# OctetKeep Privacy Notice

**Effective date:** 2026-08-16
**Controller:** Elementary Inc.

This Privacy Notice describes how Elementary Inc. processes personal data in connection with the OctetKeep website, purchases, licenses, support and security reporting.

## 1. Product analysis boundary

The OctetKeep local forensic runtime is designed to operate without sending customer forensic inputs to Elementary Inc. by default. Product-analysis telemetry, advertising tracking and device fingerprinting are not part of the admitted runtime.

## 2. Business data we may process

Depending on the service used, we may process contact details, account or transaction identifiers, license and entitlement information, support communications, security reports, legal acceptance records and information required for tax, accounting, fraud prevention and legal compliance.

## 3. Purposes

Processing may be used to provide the website and software, process purchases and licenses, provide support, handle security reports, maintain legal records, prevent fraud and abuse, comply with legal obligations, and protect the rights and security of Elementary Inc. and its users.

## 4. Legal bases

Where GDPR applies, the applicable legal basis may include performance of a contract or steps requested before contract, compliance with a legal obligation, legitimate interests where permitted and not overridden by the individual's rights, and consent where consent is required.

## 5. Recipients and service providers

Personal data may be shared with service providers acting on our instructions, payment and tax service providers where used, hosting and infrastructure providers, professional advisers, competent authorities where legally required, and other recipients necessary to provide the requested service. Current processor/subprocessor details are maintained in the internal vendor register and are updated when material processing arrangements change.

## 6. International transfers

Where personal data are transferred outside the EEA or another protected jurisdiction, Elementary Inc. applies an appropriate lawful transfer mechanism where required, together with the safeguards required by applicable law.

## 7. Retention

We retain business records only for as long as required for their purpose, legal obligations, accounting, dispute handling, security and the establishment or defence of claims. Retention schedules are maintained internally.

## 8. Your rights

Subject to applicable law, individuals may have rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent, and the right to complain to a competent supervisory authority.

## 9. Automated decisions

We do not intend to use customer forensic input to make automated decisions about individuals. Any material automated decision covered by applicable law will be separately assessed and disclosed where required.

## 10. Security

Security measures are selected according to the nature and risk of the processing. Security issues may be reported under the Security Vulnerability Disclosure Policy.

## 11. Contact

Privacy requests may be made through the current legal/support contact channel published on the OctetKeep website.

**Elementary Inc. — OctetKeep.**