Privacy Policy

1. INTRODUCTION AND SCOPE

This Enterprise Privacy Policy ("Policy") explains how EyeBall Security Inc. and its affiliates ("EyeBall", "we", "us", or "our") collect, use, process, transmit, store, and disclose information in connection with your access to and use of our website, cloud management platforms, client-side browser extensions, in-DOM protection software, APIs, and associated cybersecurity services (collectively, the "Services").

This Policy applies to: (i) organizational customers who purchase or evaluate the Services ("Customers"); (ii) authorized enterprise users whose browsers are secured or managed by the Services ("Users"); and (iii) general visitors to our websites.

2. CATEGORIES OF INFORMATION WE COLLECT

The categories and volume of data collected depend upon the specific security modules activated by Customer’s administrators:

3. HOW WE PROCESS AND USE COLLECTED DATA

We process collected information strictly for legitimate commercial and cybersecurity purposes, including:

• Service Delivery: Providing real-time client-side threat blocking, prompt sanitization, security policy deployment, and centralized administrative alerting;
• Threat Intelligence & Model Optimization: EyeBall aggregates and de-identifies security signals, malicious code samples, and threat metadata to train proprietary heuristic classifiers, refine threat models, and protect the global customer ecosystem;
• Compliance Auditing: Enabling Customer’s security operations center (SOC) and compliance officers to review audit trails, forensic artifacts, and policy enforcement metrics;
• Support & Troubleshooting: Diagnosing extension bugs, resolving performance latency anomalies, and verifying platform reliability;
• Legal Obligations: Complying with statutory reporting requirements, legal processes, and lawful law enforcement requests.

4. DISCLOSURE AND SHARING OF INFORMATION

We do not sell, rent, or trade your personal information. We disclose information only under strict operational boundaries:

• Customer Administrators: Security administrators designated by Customer have direct access to all telemetry, alerts, and user logs generated within their tenant account;
• Verified Sub-Processors: Premier cloud hosting, telemetry ingestion, and database vendors (e.g., Cloudflare, AWS) bound by rigorous confidentiality agreements and SOC 2 Type II controls;
• Corporate Transactions: In the event of a merger, acquisition, corporate reorganization, or asset sale, subject to standard confidentiality protections;
• Legal Compulsion: If required by court subpoena, government regulation, or to prevent imminent physical harm or catastrophic cyber intrusion;
• Cyber Threat Alliances: Sharing anonymized, de-identified indicators of compromise (IoCs) with accredited threat research bodies and security ISACs to advance collective defense.

5. INTERNATIONAL DATA TRANSFERS & CROSS-BORDER SAFEGUARDS

EyeBall operates global infrastructure with headquarters in the United States and data processing nodes across North America, Europe, and other regions. When Customer data originates from the European Economic Area (EEA), United Kingdom, or Switzerland and is transferred to jurisdictions lacking an adequacy decision, EyeBall relies upon the European Commission’s Standard Contractual Clauses (SCCs) and UK International Data Transfer Addendum (IDTA), accompanied by rigorous supplementary technical safeguards (including AES-256 encryption at rest and TLS 1.3 in transit).

6. DATA RETENTION, ARCHIVAL & DELETION

We retain Customer telemetry and administrative records in accordance with the retention periods configured by Customer’s administrators (typically 30, 90, or 365 days). Aggregated, anonymized threat statistics derived from telemetry may be retained indefinitely for historic threat modeling and vulnerability analytics. Upon termination of the commercial subscription, EyeBall deletes Customer’s active tenant data within thirty (30) days, unless longer retention is mandated by law.

7. SECURITY CONTROLS & TECHNICAL SAFEGUARDS

EyeBall implements enterprise-grade technical, physical, and administrative safeguards designed to protect information from unauthorized disclosure, destruction, or interception. These controls include:

• End-to-end transport encryption via TLS 1.3 with modern cipher suites;
• Database encryption at rest utilizing FIPS 140-2 validated AES-256;
• Role-based access control (RBAC), multi-factor authentication, and strict least-privilege engineering access;
• Continuous automated vulnerability scanning, dependency auditing, and third-party penetration testing.

Notice: No computer system or internet transmission is impervious to attack. EyeBall cannot guarantee absolute cryptographic infallibility against nation-state adversaries.

8. DATA SUBJECT RIGHTS (GDPR, CCPA/CPRA, HIPAA)

Depending on your jurisdiction, you may possess statutory rights regarding personal data, including the right to: (i) request access to or a copy of your data; (ii) rectify inaccurate records; (iii) request erasure (the "right to be forgotten"); (iv) restrict or object to certain processing; and (v) data portability.

Employee Requests: Because EyeBall processes browser data as a Processor on behalf of your employer (the Customer), individual employees seeking to exercise rights regarding corporate browser activity should direct their requests to their organization’s IT or Information Security department.

9. MINORS AND CHILDREN'S DATA

The Services are commercial enterprise security solutions intended solely for professional business organizations. The Services are not directed to individuals under eighteen (18) years of age. We do not knowingly collect personal data from children.

10. POLICY UPDATES AND REVISIONS

We may revise this Privacy Policy periodically to reflect technological changes, product updates, or statutory requirements. When revisions occur, we will update the version and effective date at the top of this document. Continued use of the Services following notice of changes constitutes acknowledgment and acceptance of the revised Policy.

11. CONTACT OUR DATA PROTECTION OFFICER (DPO)

If you have questions, regulatory inquiries, or privacy concerns regarding this Policy, please contact our Data Protection Office: