Privacy policy

1. Who we are

ByteMantle makes a browser security extension and its web console. For the processing described here the controller is ByteMantle, Romania (“ByteMantle”, “we”).

Questions about privacy and requests about your data: dpo@bytemantle.com (our data protection contact). Anything else: info@bytemantle.com.

2. The short version

• The extension detects threats inside your browser. Used on its own, nothing leaves the browser.
• If you choose to connect it, only a short record of each detection is sent: what was found, how risky it is, the website address without anything after “?” or “#”, the sites that led to it, and a short piece of evidence. Never what you type, passwords, form contents or cookies. An organization that manages your browser can turn on more reporting (section 6).
• An account needs only an e-mail address and a password. We do not ask for payment details, a phone number or your address.
• This website has no cookies, no analytics and no trackers.
• Data is stored in the European Union. We do not sell data and do not use it for advertising.

3. This website

The legal bases named in the tables of this policy are those of Article 6(1) of the GDPR (Regulation (EU) 2016/679).

What	Why	Legal basis	How long
Server logs kept by our hosting provider: IP address, time, page requested, browser type	To deliver the site and protect it against abuse	Legitimate interest	The short period the hosting provider keeps its logs
Contact form: name, e-mail, company, topic, message	To answer you and, if you ask for it, to prepare an offer	Steps you ask for before a contract; legitimate interest in answering	Up to 24 months after our last exchange, unless a contract follows
A short-lived counter derived from your connection (a hash, not the IP address)	To limit how many messages the form accepts per hour	Legitimate interest	One hour

Your choice of colour theme is stored only in your own browser and never sent to us.

4. The browser extension

4.1 Without a connection

Detection runs locally. Security events, trusted sites and settings are stored in your browser, where you can see, export and delete them. To check how old a website is, the extension and the console ask public domain registries (RDAP and WHOIS) and public archives about the domain name only. To describe a smart contract it may look up the contract address in public blockchain services. None of these lookups contains information about you. To recognise an attack, the extension also looks, inside your browser, at the network requests a page makes (for example the redirects that led to it or a script loaded from a brand-new domain); this happens locally and is not recorded on its own.

4.2 When you choose to connect

On the welcome page you decide whether the extension connects to our console. If you accept, we receive:

• a random installation ID and a public key generated by the extension (they identify the installation, not you);
• the extension version, browser type and version, and operating-system type;
• for each detection: its type, rule and risk, the website address without query string or fragment, the time, and a short piece of evidence (for example the harmful command that a page tried to put on your clipboard);
• for each detection, how the attack reached the browser: the site the visit came from and the redirects on the way (host names only), and the scripts that loaded the harmful page (their addresses, without query string or fragment);
• a device name, only if you or your organization chose one;
• the IP address your browser connects from (only the latest one is kept, with the browser’s record), to protect the service against abuse and to help with connection problems;
• if you leave the second box ticked: the risk ratings of websites that the extension had already collected;
• periodic health information (the extension is running, its queue, its version).

We do not receive passwords, what you type, form contents, cookies or your computer’s own name, and, unless an organization that manages your browser turns on the options in section 6, we do not receive the other pages you visit or your browsing history.

Purpose and legal basis. To show detections in a console, to correlate attacks across browsers and to improve protection for all users. The legal basis is your consent, given on the welcome page, and, with an account, the contract. You can withdraw consent at any time in the extension’s Settings (“Disconnect this browser” or stop sending detections); protection continues locally.

How long. Detection records are deleted automatically after the history period of the plan: 30 days for Free and Pro, 90 days for Business, 365 days for Enterprise (an organization can choose a shorter period). The browser’s record, with its latest IP address, is kept until the browser is removed from the console or the account is deleted.

5. Accounts and the free trial

What	Why	Legal basis	How long
E-mail address, optional name, password (stored only as a salted hash), date you accepted the terms	To create and secure your account and connect your browsers to it	Contract	Until you delete the account
Confirmation code and links sent by e-mail	To confirm the address is yours and to reset a password	Contract	30 minutes (code), 24 hours (confirmation link), 1 hour (reset link)
The network part of your IP address at sign-up and trial start (for example 203.0.113.0/24), and a keyed hash of your normalised e-mail address	To prevent fraud: mass sign-ups and repeated free trials	Legitimate interest in preventing abuse	The hash: 24 months; the network part: with the account record
Your browsers connected to the account (installation ID, browser and OS type, name, last seen)	To apply your plan to them and show them in your console	Contract	Until you remove the browser or delete the account
Sign-in and security records (time, success or failure, the IP address used)	To protect your account and investigate misuse	Legitimate interest	Up to 12 months

From your account page you can download all your data (JSON) and delete the account. Deletion removes your console data and replaces your e-mail address and name with placeholders at once; only the keyed hash above stays, to prevent repeated trials.

6. The console (organizations)

When an organization (for example your employer) connects its browsers to the console, the organization decides what is collected and for how long. For that data the organization is the controller and we are its processor, under our Data Processing Agreement. If your browser is managed by an organization, contact it first about your data; we help it answer you.

Besides the detections described in section 4.2, an organization can turn on, in its policy:

• full addresses: website addresses are sent with their query string, instead of without it;
• resource telemetry: for the pages its browsers open, the addresses of the resources a page loads (without query string unless full addresses are on), the IP addresses of the servers that answered and the status of the requests, to investigate an attack across its browsers;
• site technology (Enterprise plan): once a day per website visited, the website’s host name and the software it reports (server and framework names and versions from the response headers or a default error page, the names of its cookies without their values), to show the organization which servers its people rely on and which are out of date.

Each of these is off until the organization turns it on. An organization can also stop the evidence of detections from being sent, and forward the events to its own SIEM.

For the people who use the console we process their username, name, e-mail address, role, sign-in times, two-step sign-in settings and the actions they take with the IP address used (audit log), to provide and secure the service.

7. Cookies

• This website: none.
• Console and account pages: a session cookie needed to stay signed in (deleted when you sign out or after a period of inactivity) and a cookie that remembers the colour theme you chose. Both are strictly necessary or set at your request; no consent banner is needed and none are used for tracking.
• Extension: uses the browser’s own extension storage, not cookies.

8. Who else receives data

• Our hosting provider (data centre in the European Union): hosting of the website, the console and our e-mail, with servers in European Union. It acts as our processor.
• Destinations an organization sets up itself, for example its SIEM. These are chosen and controlled by the organization.
• Authorities, only when the law requires it.

We list our processors on the GDPR page and announce changes there before they apply.

9. Where the data is kept

All data we control is stored in the European Union. We do not transfer personal data outside the European Economic Area. The public lookups described in section 4.1 contain domain names or contract addresses only.

10. Security

Encrypted connections (HTTPS) everywhere; passwords stored only as hashes; browser connections signed with a key that never leaves the browser; signed licences and policies; two-step sign-in in the console; role-based access and an audit log; minimised data by design. Details: DPA, Annex 2. Please report vulnerabilities to info@bytemantle.com.

11. Your rights

Under the GDPR you may ask us for access to your data, its correction or deletion, to restrict or object to its use, and to receive it in a portable format. Where we rely on consent you may withdraw it at any time, without affecting what happened before. Write to dpo@bytemantle.com; we answer within one month. We may ask you to confirm that the request comes from you.

You can also complain to a data protection authority. In Romania this is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, www.dataprotection.ro; you may also contact the authority where you live or work.

We do not make decisions about people based solely on automated processing that have legal or similarly significant effects. The extension’s automatic decisions concern websites and commands (for example blocking a harmful paste), not you.

12. Children

Accounts are for people aged 16 or older. The extension can protect a family computer without an account.

13. Changes

When we change this policy we update the date at the top. Material changes are announced on this website and, for account holders, by e-mail before they apply.