Privacy Policy

Information You Provide to Us

We collect information you provide directly when you:

• Create an account (e.g., name, email, phone number, company name);
• Contact customer support;
• Sign up for newsletters or marketing;
• Register for events or webinars; or
• Submit inquiries or feedback.

Depending on what account type (individual or business) or Services you choose or how you interact with us, we may collect your personal information. "Personal Information" means any information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, to an individual or household and it may include, without limitation:

• Contact information, such as your name, email address, mailing address, phone number, and profile information;
• Account login credentials, such as usernames, passwords, password hints, and similar security information;
• Account registration and profile information and other biographical and demographic information;
• Comments, feedback, and other information you provide to us, including search query data and questions or information you send to customer support;
• Communication preferences, including preferred language and preferred contact methods;
• (for paid service users only) Payment information, such as credit or debit card number(s), bank name and account number; and/or
• (for company or organization users only) Company/organization name, names of your company's/organization's designated representative, number and type of projects, and datasets and clusters used.

Automatically Collected Information from Your Use

We may collect technical data automatically, including:

• Device and connection information such as the browser, device, or group of devices you use to access our Services but that we do not associate with personal identifier, such as IP address, browser type and version, operating system and other software installed on your device, your device's type and unique advertising identifier (such as the Apple IDFA (or UDID in older Apple phone models) or Android Advertising ID / Google AdID), and any other unique identifier that may be assigned to your device, or a non-cookie unique identifier and other technical identifiers, error reports and performance data;
• Service usage information such as session logs, command logs, usage statistics, browsing history, search history, user activities, site traffic, and other analytics such as the features you used, the settings you selected, your URL click stream data, tracking pixels, Web-based shell activity (e.g., web shell history), command-line input, authentication-related identifiers
• Visit and campaign attribution information such as the pages you view on our marketing website, the referring site, and the campaign parameters and advertising click identifiers carried on the URL you arrive at, together with a random visit identifier. We retain this information for twelve (12) months and, where you go on to create an account, associate the visit that preceded your sign-up with that account;
• System information such as system-level logs used for access control, infrastructure auditing, and anomaly detection, including date and time stamp and referring and exit pages, language you used, pages you visited on the Services, as well as what you clicked on and the average time you spent on the website, Apps, and IP addresses;
• Location-related information such as the region, city, town, or time zone where the Services are accessed or used, or your device is located in order to provide you with more relevant content for where you are in the world and enable certain service features, subject to your choice of privacy setting; and/or
• Inferences drawn from other Personal Information listed above, to create a profile reflecting your preferences, characteristics, behavior, attitude, and ability.

Data from Third-Party Sources

We also may collect data from partners, affiliates, other third parties' or public sources for business and marketing purposes, including:

• Service providers that help us determine geographic location in order to customize certain products and services to your location and enable certain service features;
• Partners with which we offer co-branded services or engage in joint marketing activities; and/or
• Publicly available sources and data suppliers from which we obtain data to validate or supplement the information we hold.

With Your Organization

If you access the Services through a subscription administered by your organization, your Personal Information and certain usage data gathered through the Services may be accessed by or shared with the administrators authorized by your organization for the purposes of usage analysis, subscription management and compliance, cost attribution, and departmental budgeting.

With Application Licensors

If you access a third-party application on the Services through a license agreement with the licensor of that application, Personal Information relevant to that application will be shared with the licensor so that it can provide you access to the application, subject to the terms of its license agreement and privacy policy.

With Our Affiliates and Service Providers

Depending on the Services you choose to access, use, or purchase, we may share Personal Information with our affiliates (including our entities, subsidiaries, and divisions that provide technology, customer service, and other shared services functions) and third-party service providers (including payment processors and sub-processors, customer support, email service providers, IT service providers, and similar vendors) at our discretion in connection with our Services or Platform, in compliance with this Privacy Policy and appropriate confidentiality and security measures, only to the extent necessary to provide the Services, complete a transaction, fulfill your requests, or to perform the Services on our behalf, based on our instructions.

By Your Privacy Choices

We may share your Personal Information with our affiliates and other third parties when you indicate your consent or preference in your account or settings or when you choose to disclose such information publicly at your discretion. The Services may allow you to post and share Personal Information, comments, materials, and other content. Any content you disclose publicly can be collected and used by others, may be indexed by search engines, and might not be removable. Please be careful when disclosing Personal Information in public areas of the Services. If you do not consent to such sharing, please do not submit any Personal Information to us or post it through our Services.

For Legal Reasons

We also will disclose your Personal Information if we have a good faith belief that such disclosure is necessary to:

• Comply with any applicable law, regulation, legal process, or other legal obligation;
• Detect, investigate, and help prevent security threats, fraud, or technical issues; and/or
• Protect the rights, property, or safety of our Services, properties, rights, employees, users, or public interest and as part of a corporate transaction, such as a transfer of assets, reorganization, restructuring, or an acquisition by or merger with another company.

Categories of Recipients

We do not sell Personal Information. We disclose it to the following categories of recipients, each of which processes it on our instructions and only as necessary for the purpose stated:

Each recipient is engaged under a written contract that limits it to processing on our instructions, requires appropriate security measures, and restricts onward transfer to sub-processors bound by equivalent obligations.

A recipient may itself use sub-processors, and some of those operate globally distributed infrastructure. Where that is the case the destination is not a fixed list of countries.

Individually named recipients. The itemised list of recipients that Korean law requires—each named, with the items transferred, the purpose, and the retention period—is maintained in the Korean-language version of this policy and is authoritative for readers of either language.

Transfer Mechanisms

Where we transfer Personal Information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on one of the following:

• Adequacy. A finding by the European Commission, the UK Secretary of State, or the Swiss Federal Council that the destination country provides an adequate level of protection. The Republic of Korea holds such a finding from the European Commission.
• Standard Contractual Clauses. The clauses approved by the European Commission, together with the UK International Data Transfer Addendum for United Kingdom transfers and the necessary adaptations for Swiss transfers.
• The EU-U.S. Data Privacy Framework, its UK Extension, and the Swiss-U.S. Data Privacy Framework, where the recipient participates in them.

We do not rely on your acceptance of this policy as the legal basis for an international transfer.

Countries outside your own may have data protection laws that differ from those where you live and may not provide an equivalent level of protection. Where a transfer relies on Standard Contractual Clauses, you may request a copy by contacting us as described in Section 13.

Operating the AI Features

• Types of Personal Information Processed: Depending on the AI function, this may include text, commands, session activity, uploaded files, or other user-provided data that you submit through the Services.
• Purpose of Processing: To operate the AI features, respond to your queries, generate outputs, and detect anomalies.
• Safeguards: We implement technical and organizational measures to protect personal information during AI processing, including encryption, access controls, and data minimization.
• Retention Period: Data used to operate an AI feature is retained only as long as necessary to provide that feature, unless a longer period is required by law.
• Your Rights: You may request access, deletion, or restriction of your Personal Information processed for AI purposes, subject to applicable laws. See "Your Rights" below.

De-identified Records Used to Improve Our Models

We do not use customer data to train any model, and we do not develop models of our own.

To measure the accuracy of our threat detection and execution judgment, and to improve the detection system on the strength of what we measure, we maintain a set of de-identified records derived from session activity on the Services.

• What it contains: De-identified records of session activity, including command sequences, judgment outcomes, threat classifications, and the relationships between hosts and accounts expressed as substitute labels that carry no meaning outside an individual record.
• De-identified before it is stored: Records are de-identified and the result is verified before they are stored. Raw session material does not enter this set. Records that fail verification are quarantined and are never added to it.
• What is excluded: Credentials, secrets, keys, and authentication material are removed by design, and any that are found to have been retained are deleted without delay. We do not knowingly retain protected health information. Content from workspaces designated regulated or restricted under a written agreement is excluded.
• Retention Period: Records are retained for twenty-four (24) months from collection and are then deleted.
• Our commitment: We maintain and use these records in de-identified form and do not attempt to re-identify them, except to verify that our de-identification process is working correctly. We do not sell, license, or share them with any third party for that party's own purposes; use them for advertising, marketing, or profiling of individuals; use them to identify or characterize a specific customer's practices or personnel; or use them to train general-purpose AI models.
• Your choice: Workspace owners can exclude their workspace from this set at any time in workspace settings. Exclusion stops any further contribution from that workspace. Records already collected are not associated with a workspace and are not retrievable by customer, so they remain until their retention period expires. Workspaces on our Enterprise plan are excluded by default and are included only if the workspace owner opts in through workspace settings.

Because these records cannot be linked to an identified or identifiable person, a request to access or delete personal information does not reach them. The exclusion control above is the way to stop contributing.

General Rights (Applicable to All Users)

You have the following rights under applicable privacy and data protection laws, as may be applicable in your jurisdictions:

• Rights of Access: You may request a copy of your Personal Information;
• Right to Correction: You may request that we correct inaccurate or incomplete data;
• Right to Deletion: You may request deletion of your Personal Information;
• Right to Restrict or Object to Processing: You can limit how we use your data in some cases;
• Right to Withdraw Consent: If we rely on your consent, you may withdraw it at any time;
• Right to Data Portability: You may ask us to transfer your information to another provider, where technically feasible; and
• Right to Lodge a Complaint: You may file a complaint with your local data protection authority.

These rights apply to Personal Information that can be linked to you. They do not reach the de-identified records described in Section 10.2, which are not associated with an identified or identifiable person; workspace owners can stop contributing to that set using the control described there.

You can exercise these rights by contacting: privacy@alpacax.com. We will respond to your request consistent with applicable laws. To protect your privacy and security, we may require you to verify your identity.

Please note that certain Personal Information is necessary to provide you with our core Services. If you choose not to provide such data or request its deletion, your ability to use some or all features of the Services may be limited. However, you may opt out of non-essential uses, such as marketing communications or third-party sharing, where applicable under the law.

For California Residents Only

Do Not Track Disclosure

As required by Section 22575 of the California Business and Professions Code, the following disclosure is made to California residents and to residents of other states:

Neither our Website nor the App alter their respective behavior or change their respective services when they receive a "do-not-track" flag or signal from your operating system or browser. As described herein, we use cookies and other tools to collect information about you when you visit our App to, among other things, better tailor the features, performance, and support of our Services, the Website, and the App. After you leave or close-out from the Website or App, we do not track your online activity on other apps or websites, but third parties (and their affiliates) may track your online activity to offer you advertisements. This tracking is anonymous and is not linked to your personal data.

Marketing

We collect various types of personal data about you during the course of your relationship with us. Under California law, if you are a resident of California, you may make a written request to us to disclose the categories or specific pieces of personal data of yours which we have shared with third parties for the third parties' direct marketing purposes during the prior year. In response to your written request, we are allowed to provide you with a notice describing the cost-free means to opt-out of our sharing your information with third parties with whom we do not share the same brand name if the third party will use such information for its direct marketing purposes.

If you would like to exercise your rights under California law, please send your written request to the e-mail address or postal address below with the words "CALIFORNIA OPT-OUT" in ALL CAPS in the subject line or clearly set forth elsewhere. Please include your postal address in your request. Within thirty (30) days of receiving your written request, we will provide you with a Third-Party Direct Marketing Opt-Out Form so you may request that your personal data not be disclosed to third parties for their direct marketing purposes.

Consumer Rights Under the California Consumer Privacy Act of 2018 (the CCPA)

To the extent the California Consumer Privacy Act is applicable, with certain exceptions, including in connection with data subject to federal regulation (i.e., the Health Insurance Portability and Accountability Act (HIPAA), the Gramm-Leach Bliley Act California (GLBA), the Fair Credit Reporting Act (FCRA), or the Drivers' Privacy Protection Act (DPPA)), contractual rights and obligations, and certain other exceptions, California residents have the following rights with respect to our data collection and data processing of California residents' personal data which is collected in California, processed in California, or part of a transaction occurring in California:

TO THE EXTENT APPLICABLE, AND TO EXERCISE ANY OF THE ABOVE RIGHTS, PLEASE CONTACT US AT ANY OF THE BELOW AND INCLUDE THE WORDS "CCPA RIGHTS" IN ALL CAPS IN THE SUBJECT LINE, AND LET US KNOW THAT YOU WANT TO EXERCISE YOUR CCPA RIGHTS AND WHAT RIGHTS YOU SEEK TO EXERCISE.