GDPR | ByteMantle

We build security software, so we start from the assumption that the safest data is the data we never collect. This page explains how ByteMantle applies the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) to the ByteMantle extension, accounts and the console.

1. Who is responsible for what

We are the controller for this website, for accounts of individual users, and for the anonymous detection records of browsers connected without an organization.
We are a processor when an organization connects its browsers to its own console tenant. The organization is the controller; our Data Processing Agreement applies.
Self-hosted consoles run on the organization’s own server; we do not receive that data at all.

2. How the principles are built in

Minimisation: detection happens in the browser. Only a short record of each detection leaves it, and only after the user or the organization chooses to connect. Website addresses are cut before “?” and “#” unless an organization turns on full addresses for its own browsers; credentials that appear in addresses are removed before storage. Extra telemetry (resource and site technology) is off until an organization turns it on.
Purpose limitation: the data is used to protect users and show detections to whoever owns the console. No advertising, no profiling for marketing, no sale of data.
Storage limitation: detection records are deleted automatically after the plan’s history period (30, 90 or 365 days, or shorter if the organization chooses).
Integrity and confidentiality: HTTPS everywhere, signed browser connections, hashed passwords, two-step sign-in, role-based access and audit logs (see DPA Annex 2).
Transparency: the welcome page of the extension states what is sent and what is not, before anything is sent.

3. Legal bases

Connecting the extension: consent, withdrawable at any time in the extension’s Settings.
Accounts, trials and paid plans: contract.
Abuse prevention (sign-up limits, repeated trials) and security logs: legitimate interest, balanced by keeping only network prefixes and keyed hashes.
Records we must keep by law: legal obligation.

These are the legal bases of Article 6 of the GDPR (Regulation (EU) 2016/679); the rights below are those of its Articles 15 to 22.

4. Your rights, in practice

Right	How
Access and portability	Account page → Download my data (JSON). Or write to us.
Erasure	Account page → Delete my account. Local extension data: Settings → clear history, or uninstall.
Rectification	Account page or console → My account.
Withdraw consent / object	Extension Settings → stop sending detections or Disconnect this browser.
Restriction	Write to dpo@bytemantle.com.

We answer within one month. If your browser is managed by an organization, that organization is the controller for its console data; we forward your request to it and help it answer.

5. Sub-processors

Sub-processor	Purpose	Location
Our hosting provider, data centre in the European Union	Hosting of the website, the console and our e-mail	European Union

We announce a new sub-processor on this page at least 30 days before it starts processing customer data. Organizations with a DPA can object during that period (DPA section 7).

6. International transfers

We do not transfer personal data outside the European Economic Area. Should that ever change, it would happen only with the safeguards of Chapter V GDPR (adequacy decision or standard contractual clauses) and after notice on this page.

7. Security incidents

If a personal data breach affects data we process for an organization, we inform the organization without undue delay and in any case within 48 hours of becoming aware of it, with the information it needs for its own notification. Where we are the controller we notify the supervisory authority within 72 hours where required, and affected people when the risk is high.

8. Contact

Data protection contact: dpo@bytemantle.com. Supervisory authority in Romania: ANSPDCP, www.dataprotection.ro.