This policy explains how Samyam Ray, trading as Cerberon, of Chennai, Tamil Nadu, India (“Cerberon”, “we”, “us”) handles personal data. For the purposes of India’s Digital Personal Data Protection Act, 2023, we are the data fiduciary for the data described here.
The short version
- Cerberon is self-hosted software. We cannot see the data in your Cerberon instance. Your source code, credentials, findings and reports stay on your server.
- This website sets no advertising or tracking cookies, and our analytics do not use cookies.
- We collect what you send us through forms and email, the minimum needed to issue and check licences, and what you share during a services engagement.
- We do not sell personal data, and we do not share it for advertising.
What we collect and why
| Data | When | Why |
|---|---|---|
| Name, work email, company, country and your message | You fill in a form or email us | To reply, give a demo, quote and sell to you |
| Booking details | You book a demo | To hold the meeting |
| Licence holder name and contact email, a hash of the licence key, the machine identifier the licence is bound to, and licence status | You buy a licence and your instance checks it | To issue, validate, renew and support licences |
| Billing details | You pay an invoice | To invoice, collect payment and meet tax and accounting law |
| Personal data in systems you ask us to test, such as test accounts | You engage us for Services | Only to perform the engagement you asked for |
| Request logs from our hosting provider, such as IP address and browser type | You visit our websites | To keep the websites secure and working |
| Aggregate, cookieless page statistics | You visit our websites | To understand which pages are useful |
The licence service does not store your IP address or browser user agent. Your Cerberon instance does not send us your findings, code, targets or users.
We process personal data with your consent, which you give by sending it to us, and for the legitimate uses the law allows, such as performing a contract you asked for, meeting legal obligations, and keeping our systems secure. You may withdraw consent at any time by emailing us. This does not affect processing that already took place.
Who processes data for us
| Provider | What it does |
|---|---|
| Cloudflare | Hosts our websites and licence service, stores form submissions, protects against abuse and provides cookieless analytics |
| Zoho | Email, and demo bookings if you book through Zoho Bookings |
These providers act on our instructions and may process data in countries other than India, including the United States. We choose providers that protect data to a standard at least comparable to this policy. We may also disclose personal data where the law requires it, or to protect our rights, our customers or the public.
How long we keep it
- Enquiries that do not become customers: up to 24 months after our last contact.
- Customer, licence and billing records: for the life of the licence or relationship, then for as long as tax and accounting law requires, typically eight years.
- Services engagement data, such as credentials and test data: deleted within 30 days of the final report unless you ask us to keep it for a retest. Reports are kept for the life of the relationship unless you ask us to delete them.
- Hosting logs: as kept by our hosting provider, usually a few days to weeks.
Your rights
Depending on where you live, you may have the right to:
- access a summary of the personal data we hold about you and how we use it,
- correct, complete or update it,
- ask us to erase it, where we no longer need it or the law does not require us to keep it,
- withdraw consent you gave,
- nominate someone to exercise these rights for you, and
- complain to us, and then to the Data Protection Board of India or your local regulator.
United States residents. We do not sell personal information, and we do not share it for cross-context behavioural advertising. Residents of California and other states with privacy laws may request access to, correction of, or deletion of their personal information by emailing us. We will not treat you differently for exercising these rights.
To exercise any right, email privacy@cerberon.dev. We may ask you to confirm your identity. We reply within 30 days.
Grievance officer
Our grievance officer answers questions about how we process your personal data. Email privacy@cerberon.dev. We acknowledge grievances within 72 hours and aim to resolve them within 30 days.
Security
We protect personal data with access controls, encryption in transit and at rest where our providers support it, least-privilege access and prompt patching. No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.
Children
Our websites and products are for businesses and are not directed at anyone under 18. We do not knowingly collect children’s personal data.
Changes
We will post any change to this policy on this page with a new date. If a change is significant, we will tell customers by email.
Contact
Samyam Ray, trading as Cerberon, Chennai, Tamil Nadu, India. Email privacy@cerberon.dev.