Privacy Policy

Zenofex LLC ("Company," "we," "us," or "our") operates BootIntel, a hardware security intelligence platform accessible at bootintel.com ("Service"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use the Service. By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use the Service.

We collect the following categories of information: Account Information: Email address, name, and profile picture (if signing in with Google). Payment Information: We do not store full payment card details. Payment processing is handled by Stripe, which stores your billing information. We receive and store a Stripe customer ID and subscription status. Device & Analysis Data: Boot logs, UART capture data, and firmware analysis results that you submit to the Service. This data is used solely to provide analysis and is not shared with third parties or used to train AI models. Usage Data: Automatically collected information including IP address, browser type and version, pages visited, time and date of visits, time spent on pages, device identifiers, and referral URLs. This data is collected via Cloudflare Web Analytics (cookieless, server-side) and Google Analytics 4 (cookies; see Section 7). It is used for aggregate site measurement and is not used for advertising or sold to third parties. Communications: If you contact us via email or our support channels, we retain the contents of that communication. We do not knowingly collect sensitive personal information such as government IDs, health data, biometric data, or financial account numbers beyond what is required for payment processing.

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases: • Contract Performance (Art. 6(1)(b)): Processing your account information, device data, and billing data is necessary to provide the Service you have subscribed to. • Legitimate Interests (Art. 6(1)(f)): Analyzing usage patterns to improve the Service, detecting and preventing fraud, and ensuring Service security. • Legal Obligation (Art. 6(1)(c)): Retaining financial records as required by law. • Consent (Art. 6(1)(a)): Where we rely on consent (e.g., marketing communications), you may withdraw consent at any time by contacting [email protected].

We use the information we collect to: • Provide, operate, and maintain the Service • Process your subscription payments and manage your account • Send transactional emails (sign-in links, payment receipts, subscription notifications) • Respond to support inquiries and communications • Monitor and analyze usage trends to improve Service performance and features • Detect, prevent, and investigate security incidents, fraud, and violations of our Terms of Service • Comply with legal obligations We do not sell, trade, or rent your personal information to third parties for their marketing purposes. We do not use your device data (UART logs, boot logs, firmware data) for any purpose other than providing analysis results to you.

We share data with the following third-party service providers solely to operate the Service. Each has its own privacy policy: • Stripe, payment processing and subscription management. Your payment information is subject to Stripe's Privacy Policy (stripe.com/privacy). • Resend, transactional email delivery (sign-in links, receipts). See resend.com/privacy. • Google OAuth, if you choose to sign in with Google, your Google account information (email, name, profile picture) is used for authentication only. See policies.google.com/privacy. • OpenAI. AI-powered analysis features may process submitted device data through OpenAI's API when AI reports are enabled. Data submitted is subject to OpenAI's API data usage policies. See openai.com/policies/privacy-policy. • Cloudflare. DNS, tunnel ingress, edge security, and Web Analytics (privacy-preserving, no cookies, no cross-site tracking). See cloudflare.com/privacypolicy. • Google Analytics 4, aggregate site traffic measurement (pageviews, referrers, device class). Sets cookies; you can opt out by enabling Do Not Track in your browser or using the Google Analytics Opt-out Add-on (tools.google.com/dlpage/gaoptout). See policies.google.com/privacy. • Google Firebase Cloud Messaging, mobile push notifications to the BootIntel mobile app. Only used when you sign in on the app. See firebase.google.com/support/privacy. We do not share your personal data with any other third parties except as required by law or with your explicit consent.

We retain different categories of data for different periods: Account Information: Retained for the duration of your account. If you delete your account, account information is deleted within 30 days, except where retention is required by law (e.g., financial records are retained for 7 years). Device & Analysis Data (scan results, boot logs, findings): Retained according to your plan's log retention limit: • Free plan: 30 days • Researcher plan: 6 months • Starter plan: 90 days • Pro plan: 1 year • Business plan: 3 years • Scale plan: 5 years • Enterprise plan: Custom (as configured) Logs older than your plan's retention window remain on disk but become inaccessible at read time. Upgrading to a plan whose window covers an older log re-unlocks it instantly. Permanent deletion only happens on explicit account closure. Usage Logs: Retained for 90 days for security and fraud detection purposes. Financial Records: Retained for 7 years as required by applicable tax and accounting regulations. To request early deletion of your data, contact [email protected].

We use the following cookies: Essential cookies (cannot be disabled, required for the Service to function): • bi_session: A session authentication cookie set when you sign in. HttpOnly (inaccessible to JavaScript), Secure in production (HTTPS only), 30-day lifetime. Without this cookie you cannot remain signed in. Analytics cookies (set by Google Analytics 4): • _ga: Distinguishes unique visitors, 2-year lifetime, set on the bootintel.com domain. • _ga_<container_id>: Persists session state for GA4, 2-year lifetime. • _gid (if present): Distinguishes users for 24 hours; some GA4 properties stop setting this. These cookies are first-party (set on bootintel.com) but the data is sent to Google Analytics for aggregate site measurement. You can opt out by installing the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout, or by enabling Do Not Track or "Reject All Cookies" in your browser. What we do NOT use: advertising cookies, cross-site tracking pixels, remarketing tags, or third-party cookies for ad personalization. Cloudflare Web Analytics is also active but is cookieless and does not set any storage on your device. You can configure your browser to refuse non-essential cookies. Refusing the bi_session cookie will prevent you from using the authenticated portions of the Service; refusing the analytics cookies has no effect on functionality.

We implement industry-standard security measures to protect your personal information: • All data is transmitted over HTTPS (TLS 1.2+) • Session tokens are cryptographically signed and rotated • Passwords are not stored (we use Google OAuth and magic link authentication) • Database access is restricted to application services within a private network • Payment data is handled entirely by Stripe and never touches our servers Despite these measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users within 72 hours of becoming aware of the breach, as required by GDPR and applicable state laws (including CCPA breach notification requirements). Notification will be sent to the email address associated with your account and will describe the nature of the breach, the data affected, and the steps we are taking.

Depending on your location, you may have the following rights regarding your personal data: Right of Access: Request a copy of the personal data we hold about you. Right to Rectification: Request correction of inaccurate personal data. Right to Erasure: Request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations. Right to Restriction: Request that we limit the processing of your personal data in certain circumstances. Right to Data Portability: Request your personal data in a structured, machine-readable format. Right to Object: Object to processing based on legitimate interests. Right to Withdraw Consent: Where processing is based on consent, withdraw consent at any time. To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may require identity verification before processing your request. If you are dissatisfied with our response, you have the right to lodge a complaint with your local data protection authority (for EEA residents: your national DPA; for UK residents: the ICO at ico.org.uk).

California residents have the following additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA): • Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months. • Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions. • Right to Correct: Request correction of inaccurate personal information. • Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information with third parties for cross-context behavioral advertising. • Right to Limit Use of Sensitive Personal Information: We do not use or disclose sensitive personal information for purposes other than providing the Service. • Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights. To exercise your California privacy rights, contact us at [email protected]. We will respond within 45 days as required by law.

The Service is intended for use by individuals aged 18 and older and is not directed to children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected] and we will promptly delete such information. If we discover we have inadvertently collected information from a child under 13, we will delete it immediately.

Zenofex LLC is based in the United States. If you access the Service from outside the United States, your personal data will be transferred to and processed in the United States, which may have different data protection laws than your country of residence. For transfers of personal data from the EEA or UK to the United States, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms, where required. By using the Service from outside the United States, you acknowledge and consent to this transfer.

We may update this Privacy Policy from time to time. We will notify you of material changes at least 14 days in advance by email to your registered address or by posting a prominent notice on the Service. The "Effective date" at the top of this policy indicates when the current version took effect. Your continued use of the Service after the effective date of a revised Privacy Policy constitutes your acceptance of the changes.

For privacy inquiries, data subject requests, or to exercise your rights under this Privacy Policy: Privacy inquiries: [email protected] Legal / notices: [email protected] Zenofex LLC bootintel.com