Privacy Policy

This Privacy Policy describes our policies and procedures on the collection, use and disclosure of your information when you visit our website or use the Service, tells you about your privacy rights and how the law protects you, and contains information regarding tracking technologies such as cookies, and third-party data processors.

We use your Personal data to provide and improve our website and the Service. By using our website and the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

For Customers using the hosted (SaaS) Service, this Privacy Policy does not apply to our use or retention of anonymized and aggregated Service usage data (such as BEP and OTEL data) that Hermetiq actually receives through the hosted Service, which Hermetiq may retain and use in perpetuity to improve our Service, including our AI capabilities, and for other business purposes. For Customers using an on-premises, self-hosted, or customer-hosted deployment of the Service, Hermetiq does not access, receive, process, store, or retain any Customer Data (including BEP and OTEL data, in identified, deidentified, anonymized, aggregated, or any other form), and no provision of this Privacy Policy grants Hermetiq any right to do so.

Definitions

All terms not defined in this Policy shall have the meanings given in our Terms of Service. For the purposes of this Privacy Policy:

Cookies are small files that are placed on your computer, mobile device or any other device by a website, containing the details of your browsing history on that website among its many uses.

Device means any device that can access the Service such as a computer, a cellphone or a digital tablet.

Personal Data is any information that relates to an identified or identifiable individual.

Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).

Website refers to https://www.hermetiq.com

Collecting and Using your Personal Data

Types of Data Collected

Personal Data

While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you. Personally identifiable information may include, but is not limited to:

• Email address
• First name and last name
• Company name and role (if you sign up on behalf of an organization)

Service Usage Data

Usage Data is collected automatically when using the Website or the Service.

Usage Data may include information such as your Device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

When you access the Website or the Service by or through a mobile device, we may collect certain information automatically, including, but not limited to, the type of mobile device you use, your mobile device unique ID, the IP address of your mobile device, your mobile operating system, the type of mobile Internet browser you use, unique device identifiers and other diagnostic data.

We may also collect information that your browser sends whenever you visit our Website or when you access the Website or Service by or through a mobile device.

Tool Usage Data

Usage data is also collected when you use our Service.

Usage data may include information such as your Device's IP address, details of your system such as the operating system and microarchitecture names, details of your build tool configuration such as the names and versions of tools being used, and other diagnostic information.

Tracking Technologies and Cookies

We use Cookies and similar tracking technologies to track the activity on our Website and Service and store certain information. Tracking technologies used are beacons, tags, and scripts to collect and track information and to improve and analyze our Website and Service. The technologies we use may include:

• Cookies or Browser Cookies. A cookie is a small file placed on your Device. You can instruct your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if you do not accept Cookies, you may not be able to use some parts of our Website or Service. Unless you have adjusted your browser setting so that it will refuse Cookies, our Service may use Cookies.
• Web Beacons. Certain sections of our Website and our Service and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit us, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of a certain section and verifying system and server integrity).

Cookies can be "Persistent" or "Session" Cookies. Persistent Cookies remain on your personal computer or mobile device when you go offline, while Session Cookies are deleted as soon as you close your web browser. You can learn more about cookies here: All About Cookies by TermsFeed.

We use both Session and Persistent Cookies for the purposes set out below:

Necessary / Essential Cookies
Type: Session and Persistent Cookies
Administered by: Us and our authentication subprocessor (Stytch)
Purpose: These Cookies are essential to provide you with services available through the Website and Service. They authenticate users, maintain login sessions, and prevent fraudulent or unauthorized use. Without these Cookies, core features such as logging in cannot be provided.

Functionality Cookies
Type: Persistent Cookies
Administered by: Us
Purpose: These Cookies allow us to remember choices you make when you use the Website or the Service, such as your preferences and settings. The purpose of these Cookies is to provide a more personalized experience and to avoid you having to re-enter your preferences each visit.

Website Analytics and Performance Measurement
Type: Cookie-free aggregated analytics
Administered by: Vercel Web Analytics and Vercel Speed Insights
Purpose: These services measure page views, referral sources, device and browser categories, approximate geography, and performance signals such as Core Web Vitals. Vercel Web Analytics does not use third-party cookies to identify visitors across websites.

Business Website Visitor Analytics
Type: Script-based visitor and company identification
Administered by: Apollo.io
Purpose: If you select “Allow business analytics,” Apollo may process information such as IP address, browser and device metadata, referring page, pages visited, visit timing, and inferred company or professional attributes to help Hermetiq understand which businesses are interested in our products. Apollo does not load on the Website when you select “Essential only.” You can change this choice from the “Privacy choices” link in the footer.

Product Analytics and Session Replay
Type: Persistent Cookies and similar technologies
Administered by: LogRocket
Purpose: Within the hosted Service, LogRocket may associate page views, user interactions, console activity, and network activity with a product session so we can diagnose issues and improve the Service. LogRocket may persist a unique session identifier across visits.

You can disable cookies through your browser settings, although doing so may prevent you from logging in or using certain Service features. To learn more about LogRocket, see LogRocket's privacy policy. To learn more about Apollo, see Apollo's privacy policy.

Use of your Personal Data

The Company may use Personal Data for the following purposes:

• To provide and maintain our Website and our Service, including to monitor the usage of our Website and our Service.
• To refine our offerings, by monitoring usage patterns and directing improvements.
• To manage your Account: to manage your registration as a user of the Service. The Personal Data you provide can give you access to different functionalities of the Service that are available to you as a registered user.
• For the performance of a contract: the development, compliance and undertaking of the purchase contract for the products, items or services you have purchased or of any other contract with us through the Website or Service.
• To contact you: To contact you by email, telephone calls, SMS, or other equivalent forms of electronic communication, such as a mobile application's push notifications regarding updates or informative communications related to the functionalities, products or contracted services, including the security updates, when necessary or reasonable for their implementation.
• To provide you with news, product updates, special offers, and general information about goods, services, and events that are similar to those you have already purchased or inquired about, unless you have opted out. You may opt out of marketing emails at any time by clicking the unsubscribe link included in any marketing email or by emailing info@hermetiq.com. Opting out of marketing emails does not affect transactional or service-related communications (such as billing notices, security alerts, or account-management messages), which we may continue to send as necessary to provide the Service.
• To manage your requests: To attend and manage your requests to Us.
• For business transfers: We may use your information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by us about our Service users is among the assets transferred.
• For other purposes: We may use your information for other purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns and to evaluate and improve our Service, products, services, marketing and your experience.

We may share your personal information in the following situations:

• For business transfers: We may share or transfer your personal information in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of our business to another company.
• With your consent: We may disclose your personal information for any other purpose with your consent.
• To comply with law or legal process: We may disclose your personal information when required by law, court order, subpoena, or other legal process, or when we believe in good faith that disclosure is necessary to protect our rights, the safety of our users, or to investigate fraud or wrongdoing. See the "Disclosure of your Personal Data" section below.

Retention of your Personal Data

The Company will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

The Company will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of our Website or our Service, or We are legally obligated to retain this data for longer time periods. As noted above, for Customers using the hosted (SaaS) Service, this Privacy Policy does not apply to our use or retention of anonymized and aggregated Service Usage Data (such as BEP and OTEL data) that Hermetiq actually receives through the hosted Service, which Hermetiq may retain and use in perpetuity to improve our Service (including our AI capabilities) and for other business purposes. For Customers using an on-premises, self-hosted, or customer-hosted deployment of the Service, Hermetiq does not receive, process, or retain any Customer Data in any form, and the perpetual-retention right described above does not apply.

Transfer of your Personal Data

Your information, including Personal Data, is processed at the Company's operating offices and in any other places where the parties involved in the processing are located. It means that this information may be transferred to — and maintained on — computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction.

Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer.

The Company will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy and no transfer of your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of your data and other personal information.

Payment Processing

Hermetiq currently bills paid Customers by invoice and does not process credit card or other payment-card data through the Service. We may engage a third-party payment processor in the future; if and when we do, we will update this Privacy Policy and our list of subprocessors above to disclose the payment processor and the categories of data shared with it.

Third Party Subprocessors

For Customers using the hosted (SaaS) Service, your information may be provided to, stored by, and processed by the following categories of third-party subprocessors in the course of providing the Website and Service:

• Cloud infrastructure: Google Cloud (Google LLC) — hosting, storage, compute, and databases for the hosted Service. Terms: https://cloud.google.com/terms
• Workspace and email: Google Workspace (Google LLC) — used for business email (including any transactional or account-related email we send to you) and internal collaboration. Terms: https://workspace.google.com/terms/premier_terms/
• Marketing website hosting, aggregated analytics, and performance measurement: Vercel (Vercel, Inc.) — hosts and serves the hermetiq.com marketing website and provides Web Analytics and Speed Insights. Vercel may process visitor IP addresses, browser metadata, request data, page views, referral information, approximate geography, and web-performance measurements. Privacy policy: https://vercel.com/legal/privacy-policy
• Authentication: Stytch (Stytch, Inc.) — handles account login, authentication, and session management on our behalf, and processes credentials such as email addresses, names, and authentication tokens. Privacy policy: https://stytch.com/privacy
• Business website visitor analytics: Apollo.io (ZenLeads Inc.) — after a Website visitor permits business analytics, Apollo may process IP address, page-view activity, browser and device metadata, and inferred company or professional attributes so Hermetiq can understand business interest in its products. Privacy policy: https://www.apollo.io/privacy-policy
• Product analytics and session replay: LogRocket (LogRocket, Inc.) — captures session replays and product analytics within the hosted Service to help us understand product usage and diagnose issues. LogRocket may record user interactions, page views, console logs, and network activity within the hosted Service. Terms: https://logrocket.com/terms-of-service/
• Sales and customer relationship management: Attio (Attio Limited) — stores contact, account, and pipeline information for sales prospects and Customers, including names, business email addresses, company names, and notes from sales communications.

A current and complete list of subprocessors, including provider names and the categories of data each receives, is available upon request at legal@hermetiq.com. Hermetiq will provide reasonable advance notice of material changes to its subprocessors. Each subprocessor is bound by contractual obligations of confidentiality and data protection.

For Customers using an on-premises, self-hosted, or customer-hosted deployment of the Service, no Customer Data flows to any of the subprocessors listed above. The Service runs entirely within Customer's own infrastructure, and Hermetiq does not transmit Customer Data to any third party.

Disclosure of your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law enforcement

Under certain circumstances, the Company may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other legal requirements

The Company may disclose your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of the Company
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of Users of the Service or the public
• Protect against legal liability

Security of your Personal Data

The security of your Personal Data is important to Us. We implement administrative, technical, and physical safeguards designed to protect Personal Data against unauthorized access, disclosure, alteration, or destruction. Our security measures include:

• Encryption in transit: all data exchanged with the hosted Service and Website is encrypted using TLS.
• Encryption at rest: Personal Data stored within Google Cloud is encrypted at rest by default using Google Cloud's encryption infrastructure (see Google Cloud's published encryption-at-rest documentation).
• Access controls: internal access to production systems is limited to authorized Hermetiq personnel and is managed through Google Cloud Identity and Access Management (IAM).
• Network security: production systems are protected by mTLS for service-to-service communication and isolated within secure cloud infrastructure.
• Subprocessors: each third-party subprocessor listed in the "Third Party Subprocessors" section operates under its own published privacy and security commitments and applicable terms of service, which Hermetiq relies on in selecting providers.

No method of transmission over the Internet or method of electronic storage is 100% secure. While we use commercially reasonable means to protect your Personal Data, we cannot guarantee its absolute security.

Data Breach Notification

In the event of a security incident that results in the unauthorized access to, acquisition of, or disclosure of Personal Data, Hermetiq will:

• Notify affected Customers without undue delay and within the timeframes required by applicable law (including, where applicable, within 72 hours of becoming aware of the incident as required by GDPR Article 33);
• Notify applicable supervisory authorities and regulators as required by law;
• Provide affected Customers with information reasonably necessary to understand the nature and scope of the incident, the categories of Personal Data affected, the measures Hermetiq has taken or proposes to take, and a point of contact for further information; and
• Cooperate in good faith with affected Customers, regulators, and law enforcement in investigating and remediating the incident.

Detailed Information on the Processing of your Personal Data

The Service Providers We use may have access to your Personal Data. These third-party vendors collect, store, use, process and transfer information about your activity on our Service in accordance with their Privacy Policies.

Children's Privacy

Our Service is intended for use by individuals aged 18 and older. We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone under the age of 18 without verification of parental consent, we take steps to remove that information from our servers.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

Your California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) and related state privacy laws give you specific rights regarding your Personal Data. This section describes those rights and how to exercise them.

Categories of Personal Information We Collect

We collect the categories of Personal Information described in the "Collecting and Using your Personal Data" and "Payment Processing" sections above, including identifiers (such as name, email address, IP address), commercial information (such as billing records and transaction data), internet or other electronic network activity (such as Usage Data and Cookies), and professional or employment-related information (such as company name and role).

Sale or Sharing of Personal Information

Hermetiq does not sell or share your Personal Information as those terms are defined under the California Consumer Privacy Act. We do not disclose your Personal Information to third parties for monetary or other valuable consideration, and we do not share your Personal Information for cross-context behavioral advertising.

Your Rights

If you are a California resident, you have the right to:

• Right to know: request that we disclose what categories and specific pieces of Personal Information we have collected about you, the categories of sources, the business purpose for collection, and the categories of third parties with whom we share that information.
• Right to delete: request that we delete the Personal Information we have collected from you, subject to certain legal exceptions.
• Right to correct: request that we correct inaccurate Personal Information we maintain about you.
• Right to opt out of sale or sharing: as noted above, we do not sell or share your Personal Information; no opt-out is required.
• Right to non-discrimination: we will not discriminate against you for exercising any of these rights.

To exercise any of these rights, contact us at legal@hermetiq.com. We will verify your request using information associated with your Account or with the personal data you submit. You may also designate an authorized agent to make a request on your behalf, subject to verification.

Residents of other U.S. states with comprehensive privacy laws (including but not limited to Colorado, Connecticut, Virginia, Utah, and Texas) have similar rights and may exercise them by contacting us at the same address.

Data Processing Addendum and International Data Transfers

Customers subject to the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection, or similar data protection laws may require Hermetiq to enter into a Data Processing Addendum (DPA). If you require a DPA, please contact legal@hermetiq.com and Hermetiq will work with you in good faith to put appropriate data-processing terms in place, including, where applicable, the EU Standard Contractual Clauses and UK International Data Transfer Addendum.

For Customers using an on-premises, self-hosted, or customer-hosted deployment of the Service, Hermetiq does not act as a processor of Customer Data, and no cross-border transfer of Customer Data occurs through Hermetiq.

Do Not Track Signals

Our Website does not currently respond to "Do Not Track" (DNT) browser signals because no consistent industry standard for DNT has been adopted. We treat all visitors consistently in accordance with this Privacy Policy, regardless of DNT setting.

Changes to this Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

We will let you know via email and/or a prominent notice on our Service, prior to the change becoming effective and update the "Last updated" date at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

If you have any questions about this Privacy Policy, you can contact us:

By email: info@hermetiq.com for general privacy questions, or legal@hermetiq.com for data subject rights and legal matters.