Privacy Policy

1. Introduction and scope

Effective date: November 6, 2026
Last updated: November 6, 2026

ZeroCeption LLC ("ZeroCeption," "we," "us" or "our") provides XSPM, an Extended Security Posture Management platform that helps organizations see and reduce risk across cloud, identity, application, data, AI, endpoint, vulnerability and compliance domains. This Privacy Policy explains how we collect, use, share and protect personal information, and the choices and rights available to you.

This policy applies to personal information we process when you:

• visit zeroception.io, zclogin.com (our platform sign-in site), or any other website that links to this policy (the "Sites");
• request a demo, security assessment, briefing, whitepaper, data sheet or other content;
• use the XSPM platform and related services (the "Services");
• register for or attend an event or webinar, or visit our booth;
• communicate with us by email, video call or social media; or
• work with us as a channel partner, reseller or supplier.

Our two roles. When we decide why and how personal information is processed, such as for our Sites, marketing, sales and account administration, we act as a controller (or "business"). When our customers connect their cloud accounts, identity providers, code repositories, endpoints, data stores and other systems to XSPM, we process the resulting information on their behalf and under their instructions. In that case we act as a processor (or "service provider"), and the customer's own privacy notice and our agreement with the customer govern that processing. Section 3 explains this in more detail.

This policy does not cover the privacy practices of our customers, partners or any third-party site or service we link to. Nothing in this policy limits any right you have under applicable law.

2. Information we collect

We collect business contact and usage information from you directly, automatically when you use our Sites and Services, and from our channel partners, event organizers and LinkedIn. Most of it relates to you in your professional capacity.

Sensitive personal information. We do not ask for sensitive personal information on our Sites, such as Social Security numbers, health information or precise geolocation. Please do not submit it through our forms. Information that customers connect to the XSPM platform may contain sensitive data; that is Customer Data and is covered in Section 3.

Photos at events. If you would prefer not to be photographed or filmed at our booth, tell our staff and we will respect that.

If you choose not to provide certain information, we may not be able to respond to your request, provide a demo or give you access to the Services.

3. Customer Data processed in the XSPM platform

When a customer connects its environment to XSPM, we process the resulting data only to provide the Services to that customer, under its instructions and our agreement with it. We call this "Customer Data."

If this policy and a customer agreement or Data Processing Agreement (DPA) say different things about Customer Data, the customer agreement or DPA governs.

What Customer Data can include. Depending on which modules and integrations a customer enables, Customer Data may include personal information that already exists in the customer's systems, such as:

• user, identity and account records from cloud platforms, Microsoft 365, Google Workspace and identity providers (names, usernames, email addresses, roles, permissions, sign-in activity);
• code repository metadata from GitHub, GitLab or Bitbucket (contributor names, commit authors, and secrets or credentials detected in code);
• endpoint information from enrolled devices (hostnames, local user accounts, installed software, IP addresses, configuration and file integrity events), collected through an agent the customer installs;
• results of data discovery and classification, including the location, owner and access paths of sensitive records, and short evidence excerpts that show why a classifier matched;
• AI usage information, such as the AI tools in use, prompts and uploaded files inspected for sensitivity, and the identities and agents involved; and
• vulnerability, asset ownership and audit-log information.

How we handle it.

• We process Customer Data only to provide, secure, support and improve the Services for that customer, as described in our customer agreement and DPA.
• We do not sell Customer Data or share it for advertising, and we do not use it to market to the individuals it concerns.
• Customer Data is hosted on Amazon Web Services (AWS) in the United States. Aurora AI processes it within our own environment and does not send it to outside AI model providers.
• We do not use Customer Data to train AI models that are shared with, or used for, other customers.
• Access by ZeroCeption personnel is limited to what is needed to operate and support the Services, and is logged.
• When a customer's subscription ends, we delete Customer Data within 90 days, unless the law requires us to keep it longer.

Your rights over Customer Data. If your information is in a customer's environment, that customer controls it. Please send privacy requests to that organization. If you contact us instead, we will refer you to the customer, or forward your request to it where we can identify it, and assist the customer as our agreement requires.

Data from Google Workspace and Microsoft 365. When a customer connects Google Workspace or Microsoft 365 to XSPM through their APIs, we apply these extra commitments to the data we receive:

• We use it only to provide and improve the XSPM features the customer has enabled.
• We do not sell it or use it for advertising of any kind, including retargeting or interest-based ads.
• We transfer it to others only as needed to provide those features, to comply with law, or as part of a merger or acquisition with the customer's prior consent.
• We do not use it to build, train or improve generalized AI or machine-learning models.
• Our personnel do not read it except with the customer's permission, for security purposes, or where the law requires.

ZeroCeption's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use information

We use the information described in Section 2 for the following purposes:

• Provide the Services. Set up and manage accounts, authenticate users, deliver the XSPM platform, and provide customer support.
• Respond to requests. Schedule demos, security assessments and briefings, send requested content, and answer questions.
• Communicate with you. Send service notices, security alerts, administrative messages, and changes to our terms or policies.
• Improve sales and support. When we record a call with notice, use the recording to keep accurate notes, train our team and improve quality.
• Market our products. Send newsletters, event invitations and product updates, and measure how they perform. You can opt out at any time (Section 11).
• Advertise. With your consent, show relevant ads on LinkedIn and measure ad results, using the LinkedIn Insight Tag (Section 7). This may count as "targeted advertising" or "sharing" under some state laws.
• Understand and improve. Analyze how visitors use our Sites and how customers use the Services, using Cloudflare Web Analytics and, with your consent, Google Analytics, so we can fix problems and improve our content and products.
• Run events and partnerships. Follow up after events and booth visits, administer giveaways under their official rules, use event photos and video in our marketing and social media, and work with channel partners on orders and joint opportunities.
• Protect our business and users. Monitor for fraud, abuse and security incidents, and protect the integrity of our Sites and Services.
• Meet legal obligations. Keep business records, respond to lawful requests, enforce our agreements, and establish or defend legal claims.

We may create de-identified or aggregated information that no longer identifies you, and use it for any lawful purpose. We will keep it de-identified and will not attempt to re-identify it, except as the law allows.

5. AI-assisted features and automated processing

The Services include Aurora AI, which analyzes Customer Data to correlate findings, score risk, summarize evidence and suggest remediation steps.

• Aurora AI runs inside ZeroCeption's own environment on AWS in the United States. Customer Data is not sent to outside AI model providers.
• Aurora AI outputs are recommendations for the customer's security team. People at the customer decide what action to take.
• We do not use AI or other automated processing to make decisions about individuals that produce legal or similarly significant effects, such as decisions about employment, credit, housing, insurance or access to essential services.
• We do not use automated processing to profile visitors or contacts beyond the analytics and advertising described in Sections 4 and 7.

6. How we share information

We do not sell personal information for money. We share it only with the recipients below, and we require service providers and partners by contract to protect it and use it only for the purposes we allow.

We may also share information with your consent or at your direction.

Advertising and analytics. Google Analytics and the LinkedIn Insight Tag load only if you agree in our cookie settings. When they run, they collect information about your visits directly from your browser. Under some state laws, this can be a "sale" of personal information or "sharing" for targeted (cross-context behavioral) advertising. You can withdraw your consent at any time (Section 7). The categories involved are device and usage data and, for LinkedIn, the fact that a LinkedIn member visited our Sites.

7. Cookies and similar technologies

Analytics and advertising cookies run on our Sites only if you agree. Strictly necessary cookies always run, because the Sites need them to work.

When you first visit, a cookie settings panel asks for your choice. Until you choose, only strictly necessary technologies run. You can change your choice at any time through the Cookie Settings link in the footer of our Sites.

We also use Cloudflare Web Analytics to count visits and measure site performance. It does not use cookies.

How we remember your choice. We store your cookie choices in a first-party cookie on our Sites. Choices apply only to the browser and device you make them on. If you clear your cookies or use another browser, we will ask again.

Other ways to control cookies.

• Install the Google Analytics opt-out browser add-on to stop Google Analytics on all websites.
• Manage LinkedIn ad personalization in your LinkedIn account's advertising settings.
• Block or delete cookies in your browser settings. Some site features, including sign-in, may not work if you block all cookies.

Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a refusal of analytics and advertising cookies for that browser. Those tools stay off, and we do not show the cookie settings panel.

Do Not Track. There is no common industry standard for "Do Not Track" browser signals, so we do not respond to them. We do honor GPC as described above.

8. Data retention

We keep personal information only as long as we need it for the purposes in this policy, then delete or de-identify it. These are our standard periods; we may keep information longer where the law requires it or to resolve a dispute.

9. Data security

We use administrative, technical and physical safeguards designed to protect personal information against loss, misuse and unauthorized access, disclosure, alteration or destruction. These include:

• encryption of data in transit and at rest;
• role-based access controls and least-privilege access for our personnel;
• logging and monitoring of access to production systems and Customer Data;
• vulnerability management, secure software development practices and regular security testing;
• security reviews and contractual security requirements for service providers; and
• security and privacy training for our personnel.

No system is completely secure, and we cannot guarantee the security of information sent to us over the internet. If we learn of a security incident affecting your personal information, we will notify you and the relevant authorities as the law and our contracts require.

You also help keep your account safe. Use your organization's single sign-on or a strong, unique password, keep your credentials confidential, and tell us right away at [email protected] if you suspect unauthorized use of your account.

10. Where we process information

ZeroCeption is based in the United States, and our Sites and Services are intended for organizations and individuals in the United States. We store and process personal information and Customer Data in the United States.

If you access our Sites from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country. Some of our service providers may access information from other countries to provide support; where they do, we require them by contract to protect it as described in this policy.

11. Your privacy rights and choices

Many US states give residents rights over their personal information. We honor the requests below from any US resident, subject to legal exceptions, even if your state's law does not require it.

Marketing choices. You can unsubscribe from marketing emails at any time with the link in each email or by emailing us. We will still send service and account messages if you are a customer.

How to make a request. Email [email protected] with the subject "Privacy Request." To withdraw consent for analytics or advertising, use the Cookie Settings link in the footer of our Sites, or turn on Global Privacy Control in your browser.

Verification. To protect you, we verify requests by matching information you give us with information we hold, such as your email address. We may ask for more detail for access, correction and deletion requests. Opt-out requests do not need verification.

Authorized agents. You may use an authorized agent. We may ask the agent for signed permission from you and ask you to verify your identity directly with us.

Timing. We respond within 45 days. If we need more time, up to another 45 days, we will tell you why.

Deleting your account. Your organization's administrator can remove your XSPM user account. You can also ask us to delete it by emailing [email protected]. If the account belongs to a customer, we may confirm with that customer first.

Fees. Requests are free. Where the law allows, we may charge a reasonable fee or decline a request that is clearly unfounded, excessive or repeated, and we will tell you why.

Appeals. If we deny your request, you can appeal by replying to our decision or emailing [email protected] with the subject "Privacy Appeal" within 60 days. We will respond within the time your state's law requires, usually 45 or 60 days. If you disagree with the outcome, you may contact your state attorney general.

No discrimination. We will not deny you service, charge you a different price or give you a lower quality of service because you exercised your privacy rights.

12. Additional disclosures for US state residents

This section gives the specific disclosures that California and other state privacy laws require. It covers the 12 months before the "Last updated" date above.

The sources, purposes and retention periods for each category are described in Sections 2, 4 and 8.

• Sensitive information. We use account log-in credentials only to provide and secure the Services, not to infer characteristics about you, so the California right to limit does not apply.
• Minors. We do not knowingly sell or share the personal information of anyone under 16.
• California "Shine the Light." We do not share personal information with third parties for their own direct marketing.
• Nevada. We do not sell covered information as Nevada law defines it. You may still send an opt-out request to [email protected].
• Delaware and other states. Where your state gives you rights not listed here, such as Delaware's right to learn about inferences and consequential profiling, the request process in Section 11 applies.

13. Children's privacy

Our Sites and Services are designed for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.

14. Third-party sites, integrations and partners

Our Sites may link to other websites, and the Services connect to third-party platforms that customers choose to integrate, such as cloud providers, identity providers and code repositories. Those third parties have their own privacy practices, which this policy does not cover. Please review their privacy notices.

If you buy through one of our channel partners, that partner also handles your order and billing information under its own privacy notice.

15. Changes to this policy

We may update this policy as our practices, Services or the law change. We will post the new version on this page and change the "Last updated" date. If we make a material change, we will tell you in advance by email or a prominent notice on our Sites, and get your consent where the law requires it.

16. Contact us

For questions about this policy or to exercise your privacy rights, contact:

ZeroCeption LLC
Attn: Privacy
8 The Green, Ste A
Dover, DE 19901
United States

Privacy requests and questions: [email protected]
General inquiries: [email protected]

This policy is available in an accessible format on request.