Scope

This notice applies to Infraveil Corporation's public websites, whitepaper site, portal, hosted dashboard, launcher and agent communications, demonstrations, customer support, commercial communications, and related backend operations services (collectively, the “Services”). It also covers personal information received through customer-selected integrations when Infraveil processes that information to provide the Services.

Customer application code, application databases, process environments, and persistent application files generally remain on infrastructure the customer chooses and controls. Selected operational information is sent to or made available through Infraveil as described below.

A signed order form, data processing agreement, security addendum, or other customer agreement may provide additional or different terms. That agreement controls for the customer relationship to the extent of a conflict.

2. Who we are and our privacy roles

Infraveil Corporation is responsible for the public website, account administration, billing state, product security, commercial communications, and support records described in this notice. For those activities, Infraveil generally determines why and how the information is processed.

When a customer uses Infraveil to operate its own services and submits operational information on behalf of that customer's users, workforce, or business, Infraveil generally acts as the customer's processor or service provider, subject to the applicable customer agreement. The customer remains responsible for its own notices, instructions, legal authority, and use of the Services.

Questions or privacy requests may be sent to [email protected]. Commercial questions may be sent to [email protected].

3. Information we collect

4. Sources of information

• Directly from you or your organization: account registration, orders, support emails, configuration, and information submitted through the portal or dashboard.
• From connected servers and services: launcher and agent communications, health data, operational events, audit records, and other information configured for the Services.
• Automatically from the sites and Services: server logs, security events, browser/device information, privacy preferences, and optional analytics or attribution data.
• From service providers and integrations: payment status, authentication results, integration delivery status, and customer-authorized third-party events.
• From customers: information about their authorized users, personnel, systems, and service activity when Infraveil processes it on the customer's behalf.

5. How we use information and the legal bases we rely on

Provide and administer the Services

We use account, configuration, operational, billing, and integration information to deliver the service requested by the customer, authenticate users and machines, operate the dashboard, process authorized actions, provide support, and administer subscriptions. Where applicable, this processing is necessary to perform a contract or take requested pre-contract steps.

Commercial communications

We use business contact information to respond to inquiries and requests for demos or purchases, administer the customer or commercial relationship, and send necessary service notices. If we send promotional commercial communications, a recipient may opt out by replying to the message or emailing [email protected]. We may still send notices needed to provide or administer the Services.

Protect customers, systems, and the public

We use authentication, network, operational, audit, and security information to detect abuse, investigate incidents, preserve evidence, enforce access and acceptable-use controls, prevent fraud, and maintain service integrity. Where applicable, we rely on our legitimate interests and those of our customers in operating secure and reliable services.

Comply with law and establish legal claims

We may process and preserve information when reasonably necessary to comply with legal, tax, accounting, regulatory, or contractual requirements; respond to lawful process; and establish, exercise, or defend legal claims.

Improve and understand the Services

We may use aggregated service information and optional website analytics to understand performance, reliability, feature use, and site navigation. Optional website analytics and conversion measurement are disabled until the visitor allows them, unless another lawful configuration is provided through an applicable customer service.

Consent

Where consent is required, we rely on it for the specific purpose presented at collection. Consent can be withdrawn through the available privacy control or by contacting us; withdrawal does not affect earlier lawful processing.

6. Customer-controlled infrastructure and service data

Infraveil is a management layer, not the underlying compute host. The customer selects and controls the servers on which its applications run. The customer also controls what applications, users, integrations, logs, routes, and operational events are connected to Infraveil.

The dashboard receives selected information needed to show service health, releases, changes, logs, security events, incidents, approvals, and recovery state. The exact categories, instructions, retention, and export options may depend on the customer's configuration and agreement.

Customers should not place personal information in logs, configuration fields, commands, support messages, or free-text areas unless it is necessary and authorized. Customers are responsible for configuring their applications and logging practices to avoid unnecessary collection.

7. When information is disclosed

We may disclose information only as reasonably necessary for the purposes described in this notice:

• to personnel and contractors who need it to operate, secure, support, or administer the Services;
• to infrastructure, analytics, authentication, communications, support, and payment providers acting for Infraveil;
• to a customer's configured integrations and recipients at that customer's direction;
• if a customer enables or selects an AI or model-provider integration, to that provider, including prompts and operational context the customer chooses to submit;
• to professional advisers, auditors, insurers, or financing parties subject to appropriate confidentiality duties;
• to authorities or other parties when required by law or reasonably necessary to protect rights, safety, service integrity, customers, or the public; and
• in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate safeguards and notice where required.

Customers must review the terms and privacy practices of an AI or model provider before enabling or selecting its integration.

Sale and targeted advertising: Infraveil does not sell personal information for monetary or other valuable consideration and does not share personal information from the Services for cross-context behavioral advertising. The optional public-site measurement described below is used to understand Infraveil's own sites and conversions, not to build advertising profiles for third parties.

8. Browser storage, analytics, and privacy choices

Essential storage may be used to maintain security, sessions, requested functionality, and a visitor's privacy preference. The privacy choice is stored in local browser storage and, on Infraveil domains, in a first-party preference cookie scoped to infraveil.com so the choice is shared between the main site and whitepaper site. Optional measurement can include page title and path, event name, referring campaign parameters, and advertising click identifiers contained in the URL. The public conversion script does not include the page's query string in its event URL, but it may separately preserve recognized attribution parameters in local browser storage.

Optional analytics and conversion measurement are off until a visitor selects “Allow optional analytics.” Selecting “Decline” updates the shared preference, clears Infraveil attribution and conversion markers stored by the current public-site origin, and prevents optional scripts from loading on later main-site or whitepaper pages. A change from allow to decline applies from the next page load and cannot retract information already transmitted.

When a browser sends a Global Privacy Control or enabled Do Not Track signal, the public frontend keeps optional analytics off. Browser settings may also be used to remove local storage. Blocking all storage can affect login sessions or other requested functionality.

9. Retention and deletion

We retain personal information only for as long as reasonably necessary for the purpose collected, including to provide an active account or customer service, preserve security and audit evidence, comply with legal and accounting obligations, resolve disputes, and enforce agreements. The applicable period depends on the data category, customer configuration, contract, sensitivity, legal requirements, and whether the information is stored in active systems, logs, or backups.

• Account and customer records are generally kept for the customer relationship and a reasonable period afterward for administration, security, disputes, and legal obligations.
• Operational logs and telemetry follow the configured product or customer retention. Where a 30-day standard is presented for a specific operational log, it does not automatically apply to billing, audit, security, support, or backup records.
• Support and commercial communications are kept as needed to respond, maintain relationship history, and meet contractual or legal obligations.
• Optional website attribution remains in browser storage until it is replaced, removed through the privacy control, or cleared through browser settings. Server-side measurement follows the operational retention configured for that service.

When retention is no longer justified, information is deleted, de-identified, or isolated from ordinary use, subject to technical backup cycles and lawful preservation requirements.

10. Security

We use administrative, technical, and organizational measures designed to protect information in light of its nature and the service context. Depending on the component, those measures may include authenticated and signed machine communications, access controls, audit receipts, policy controls, token rotation, quarantine or revocation controls, cache purge mechanisms, transport encryption, integrity hashes, and operational monitoring.

No system is completely secure. Customers remain responsible for their hosts, DNS, application code, databases, secrets, credentials, workforce access, devices, and third-party integrations. Suspected security issues should be reported through the contact information below.

11. International processing and transfers

Infraveil is a United States business, and information may be processed in the United States and in other locations where Infraveil, its service providers, or a customer's selected integrations operate. Those locations may have privacy laws different from the individual's home jurisdiction.

Where applicable law requires a transfer mechanism or additional safeguard, the relevant customer agreement must identify the mechanism used for that service. This notice does not by itself establish or replace a required transfer mechanism. Customers should review their agreement for service-specific data-location and transfer terms.

Individuals who are not associated with a customer may email [email protected] to request service-specific information about applicable transfers or safeguards.

12. Privacy rights and requests

Depending on location and relationship with Infraveil, an individual may have rights to request access, confirmation, correction, deletion, restriction, objection, or portability; withdraw consent; opt out of certain sale, sharing, targeted advertising, or profiling; and appeal a denied request. An individual may also complain to an applicable privacy or data-protection authority.

Send a request to [email protected] with “Privacy request” in the subject. Describe the right requested and the account, workspace, or business relationship involved. We may need information reasonably necessary to verify identity and authority. Verification information is used only to process and secure the request.

If applicable law gives you a right to appeal our decision, email [email protected] with “Privacy appeal” in the subject and identify the original request and decision. We will provide a written outcome within the period required by applicable law. If we deny the appeal, you may contact the applicable regulator or state attorney general where the law provides that option.

If Infraveil processes the information only on behalf of a customer, the request may be referred to that customer or handled on the customer's documented instructions. Rights are subject to applicable exceptions, including security, fraud prevention, legal obligations, and the rights of others. We will not discriminate against an individual for exercising an applicable privacy right.

13. Supplemental notice for California residents

This section applies only to the extent the California Consumer Privacy Act applies to Infraveil's processing. It does not create or expand rights beyond applicable law.

This section describes categories of personal information Infraveil may have collected in the preceding 12 months, depending on use of the Services. The detailed table in Section 3 describes the corresponding purposes. Categories may include identifiers; customer records and commercial information; internet or other electronic network activity; professional or employment-related information supplied in a business relationship; inferences limited to service or support context; and sensitive information such as account credentials or the contents of support communications when a person chooses to provide them.

Sources include individuals, customer organizations, connected systems, service providers, integrations, and automatic website or service collection. Categories may be disclosed for business purposes to the recipients described in Section 7. Infraveil does not sell these categories for monetary or other valuable consideration or share them for cross-context behavioral advertising.

California residents may request to know, access, delete, or correct applicable personal information and may exercise applicable opt-out or limitation rights. Infraveil will honor recognized browser privacy signals for optional public-site analytics as described above. Requests may be submitted through the contact method in Section 12. An authorized agent may submit a request when legally permitted and may be asked to provide proof of authorization.

14. Children

The Services are intended for businesses and people acting in a professional capacity. Accounts, demos, and portal access are not directed to children. A person who creates an account, requests a demo, or accesses the portal must be at least 18 years old, or the higher age required to enter a binding agreement in that person's location. If you believe a child provided personal information, contact us so the situation can be reviewed and the information deleted when appropriate.

15. Changes, third-party services, and contact

Customer-selected integrations and third-party sites have their own privacy practices. This notice does not control a third party's independent processing. Review the privacy terms of any integration or external site before enabling it.

We may update this notice when the Services, legal requirements, or data practices change. The effective date at the top will be updated. Material changes will be communicated through a reasonable channel when required by law or contract.

Privacy and customer requests: [email protected]
Commercial questions: [email protected]
Operator: Infraveil Corporation, United States