Privacy at a Glance

This section provides a simplified summary of our privacy policy. For complete details, please read the full policy below.

Disclosure Regarding Customer Information

This Privacy Policy does not apply to the personal information that we process on behalf of our customers pursuant to a written agreement we have entered into with such customers ("Customer Information"). Our customers' respective privacy notices or policies govern their collection and use of Customer Information. Our processing of Customer Information is governed by the contracts that we have in place with our customers, not this Privacy Policy.

Contents

• Interpretation and Definitions
• Collecting and Using Your Personal Data
• Detailed Information on the Processing of Your Personal Data
• Information About Third-Party Extensions and Their Developers
• GDPR Privacy
• CCPA / CPRA Privacy Notice (California Privacy Rights)
• Singapore PDPA Privacy Notice
• "Do Not Track" Policy as Required by California Online Privacy Protection Act (CalOPPA)
• Your California Privacy Rights (California's Shine the Light law)
• California Privacy Rights for Minor Users (California Business and Professions Code Section 22581)
• Children's Privacy
• Links to Other Websites
• Changes to this Privacy Policy
• Contact Us

Privacy Policy

Last updated: May 7, 2026

This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You. We use Your Personal data to provide and improve the Service. By using the Service, You agree to the collection and use of information in accordance with this Privacy Policy.

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

• Account means a unique account created for You to access our Service or parts of our Service.
• Affiliate means an entity that controls, is controlled by or is under common control with a party, where "control" means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.
• Business, for the purpose of CCPA/CPRA, refers to the Company as the legal entity that collects Consumers' personal information and determines the purposes and means of the processing of Consumers' personal information, or on behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers' personal information, that does business in the State of California.
• CCPA and/or CPRA refers to the California Consumer Privacy Act (the "CCPA") as amended by the California Privacy Rights Act of 2020 (the "CPRA").
• Company (referred to as either "the Company", "We", "Us" or "Our" in this Agreement) refers to Alpha CISO Pte. Ltd, #14-04, SBF Center, 160 Robinson Road, Singapore, 068914.

For the purpose of the GDPR, the Company is the Data Controller.

• Consumer, for the purpose of the CCPA/CPRA, means a natural person who is a California resident. A resident, as defined in the law, includes (1) every individual who is in the USA for other than a temporary or transitory purpose, and (2) every individual who is domiciled in the USA who is outside the USA for a temporary or transitory purpose.
• Cookies are small files that are placed on Your computer, mobile device or any other device by a website, containing the details of Your browsing history on that website among its many uses.
• Country refers to: Singapore
• Data Controller, for the purposes of the GDPR (General Data Protection Regulation), refers to the Company as the legal person which alone or jointly with others determines the purposes and means of the processing of Personal Data.
• Device means any device that can access the Service such as a computer, a cellphone or a digital tablet.
• Do Not Track (DNT) is a concept that has been promoted by US regulatory authorities, in particular the U.S. Federal Trade Commission (FTC), for the Internet industry to develop and implement a mechanism for allowing internet users to control the tracking of their online activities across websites.
• GDPR refers to EU General Data Protection Regulation.
• PDPA refers to the Singapore Personal Data Protection Act 2012, as amended, including its subsidiary legislation and binding advisory guidelines issued by the Personal Data Protection Commission of Singapore.
• Personal Data is any information that relates to an identified or identifiable individual.

For the purposes of GDPR, Personal Data means any information relating to You such as a name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity.

For the purposes of the CCPA/CPRA, Personal Data means any information that identifies, relates to, describes or is capable of being associated with, or could reasonably be linked, directly or indirectly, with You.

• Service refers to the Website.
• Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analyzing how the Service is used. For the purpose of the GDPR, Service Providers are considered Data Processors.
• Third-party Social Media Service refers to any website or any social network website through which a User can log in or create an account to use the Service.
• Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
• Website refers to Extension Auditor, accessible from https://extensionauditor.com
• You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Under GDPR, You can be referred to as the Data Subject or as the User as you are the individual using the Service.

Collecting and Using Your Personal Data

Types of Data Collected

We organize the categories of data We collect by the source of the data: information You provide to Us directly, information We collect automatically as You use the Service, information We obtain from third-party sources, and information collected through cookies and similar technologies.

Information You Provide to Us

We collect personal information that You voluntarily provide to Us when You register an account, request customer support, contact Us, or otherwise interact with the Service.

Account Information

When You register an account, We collect:

• Email address
• First and last name
• Password (hashed using industry-standard algorithms; We never store plaintext passwords)
• Optional profile information You choose to provide (display name, avatar, time-zone, language preference)

Payment Information

When You subscribe to a paid plan, payment is processed by Stripe. We do not store or directly collect Your payment card details. We receive transaction metadata from Stripe — such as Your billing email, billing name, the last four digits of Your payment card, and the status of Your subscription — for the purposes of account management, invoicing, and tax reporting.

When You pay via bank transfer, We may additionally collect information necessary to facilitate the transaction and to verify Your identity, including without limitation Your bank account information.

Your Communications with Us

If You contact Us via the contact form, support email, feedback channels, or other communication mechanisms, We collect the personal information You include in Your communication — such as Your name, email address, and the contents of Your message — as well as any attachments or screenshots You provide.

Information We Collect Automatically

We collect certain information automatically as You use the Service.

Device Information

When You access the Service, We automatically collect information about Your device, including Your Internet Protocol (IP) address, browser type and version, operating system, screen resolution, language preference, time zone, and other technical metadata sent by Your browser.

Usage Information

We collect information about how You interact with the Service — such as the pages You visit, the time and date of Your visit, the time spent on each page, the links You click, the actions You take, search queries You submit, and other diagnostic data.

Mobile Device Information

When You access the Service from a mobile device, We may additionally collect the type of mobile device, mobile device unique identifier, mobile operating system, type of mobile Internet browser, and other mobile device identifiers.

Information from Third-Party Sources

Third-Party Social Media Services (OAuth)

We allow You to create an account and log in to the Service through the following Third-Party Social Media Services:

• Google
• GitHub
• Apple

If You decide to register through or otherwise grant Us access to a Third-Party Social Media Service, We may collect Personal Data that is already associated with Your Third-Party Social Media Service account, such as Your name and email address.

You may also have the option of sharing additional information with Us through Your Third-Party Social Media Service account. If You choose to provide such information and Personal Data, during registration or otherwise, You are giving Us permission to use, share, and store it in a manner consistent with this Privacy Policy.

Cookies and Other Tracking Technologies

We use Cookies and similar tracking technologies to track the activity on Our Service and store certain information. Tracking technologies used are beacons, tags, and scripts to collect and track information and to improve and analyze Our Service. The technologies We use may include:

• Cookies or Browser Cookies. A cookie is a small file placed on Your Device. You can instruct Your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if You do not accept Cookies, You may not be able to use some parts of our Service. Unless you have adjusted Your browser setting so that it will refuse Cookies, our Service may use Cookies.
• Web Beacons. Certain sections of our Service and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit Us, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of a certain section and verifying system and server integrity).

Cookies can be "Persistent" or "Session" Cookies. Persistent Cookies remain on Your personal computer or mobile device when You go offline, while Session Cookies are deleted as soon as You close Your web browser.

You can learn more about cookies on Cloudflare website article.

We use both Session and Persistent Cookies for the purposes set out below:

• Necessary / Essential Cookies

Type: Session Cookies

Administered by: Us

Purpose: These Cookies are essential to provide You with services available through the Website and to enable You to use some of its features. They help to authenticate users and prevent fraudulent use of user accounts. Without these Cookies, the services that You have asked for cannot be provided, and We only use these Cookies to provide You with those services.

• Cookies Policy / Notice Acceptance Cookies

Type: Persistent Cookies

Administered by: Us

Purpose: These Cookies identify if users have accepted the use of cookies on the Website.

• Functionality Cookies

Type: Persistent Cookies

Administered by: Us

Purpose: These Cookies allow us to remember choices You make when You use the Website, such as remembering your login details or language preference. The purpose of these Cookies is to provide You with a more personal experience and to avoid You having to re-enter your preferences every time You use the Website.

• Tracking and Performance Cookies

Type: Persistent Cookies

Administered by: Third-Parties

Purpose: These Cookies are used to track information about traffic to the Website and how users use the Website. The information gathered via these Cookies may directly or indirectly identify you as an individual visitor. This is because the information collected is typically linked to a pseudonymous identifier associated with the device you use to access the Website. We may also use these Cookies to test new pages, features or new functionality of the Website to see how our users react to them.

For more information about the cookies we use and your choices regarding cookies, please visit our Cookies Policy or the Cookies section of our Privacy Policy.

Use of Your Personal Data

We may use Personal Data for the following purposes:

• To provide and maintain our Service, including to monitor the usage of our Service.
• To manage Your Account: to manage Your registration as a user of the Service. The Personal Data You provide can give You access to different functionalities of the Service that are available to You as a registered user.
• For the performance of a contract: the development, compliance and undertaking of the purchase contract for the products, items or services You have purchased or of any other contract with Us through the Service.
• To contact You: To contact You by email, telephone calls, SMS, or other equivalent forms of electronic communication, such as a mobile application's push notifications regarding updates or informative communications related to the functionalities, products or contracted services, including the security updates, when necessary or reasonable for their implementation.
• To provide You with news, special offers and general information about other goods, services and events which we offer that are similar to those that you have already purchased or enquired about unless You have opted not to receive such information.
• To manage Your requests: To attend and manage Your requests to Us.
• For business transfers: We may use Your information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by Us about our Service users is among the assets transferred.
• For other purposes: We may use Your information for other purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns and to evaluate and improve our Service, products, services, marketing and your experience.

We may share Your personal information in the following situations:

• With Service Providers: We share Your personal information with the third-party service providers identified in the "Detailed Information on the Processing of Your Personal Data" section below — strictly for the purposes set out there (hosting, security, error reporting, payments, email delivery).
• For business transfers: We may share or transfer Your personal information in connection with, or during negotiations of, any merger, sale of Our assets, financing, or acquisition of all or a portion of Our business to another company. Where required, We will provide notice before personal information is transferred and becomes subject to a different privacy policy.
• For legal reasons or to protect rights: We may disclose Your personal information where required by law or where reasonably necessary to comply with legal process, enforce Our agreements, prevent fraud, or protect the rights, property, or safety of Us, Our users, or the public.
• With Your consent: We may disclose Your personal information for any other purpose with Your consent.

Retention of Your Personal Data

We retain Personal Data only for as long as necessary for the purposes set out in this Privacy Policy. The following retention periods apply:

When the applicable retention period expires, We securely delete or anonymize the data. Where We are subject to a legal hold or ongoing dispute, We may retain the affected records until the matter is resolved.

Transfer of Your Personal Data

Your information, including Personal Data, is processed at Our operating offices and in any other places where the parties involved in the processing are located. It means that this information may be transferred to — and maintained on — computers located outside of Your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from Your jurisdiction.

Your consent to this Privacy Policy followed by Your submission of such information represents Your agreement to that transfer.

We will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy and no transfer of Your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of Your data and other personal information.

Delete Your Personal Data

You have the right to delete or request that We assist in deleting the Personal Data that We have collected about You.

Our Service may give You the ability to delete certain information about You from within the Service.

You may update, amend, or delete Your information at any time by signing in to Your Account, if you have one, and visiting the account settings section that allows you to manage Your personal information. You may also contact Us to request access to, correct, or delete any personal information that You have provided to Us.

Please note, however, that We may need to retain certain information when we have a legal obligation or lawful basis to do so.

Disclosure of Your Personal Data

Business Transactions

If We are involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law enforcement

Under certain circumstances, We may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other legal requirements

We may disclose Your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend Our rights or property
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of Users of the Service or the public
• Protect against legal liability

Security of Your Personal Data

The security of Your Personal Data is a priority for Us. We use appropriate physical, technical, and administrative controls to protect the data we are responsible for. This includes, but is not limited to:

• Encryption: Encrypting data both in transit and at rest.
• Access Control: Implementing strict access controls to ensure that only authorized personnel have access to Your Personal Data.
• Secure Infrastructure: Leveraging secure cloud infrastructure from industry-leading service providers.
• Vendor Vetting: Taking appropriate steps to ensure that our vendors and partners adopt consistent and high standards of security and data protection.

While We strive to use commercially acceptable means to protect Your Personal Data, no method of transmission over the Internet or method of electronic storage is 100% secure. However, we are committed to continuously improving our security measures to protect your information.

Detailed Information on the Processing of Your Personal Data

The Service Providers We use may have access to Your Personal Data. These third-party vendors collect, store, use, process and transfer information about Your activity on Our Service in accordance with their Privacy Policies.

To make this clearer, here is a summary of the data we collect, why we collect it, and who we share it with:

Error Reporting

We use error reporting services to identify and fix errors in Our application. Error reporting is treated as essential to the security and reliability of the Service and is enabled regardless of cookie-consent choice.

• Sentry

Sentry is an error reporting service. We deploy the Sentry browser SDK on Our Service, which captures information about errors that occur during Your session — including the error message and stack trace, the URL where the error occurred, the browser type and version, and Your IP address. Sentry may set local-storage entries on Your device for error correlation. We do not use Sentry's session-replay or performance-profiling integrations. Source-map redaction and PII scrubbing are applied to limit the personal data captured.

For more information on the privacy practices of Sentry, please visit their Privacy Policy: https://sentry.io/privacy/

Analytics

Subject to Your cookie-consent choice (see "Cookies and Other Tracking Technologies" above), We use the following analytics technologies. Both are loaded only after You accept analytics cookies via Our cookie banner.

• Umami Analytics (self-hosted, with optional session replay)

Umami is a privacy-focused analytics platform. We host Umami ourselves on Our Hetzner infrastructure, so analytics data does not leave our infrastructure for a third-party SaaS. With Your consent, We additionally enable Umami's session-replay feature ("recorder.js"), which records anonymized interactions with Our website to help Us understand how the Service is used and improve it. Recordings apply moderate masking of input fields and have a maximum duration of 20 minutes.

• Cloudflare Web Analytics

Cloudflare Web Analytics is a privacy-friendly, cookie-less web-analytics product that collects high-level page-view and performance metrics about Your visit (e.g., page URL, referrer, browser type, device type, country derived from IP, and basic timing information) without using persistent identifiers.

For more information on the privacy practices of Cloudflare, please visit their Privacy Policy: https://www.cloudflare.com/privacypolicy/

Hosting and Infrastructure

The Service is self-hosted on dedicated server infrastructure provided by Hetzner Online GmbH ("Hetzner"). Hetzner provides the underlying compute, storage, and network resources but does not access or process the personal data stored on Our systems in the ordinary course. Hetzner's data centers are located in Germany and Finland, both within the European Economic Area (EEA), and are subject to the GDPR. We have entered into Hetzner's standard Data Processing Agreement.

For more information on the privacy practices of Hetzner, please visit their Privacy Policy: https://www.hetzner.com/legal/privacy-policy/

Database and Authentication

We operate Our own database and authentication infrastructure using the open-source Supabase platform, which We deploy and run ourselves on the Hetzner infrastructure described above. We do not use Supabase Inc.'s hosted services, and Supabase Inc. does not have access to or process personal data on Our behalf. References to "Supabase" elsewhere on the Service refer to the open-source software, not the hosted Supabase Cloud product.

Where You sign in or register through a Third-Party Social Media Service (Google, GitHub, or Apple), the relevant OAuth flow transits that provider's infrastructure; the resulting account record is stored on Our self-hosted infrastructure as described above.

Infrastructure and Security

We use services from Cloudflare to enhance the security and performance of our website. This includes using their DNS services and security products like Cloudflare Turnstile for captcha protection. Cloudflare may process data from users of our Service to provide these services.

For more information on the privacy practices of Cloudflare, please visit their Privacy Policy: https://www.cloudflare.com/privacypolicy/

Transactional and Marketing Email

We use a third-party email service provider to send (a) transactional emails (account verification, password reset, billing receipts, security alerts, scan-result notifications, and similar service-related messages) and (b) optional marketing emails (product updates, newsletters) where You have opted in.

You may opt out of marketing emails at any time by following the unsubscribe link in any marketing message or by updating Your preferences in account settings. Opting out of marketing does not affect Your receipt of transactional emails, which are necessary for the operation of the Service.

• Mailgun (operated by Sinch)

Mailgun is the email delivery service We use for both transactional and marketing email. It receives the recipient address, email content, and delivery metadata required to relay the message.

For more information on the privacy practices of Mailgun, please visit their Privacy Policy: https://www.mailgun.com/legal/privacy/

Payments

We may provide paid products and/or services within the Service. In that case, we may use third-party services for payment processing (e.g. payment processors).

We will not store or collect Your payment card details. That information is provided directly to Our third-party payment processors whose use of Your personal information is governed by their Privacy Policy. These payment processors adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, Mastercard, American Express and Discover. PCI-DSS requirements help ensure the secure handling of payment information.

• Stripe

Their Privacy Policy can be viewed at https://stripe.com/us/privacy

When You use Our Service to pay a product and/or service via bank transfer, We may ask You to provide information to facilitate this transaction and to verify Your identity.

Information About Third-Party Extensions and Their Developers

Separately from the personal information We process about Our users, Extension Auditor processes information about browser extensions and the persons who publish them as the core function of the Service. This processing is the subject of this section.

What we collect

We collect and process the following categories of information from public Chrome Web Store listings and other public sources:

• Extension metadata (extension ID, name, description, category, version history, install count, ratings)
• Manifest files and declared permissions
• Extension package contents (code, scripts, resources) for the purpose of automated analysis
• Promotional assets (icons, screenshots, marketing copy) as published in the listing
• Publisher metadata (publisher name, website, support contact email or URL, verification status, the set of other extensions published by the same developer)

The information collected from public sources is, in some cases, supplemented by signals derived from automated analysis (e.g., dangerous-permission flags, code-pattern findings, similarity to known-malicious code). The combination of public-source data and Our analytical output is published as a "scan report" on extensionauditor.com.

Why we process it

The lawful basis for this processing under the GDPR is Article 6(1)(f) — legitimate interests. Our legitimate interests include:

• Security research and consumer protection. Identifying browser extensions that present a risk to end users, IT administrators, and the public. Browser extensions operate inside the user's session with broad privileges and have repeatedly been used as malware delivery vehicles, data-exfiltration tools, and supply-chain attack surfaces. Independent analysis serves a substantial public interest.
• Threat intelligence. Building a corpus of historical scan data that allows researchers, defenders, and enterprise security teams to track changes in extension behavior, publisher reputation, and emerging threats.
• Transparency and accountability. Allowing developers, journalists, and researchers to verify the basis on which We classify an extension.

We have conducted a documented Legitimate Interests Assessment that balances these interests against the rights and freedoms of the developers and publishers concerned. Where We process the personal data of natural persons (e.g., a developer's name and contact email as listed publicly on the Chrome Web Store), We have determined that Our legitimate interests are not overridden by the rights of those individuals, particularly given that:

• The information is published voluntarily by the developer in the context of distributing software to the public
• The processing is limited to security analysis and is not used for advertising, profiling unrelated to security, or sale to third parties
• We provide a clear and accessible removals process
• Scan reports are framed as analytical opinions, not statements of fact about the developer as a person

Retention of scan data

Scan reports are retained as historical security records, including for previously-published versions of an extension that have since been removed from the Chrome Web Store. Historical retention is essential to the security-research function — many investigations rely on being able to compare a current version against an earlier version.

Notwithstanding this default retention, We honor validated removal and erasure requests as set out in Our Removals & Takedowns policy, including erasure requests under GDPR Article 17 from individuals identified in scan reports.

Your rights as a developer or publisher

If You are a developer, publisher, or other natural person whose personal data appears in a scan report, You have the rights described in the relevant statutory sections of this Privacy Policy (GDPR / UK GDPR, CCPA / CPRA, PDPA), and You may also use the dedicated channels set out in Our Removals & Takedowns policy:

• Image / asset removal — replace your listing's icon and screenshots with a placeholder
• Factual inaccuracy correction — challenge specific factual claims in a scan report
• Trademark complaint — report alleged misuse of a registered mark
• GDPR / CCPA / PDPA erasure or correction — exercise statutory data-subject rights

We will respond to validated requests within the timelines set out in the Removals policy.

GDPR Privacy

Legal Basis for Processing Personal Data under GDPR

We may process Personal Data under the following conditions:

• Consent: You have given Your consent for processing Personal Data for one or more specific purposes.
• Performance of a contract: Provision of Personal Data is necessary for the performance of an agreement with You and/or for any pre-contractual obligations thereof.
• Legal obligations: Processing Personal Data is necessary for compliance with a legal obligation to which We are subject.
• Vital interests: Processing Personal Data is necessary in order to protect Your vital interests or of another natural person.
• Public interests: Processing Personal Data is related to a task that is carried out in the public interest or in the exercise of official authority vested in Us.
• Legitimate interests: Processing Personal Data is necessary for the purposes of the legitimate interests pursued by Us.

Our processing of your personal information is supported by one or more of the following lawful bases:

In any case, We will gladly help to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.

Your Rights under the GDPR

We undertake to respect the confidentiality of Your Personal Data and to guarantee You can exercise Your rights.

You have the right under this Privacy Policy, and by law if You are within the EU, to:

• Request access to Your Personal Data. The right to access, update or delete the information We have on You. Whenever made possible, you can access, update or request deletion of Your Personal Data directly within Your account settings section. If you are unable to perform these actions yourself, please contact Us to assist You. This also enables You to receive a copy of the Personal Data We hold about You.
• Request correction of the Personal Data that We hold about You. You have the right to have any incomplete or inaccurate information We hold about You corrected.
• Object to processing of Your Personal Data. This right exists where We are relying on a legitimate interest as the legal basis for Our processing and there is something about Your particular situation, which makes You want to object to our processing of Your Personal Data on this ground. You also have the right to object where We are processing Your Personal Data for direct marketing purposes.
• Request erasure of Your Personal Data. You have the right to ask Us to delete or remove Personal Data when there is no good reason for Us to continue processing it.
• Request the transfer of Your Personal Data. We will provide to You, or to a third-party You have chosen, Your Personal Data in a structured, commonly used, machine-readable format. Please note that this right only applies to automated information which You initially provided consent for Us to use or where We used the information to perform a contract with You.
• Withdraw Your consent. You have the right to withdraw Your consent on using your Personal Data. If You withdraw Your consent, We may not be able to provide You with access to certain specific functionalities of the Service.

Exercising of Your GDPR Data Protection Rights

You may exercise Your rights of access, rectification, cancellation and opposition by contacting Us. Please note that we may ask You to verify Your identity before responding to such requests. If You make a request, We will try our best to respond to You as soon as possible.

You have the right to complain to a Data Protection Authority about Our collection and use of Your Personal Data. For more information, if You are in the European Economic Area (EEA), please contact Your local data protection authority in the EEA.

CCPA/CPRA Privacy Notice (California Privacy Rights)

This privacy notice section for California residents supplements the information contained in Our Privacy Policy and it applies solely to all visitors, users, and others who reside in the State of California.

Categories of Personal Information Collected

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or Device. The following is a list of categories of personal information which we may collect or may have been collected from California residents within the last twelve (12) months.

Please note that the categories and examples provided in the list below are those defined in the CCPA/CPRA. This does not mean that all examples of that category of personal information were in fact collected by Us, but reflects our good faith belief to the best of Our knowledge that some of that information from the applicable category may be and may have been collected. For example, certain categories of personal information would only be collected if You provided such personal information directly to Us.

• Category A: Identifiers.

  Examples: A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, driver's license number, passport number, or other similar identifiers.

  Collected: Yes.

• Category B: Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).

  Examples: A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.

  Collected: Yes.

• Category C: Protected classification characteristics under California or federal law.

  Examples: Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).

  Collected: No.

• Category D: Commercial information.

  Examples: Records and history of products or services purchased or considered.

  Collected: Yes.

• Category E: Biometric information.

  Examples: Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.

  Collected: No.

• Category F: Internet or other similar network activity.

  Examples: Interaction with our Service or advertisement.

  Collected: Yes.

• Category G: Geolocation data.

  Examples: Approximate physical location.

  Collected: No.

• Category H: Sensory data.

  Examples: Audio, electronic, visual, thermal, olfactory, or similar information.

  Collected: No.

• Category I: Professional or employment-related information.

  Examples: Current or past job history or performance evaluations.

  Collected: No.

• Category J: Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).

  Examples: Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.

  Collected: No.

• Category K: Inferences drawn from other personal information.

  Examples: Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

  Collected: No.

• Category L: Sensitive personal information.

  Examples: Account login and password information, geolocation data.

  Collected: Limited. We process account login credentials (email address and a hashed password) for authentication purposes only. We do not collect precise geolocation data, government identifiers, financial-account credentials beyond what is required to process a payment via Stripe, racial or ethnic origin, religious or philosophical beliefs, union membership, genetic or biometric data, health data, or sexual orientation data. The login credentials We process are used solely to authenticate You and are not used for inferring characteristics about You. This use falls within the exceptions in CPRA § 1798.121(d) and accordingly the right to limit use and disclosure of sensitive personal information does not apply.

Under CCPA/CPRA, personal information does not include:

• Publicly available information from government records
• Deidentified or aggregated consumer information
• Information excluded from the CCPA/CPRA's scope, such as:
  • Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data
  • Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994

Sources of Personal Information

We obtain the categories of personal information listed above from the following categories of sources:

• Directly from You. For example, from the forms You complete on our Service, preferences You express or provide through our Service, or from Your purchases on our Service.
• Indirectly from You. For example, from observing Your activity on our Service.
• Automatically from You. For example, through cookies We or our Service Providers set on Your Device as You navigate through our Service.
• From Service Providers. For example, third-party vendors to monitor and analyze the use of our Service, third-party vendors for payment processing, or other third-party vendors that We use to provide the Service to You.

Use of Personal Information

We may use or disclose personal information We collect for "business purposes" or "commercial purposes" (as defined under the CCPA/CPRA), which may include the following examples:

• To operate our Service and provide You with Our Service.
• To provide You with support and to respond to Your inquiries, including to investigate and address Your concerns and monitor and improve our Service.
• To fulfill or meet the reason You provided the information. For example, if You share Your contact information to ask a question about our Service, We will use that personal information to respond to Your inquiry. If You provide Your personal information to purchase a product or service, We will use that information to process Your payment and facilitate delivery.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• As described to You when collecting Your personal information or as otherwise set forth in the CCPA/CPRA.
• For internal administrative and auditing purposes.
• To detect security incidents and protect against malicious, deceptive, fraudulent or illegal activity, including, when necessary, to prosecute those responsible for such activities.
• Other one-time uses.

Please note that the examples provided above are illustrative and not intended to be exhaustive. For more details on how we use this information, please refer to the "Use of Your Personal Data" section.

If We decide to collect additional categories of personal information or use the personal information We collected for materially different, unrelated, or incompatible purposes, We will update this Privacy Policy.

Disclosure of Personal Information

We may use or disclose and may have used or disclosed in the last twelve (12) months the following categories of personal information for business or commercial purposes:

• Category A: Identifiers
• Category B: Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))
• Category D: Commercial information
• Category F: Internet or other similar network activity

Please note that the categories listed above are those defined in the CCPA/CPRA. This does not mean that all examples of that category of personal information were in fact disclosed, but reflects our good faith belief to the best of our knowledge that some of that information from the applicable category may be and may have been disclosed.

When We disclose personal information for a business purpose or a commercial purpose, We enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.

Share of Personal Information

We may share, and have shared in the last twelve (12) months, Your personal information identified in the above categories with the following categories of third parties:

• Service Providers
• Payment processors
• Our affiliates
• Our business partners
• Third party vendors to whom You or Your agents authorize Us to disclose Your personal information in connection with products or services We provide to You

Sale and Sharing of Personal Information

Under the CCPA/CPRA, "sell" means making personal information available to a third party for monetary or other valuable consideration, and "share" means making personal information available to a third party for cross-context behavioral advertising.

We do not sell personal information, and We do not share personal information for cross-context behavioral advertising. We have not sold or shared personal information for these purposes in the preceding twelve (12) months, and We do not currently have any advertising partners, ad-network integrations, or analytics partners that use the data We disclose for behavioral advertising.

We disclose personal information to service providers solely for the business purposes described elsewhere in this Privacy Policy (hosting, security, payments, error reporting, email delivery, analytics on Your consent). Each service provider is contractually restricted from using personal information for any purpose other than performing the services for Us, including from selling, sharing, or using it to build profiles for advertising.

Because We do not engage in any sale or cross-context-advertising sharing, the "Do Not Sell or Share My Personal Information" right does not result in a change of practice when invoked. You may nonetheless submit a request via the contact details in this Privacy Policy and We will confirm Our non-sale, non-sharing posture in writing.

Sale of Personal Information of Minors Under 16 Years of Age

The Service is not directed to anyone under 18 and We do not knowingly collect personal information from anyone under that age (see the "Children's Privacy" section).

In any event, We do not sell or share personal information of consumers under 16 years of age under any circumstance, regardless of the affirmative-authorization framework that the CCPA/CPRA permits, because We do not sell or share personal information of any consumer (see the "Sale and Sharing of Personal Information" section).

If You have reason to believe that a person under the age of 18 has provided Us with personal information, please contact [email protected] with sufficient detail to enable Us to delete that information.

Your Rights under the CCPA/CPRA

The CCPA/CPRA provides California residents with specific rights regarding their personal information. If You are a resident of California, You have the following rights:

• The right to notice. You have the right to be notified which categories of Personal Data are being collected and the purposes for which the Personal Data is being used.
• The right to know/access. Under CCPA/CPRA, You have the right to request that We disclose information to You about Our collection, use, sale, disclosure for business purposes and share of personal information. Once We receive and confirm Your request, We will disclose to You:
  • The categories of personal information We collected about You
  • The categories of sources for the personal information We collected about You
  • Our business or commercial purposes for collecting or selling that personal information
  • The categories of third parties with whom We share that personal information
  • The specific pieces of personal information We collected about You
  • If we sold Your personal information or disclosed Your personal information for a business purpose, We will disclose to You:
    • The categories of personal information categories sold
    • The categories of personal information categories disclosed
• The right to opt out of the sale or sharing of Personal Data. You have the right to direct Us not to sell or share Your personal information. As described in the "Sale and Sharing of Personal Information" section, We do not sell or share personal information for cross-context behavioral advertising and We do not have advertising partners.
• The right to correct Personal Data. You have the right to correct or rectify any inaccurate personal information about You that We collected. Once We receive and confirm Your request, We will use commercially reasonable efforts to correct (and direct our Service Providers to correct) Your personal information, unless an exception applies.
• The right to limit use and disclosure of sensitive Personal Data. You have the right to request to limit the use or disclosure of certain sensitive personal information We collected about You, unless an exception applies. To submit, please see the "Limit the Use or Disclosure of My Sensitive Personal Information" section or contact Us.
• The right to delete Personal Data. You have the right to request the deletion of Your Personal Data under certain circumstances, subject to certain exceptions. Once We receive and confirm Your request, We will delete (and direct Our Service Providers to delete) Your personal information from our records, unless an exception applies. We may deny Your deletion request if retaining the information is necessary for Us or Our Service Providers to:
  • Complete the transaction for which We collected the personal information, provide a good or service that You requested, take actions reasonably anticipated within the context of our ongoing business relationship with You, or otherwise perform our contract with You.
  • Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
  • Debug products to identify and repair errors that impair existing intended functionality.
  • Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
  • Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
  • Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if You previously provided informed consent.
  • Enable solely internal uses that are reasonably aligned with consumer expectations based on Your relationship with Us.
  • Comply with a legal obligation.
  • Make other internal and lawful uses of that information that are compatible with the context in which You provided it.
• The right not to be discriminated against. You have the right not to be discriminated against for exercising any of Your consumer's rights, including by:
  • Denying goods or services to You
  • Charging different prices or rates for goods or services, including the use of discounts or other benefits or imposing penalties
  • Providing a different level or quality of goods or services to You
  • Suggesting that You will receive a different price or rate for goods or services or a different level or quality of goods or services

Exercising Your CCPA/CPRA Data Protection Rights

Please see the "Sale and Sharing of Personal Information" section above and the "Limit the Use or Disclosure of My Sensitive Personal Information" section below for more information on Our practices.

Additionally, in order to exercise any of Your rights under the CCPA/CPRA, and if You are a California resident, You can contact Us:

• By email: [email protected]
• By visiting this page on our website: https://extensionauditor.com/contact
• By mail: #14-04, SBF Center, 160 Robinson Road, Singapore, 068914

Only You, or a person registered with the California Secretary of State that You authorize to act on Your behalf, may make a verifiable request related to Your personal information.

To verify your identity, we may ask you to log in to your account or to confirm personal details we have on file for you.

Your request to Us must:

• Provide sufficient information that allows Us to reasonably verify You are the person about whom We collected personal information or an authorized representative
• Describe Your request with sufficient detail that allows Us to properly understand, evaluate, and respond to it

We cannot respond to Your request or provide You with the required information if We cannot:

• Verify Your identity or authority to make the request
• And confirm that the personal information relates to You

We will disclose and deliver the required information free of charge within 45 days of receiving Your verifiable request. The time period to provide the required information may be extended once by an additional 45 days when reasonably necessary and with prior notice.

Any disclosures We provide will only cover the 12-month period preceding the verifiable request's receipt.

For data portability requests, We will select a format to provide Your personal information that is readily usable and should allow You to transmit the information from one entity to another entity without hindrance.

Do Not Sell or Share My Personal Information

As stated in the "Sale and Sharing of Personal Information" section above, We do not sell personal information and We do not share personal information for cross-context behavioral advertising. We do not have advertising partners or ad-network integrations.

You may nonetheless exercise the right to direct Us not to sell or share Your personal information by contacting Us at [email protected]. We will confirm Our non-sale, non-sharing posture in writing within the timelines required by the CCPA/CPRA.

Honoring Global Privacy Control (GPC) signals

Pursuant to 11 CCR § 7025, We treat browser-transmitted Global Privacy Control (GPC) signals as a valid consumer request to opt out of the sale or sharing of personal information. Because We do not sell or share personal information, the GPC signal does not change Our processing — but where We later introduce any feature that would constitute a sale or sharing under CCPA/CPRA, GPC signals will be honored automatically without further action from You.

Cookie preferences

You can manage Your cookie consent at any time using the "Cookie preferences" link in the website footer, which lets You accept or reject the analytics technologies described in the "Analytics" subsection above.

Limit the Use or Disclosure of My Sensitive Personal Information

If You are a California resident, You have the right to limit the use and disclosure of Your sensitive personal information to that use which is necessary to perform the services reasonably expected by an average consumer who requests such services.

The only category of sensitive personal information We process is account login credentials (Your email address and a hashed password), and We use these solely to authenticate You into the Service. Our use of these credentials falls within the exceptions in CPRA § 1798.121(d) and the implementing regulations at 11 CCR § 7027(m), which means the right to limit does not result in a change of practice when invoked. We do not infer characteristics about You from these credentials and We do not disclose them for any purpose other than authentication.

You may nonetheless submit a request via [email protected] and We will confirm Our practices in writing.

Singapore PDPA Privacy Notice

This section supplements Our Privacy Policy and applies to Personal Data processed by Alpha CISO Pte. Ltd. as a Singapore-incorporated organization under the Singapore Personal Data Protection Act 2012 ("PDPA"). Where the protections of the PDPA differ from or supplement those described elsewhere in this Privacy Policy, this section governs with respect to Personal Data subject to the PDPA.

Data Protection Officer

Pursuant to Section 11(3) of the PDPA, We have designated a Data Protection Officer ("DPO") responsible for ensuring Our compliance with the PDPA. The DPO's business contact information, made publicly available pursuant to Section 11(5) of the PDPA, is:

• Designation: Data Protection Officer, Alpha CISO Pte. Ltd.
• Email: [email protected]
• Postal address: Alpha CISO Pte. Ltd., #14-04, SBF Center, 160 Robinson Road, Singapore, 068914

You may direct any question, request, or complaint relating to Our handling of Your Personal Data under the PDPA to the DPO at the contact details above.

Your Rights under the PDPA

The PDPA grants You the following rights with respect to Personal Data We hold about You:

• Access (PDPA § 21). You may request information about the Personal Data We hold about You and how it has been used or disclosed within the past year, subject to the exceptions in the Fifth Schedule of the PDPA.
• Correction (PDPA § 22). You may request that We correct any error or omission in Personal Data We hold about You, subject to the exceptions in the Sixth Schedule of the PDPA. Where We make a correction, We will, unless You consent otherwise, send the corrected Personal Data to every other organization to which it was disclosed within the year preceding the correction.
• Withdrawal of Consent (PDPA § 16). You may withdraw any consent You previously gave for Us to collect, use, or disclose Your Personal Data. We will inform You of the likely consequences of withdrawal before processing the request, give effect to the withdrawal within a reasonable period, and cease (and instruct Our processors to cease) the relevant collection, use, or disclosure.
• Data Portability (when the relevant provisions are commenced). You will be entitled to request that We transmit certain Personal Data in a commonly used machine-readable format to another organization once the data portability provisions of the PDPA come into operation.

How to Exercise Your Rights

To exercise any of these rights, please contact our DPO at [email protected]. We will respond within thirty (30) days of receipt of a verifiable request. Where We are unable to respond within this period, We will inform You in writing of the reason and the timeframe for Our response.

We may decline a request, in whole or in part, where the PDPA permits Us to do so — for example, where compliance would reveal Personal Data about another individual, where the Personal Data is subject to legal privilege, or where the request is frivolous, vexatious, or otherwise within the exceptions specified in the Fifth or Sixth Schedules of the PDPA.

A reasonable fee may be charged for processing access requests, in accordance with the PDPA. Correction and withdrawal-of-consent requests are processed without charge.

Cross-Border Transfers

Where We transfer Personal Data outside Singapore, We take reasonable steps to ensure that the recipient is bound by legally enforceable obligations to provide a standard of protection that is comparable to the protection afforded under the PDPA, in accordance with Section 26 of the PDPA and Part III of the Personal Data Protection Regulations 2021. This includes the use of contractual clauses with our hosting, database, error-reporting, and email service providers.

Data Breach Notification

Pursuant to Section 26D of the PDPA, We will notify the Personal Data Protection Commission of Singapore, and where required affected individuals, of any notifiable data breach within the timeframes specified in the PDPA — generally as soon as practicable, and in any case no later than three (3) calendar days for notification to the Commission.

Complaints

If You are not satisfied with Our handling of Your request, You may lodge a complaint with the Personal Data Protection Commission of Singapore at pdpc.gov.sg. Before doing so, We encourage You to contact Our DPO so that We may attempt to address Your concern directly.

"Do Not Track" and Global Privacy Control Signals

Do Not Track (DNT). Industry standards for Do Not Track signals were never adopted across the web, and most browsers no longer offer them as a setting. Our Service does not respond to DNT signals.

Global Privacy Control (GPC). We honor browser-transmitted GPC signals as a valid request to opt out of the sale or sharing of personal information for cross-context behavioral advertising, in accordance with 11 CCR § 7025. As described in the "Sale and Sharing of Personal Information" section, We do not sell or share personal information for these purposes, so the GPC signal does not change Our processing — but it is logged and honored automatically as a defense-in-depth measure.

Your California Privacy Rights (California's Shine the Light law)

Under California Civil Code Section 1798 (California's Shine the Light law), California residents with an established business relationship with us can request information once a year about sharing their Personal Data with third parties for the third parties' direct marketing purposes.

If you'd like to request more information under the California Shine the Light law, and if You are a California resident, You can contact Us using the contact information provided below.

California Privacy Rights for Minor Users (California Business and Professions Code Section 22581)

California Business and Professions Code Section 22581 allows California residents under the age of 18 who are registered users of online sites, services or applications to request and obtain removal of content or information they have publicly posted.

To request removal of such data, and if You are a California resident, You can contact Us using the contact information provided below, and include the email address associated with Your account.

Be aware that Your request does not guarantee complete or comprehensive removal of content or information posted online and that the law may not permit or require removal in certain circumstances.

Children's Privacy

The Service is not directed to and is not intended for use by anyone under the age of eighteen (18). We do not knowingly collect personal information from anyone under the age of 18. By using the Service, You represent and warrant that You are at least 18 years old, in accordance with our Terms of Service.

If We become aware that We have collected personal information from a person under the age of 18, We will take steps to delete that information from Our records within thirty (30) days. If You are a parent or guardian and You are aware that Your child has provided Us with personal information, please contact Us at [email protected].

Notwithstanding the foregoing, certain rights and protections under specific statutes apply to lower age thresholds (for example, COPPA addresses children under 13, GDPR Article 8 addresses children under 16, and CCPA addresses minors under 16). Where such statutes apply, We will comply with the additional requirements they impose.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Changes to this Privacy Policy

We may update Our Privacy Policy from time to time.

We will notify You of any changes by posting the new Privacy Policy on this page.

We will let You know via email and/or a prominent notice on Our Service, prior to the change becoming effective and update the "Last updated" date at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

If you have any questions about this Privacy Policy, You can contact us:

• By email: [email protected]
• By visiting this page on our website: https://extensionauditor.com/contact
• By mail to our registered address: Alpha CISO Pte. Ltd., #14-04, SBF Center, 160 Robinson Road, Singapore, 068914

Data Protection Officer (Singapore PDPA): [email protected]

EU and UK data subjects may also exercise their rights by contacting Our DPO at the address above. Where a designated EU or UK representative under Article 27 of the GDPR or UK GDPR is appointed, this notice will be updated accordingly.