Privacy Policy.

“Personal Information” is information that identifies you as an individual or relates to an identifiable individual. We collect Personal Information through or in connection with the Services, such as:

Name; email address; company or organization and your role; IP address (we may also derive your approximate location from your IP address); and records of your communications with us.

We and our service providers collect Personal Information in a variety of ways, including through the Services — for example, when you create an account, request a license or trial, or contact us.

We need to collect Personal Information in order to provide the requested Services to you. If you do not provide the information requested, we may not be able to provide the Services. If you disclose any Personal Information relating to other people to us or to our service providers in connection with the Services, you represent that you have the authority to do so and to permit us to use the information in accordance with this Privacy Policy.

We and our service providers use Personal Information for the following purposes. Where the GDPR or UK GDPR applies, we state the legal basis on which we rely for each purpose.

To provide the Services’ functionality to you, such as arranging access to your account; to verify your information; to provide customer service; to respond to your inquiries and fulfill your requests; and to send administrative information to you, such as changes to our terms, conditions, and policies. Legal basis: performance of a contract with you, or taking steps at your request prior to entering into a contract.

To send you newsletters and marketing-related communications, from which you may opt out at any time. Legal basis: your consent, or our legitimate interest in promoting our products to existing business contacts, in each case as permitted by applicable law (including the UK Privacy and Electronic Communications Regulations).

To analyze use of the Services and to better understand your interests and preferences, so that we can personalize our interactions with you. Legal basis: our legitimate interest in understanding and improving the Services.

To generate aggregated or anonymized data that no longer identifies you, which we may use and disclose for any purpose. Legal basis: our legitimate interest in producing data that carries no privacy risk to you.

For audits and verifying that our internal processes function as intended; for fraud prevention and security monitoring; for developing, enhancing, improving, and maintaining our products and services; for identifying usage trends and determining the effectiveness of our communications; and for operating and expanding our legitimate business activities. Legal basis: our legitimate interests in running, securing, and developing our business, or compliance with a legal obligation to which we are subject.

We do not sell Personal Information, use it for targeted advertising, or use it to make automated decisions that produce legal or similarly significant effects concerning you.

We disclose Personal Information to our service providers, to facilitate services they provide to us. These can include providers of services such as website hosting, information technology and related infrastructure, customer service, and email delivery. Our service providers process Personal Information on our instructions and are bound by contractual obligations of confidentiality and data protection.

We may also use and disclose Personal Information as we believe to be necessary or appropriate: (a) to comply with applicable law, to respond to lawful requests and legal process, and to fulfil other legal obligations; (b) to enforce our terms and conditions; and (c) to protect our rights, privacy, safety, or property, and/or that of you or others. We may use, disclose, or transfer Personal Information to a third party in connection with any proposed or actual reorganization, bankruptcy, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business or assets.

We and our service providers may collect information automatically in a variety of ways, including:

Certain information is collected by most browsers or automatically through your device, such as your device and browser type, operating system, screen resolution, language, and similar details. We use this information to ensure that the Services function properly.

When you use our software, including the Octet SDK, we and our service providers may collect usage and diagnostic data to understand how it is used and to improve it.

We do not currently set cookies or use third-party analytics services or pixel tags on the Services. If we introduce them in the future, we will update this Privacy Policy to name the provider and any available opt-out and, where required by applicable law, ask for your consent before placing non-essential cookies or similar technologies. We do not respond to browser do-not-track signals.

We use our own Octet browser product on the Services. For each browser session, it reads standard browser-environment attributes (such as the browser’s configured language, locale, and time settings, and standard rendering and capability characteristics), takes lightweight network-timing measurements, and observes connection-level attributes such as the source IP address, in order to infer the country you are connecting from, expressed as a country-level result with a confidence score. It is stateless: it stores nothing on your device, sets no cookies or identifiers, and builds no profile of you. It never triggers a permission prompt and does not use your browser’s geolocation, camera, or microphone. It does not collect or transmit coordinates and does not determine your precise location. We use it to help secure the Services and prevent fraud, and to test and improve our own product.

Octet does not collect precise (GPS-level) geolocation through this website. The Octet mobile SDK is designed so that an end user’s coordinates are never transmitted off their device; a location proof carries a cryptographic commitment, not coordinates. Our browser product returns only a country-level inference.

If we are required to treat information collected automatically as Personal Information under applicable law, we may use and disclose it for the purposes for which we use and disclose Personal Information, as detailed in this Privacy Policy. In some instances, we may combine information collected automatically with Personal Information; if we do, we will treat the combined information as Personal Information so long as it is combined.

Octet provides software to developers and businesses (“customers”) whose applications and websites use Octet products. When a customer’s application generates a location proof through the Octet mobile SDK, Octet processes that proof on the customer’s behalf as a processor (or service provider); proofs are retained for twenty-four (24) hours to enable verification and are then deleted. When a customer’s website uses the Octet browser product, Octet processes the associated browser and connection signals on the customer’s behalf to return a country-level verdict, and is stateless with respect to those signals. In each case the customer’s privacy policy, not this one, governs that processing; our obligations to the customer are set out in our agreement with them. If you are an end user of a customer’s application or website and have questions about how your information is handled, please contact that customer directly.

We seek to use reasonable organizational, technical, and administrative measures to protect Personal Information within our organization. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance with the “Contact Us” section below.

We retain Personal Information for as long as needed or permitted in light of the purpose(s) for which it was obtained. The criteria used to determine our retention periods include: the length of time we have an ongoing relationship with you and provide the Services to you; whether there is a legal obligation to which we are subject; and whether retention is advisable in light of our legal position (such as applicable statutes of limitations, litigation, or regulatory investigations).

Where the GDPR or UK GDPR applies, you have the right to request access to, rectification of, or erasure of your Personal Information; to request restriction of processing or to object to processing (including an absolute right to object to direct marketing); and to data portability. Where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

To exercise these rights, contact us as described in the “Contact Us” section below. We may need to verify your identity before acting on a request, and we will respond consistent with applicable law. You also have the right to lodge a complaint with a supervisory authority — in the UK, the Information Commissioner’s Office (ico.org.uk); in the EU, the data protection authority of your member state.

You may opt out of marketing communications at any time by following the unsubscribe instructions in any marketing email or by contacting us. Please note that even if you opt out of marketing, we may still send you administrative messages relating to the Services.

This Privacy Policy does not address, and we are not responsible for, the privacy, information, or other practices of any third parties, including any third party operating a website or service to which the Services link (for example, source-code repositories and social media platforms). The inclusion of a link on the Services does not imply our endorsement of the linked site or service.

The Services are not directed to individuals under the age of sixteen (16), and we do not knowingly collect Personal Information from individuals under 16.

We are incorporated in the United States and operate from the United Kingdom and the United States. We may store and process your Personal Information in any country where we have facilities or in which we engage service providers, including the United States, which may have data-protection rules that are different from those of your country.

Where the GDPR or UK GDPR applies to a transfer of your Personal Information outside the EEA or the UK, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK Addendum or International Data Transfer Agreement, or on an adequacy decision covering the recipient. You may request a copy of the relevant safeguard by contacting us as described below.

Unless we request it, we ask that you not send us, and you not disclose, any sensitive Personal Information (for example, Social Security or other government identifiers; information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometric or genetic characteristics; or criminal background) on or through the Services or otherwise to us.

The “Last updated” legend at the top of this Privacy Policy indicates when it was last revised. Any changes will become effective when we post the revised Privacy Policy on the Services. Where changes are material and applicable law requires it, we will provide additional notice.

Understone, Inc., doing business as Octet, is the company responsible for the collection, use, and disclosure of your Personal Information under this Privacy Policy. If you have any questions, or wish to exercise any of the rights described above, please contact us at privacy@octetproof.com. Because email communications are not always secure, please do not include credit card or other sensitive information in your emails to us.