1. Introduction

This Policy applies to:

• Individual users running diagnostics on their personal devices;
• IT technicians using Cirtyn for pre/post-repair device testing;
• Enterprise clients and IT administrators using Cirtyn for asset lifecycle management;
• Refurbishers and recyclers using Cirtyn for device certification before resale or disposal;
• Insurance providers and financial institutions using Cirtyn health scores for device risk classification;
• Visitors browsing cirtyn.com or accessing any Cirtyn portal.

2. Company and Contact Information

Cirtyn is a product of Pramaan Systems. For purposes of US privacy law, we act as the controller/business with respect to personal information collected through Cirtyn.

3. What Cirtyn Does — Our Privacy-by-Design Approach

Cirtyn is built on a principle of data minimization. It is a hardware diagnostic tool — not a surveillance tool, monitoring platform, or data harvesting service. Its sole function is to assess the physical condition of a device's hardware and generate a standardized, verifiable health report.

Cirtyn does NOT access, read, copy, or transmit: personal files, documents, emails, photos, videos, messages, contact lists, browser history, passwords, financial credentials, keystrokes, screen content, or any user-generated content. It has no visibility into what you do on your device — only into how your device's hardware is performing.

Every system permission Cirtyn requests is used exclusively for hardware diagnostics. A complete list of permissions and the specific purpose of each is provided in Section 9.

4. Information We Collect

4.1 Account and Registration Information

4.2 Hardware Diagnostic Data

When Cirtyn performs a diagnostic scan, it collects the following hardware-level data:

4.3 Usage and Performance Data

• Diagnostic session timestamps and duration.
• Feature usage statistics (which diagnostic modules were run).
• Crash reports and error logs, including software version and nature of failure.
• Diagnostic model performance metrics (used to improve accuracy of health predictions).

This data is collected in aggregated or pseudonymized form wherever possible. It is used solely to improve Cirtyn's software reliability and diagnostic accuracy. It is never sold or used for advertising.

4.4 Enterprise Asset Data

• Device inventory lists covering all enrolled devices.
• Chronological diagnostic history per device.
• Component change logs (hardware modifications detected between scans).
• Lifecycle analytics — aggregated health trend data across the device fleet.

Enterprise asset data is visible only to authorized administrators within the customer organization and to Cirtyn support personnel as necessary to deliver the contracted service.

4.5 Certification and Report Data

• Device health score and per-component test results.
• Unique Certificate ID linked to the specific device and test session.
• QR verification token for independent third-party certificate validation.
• Test timestamp and Cirtyn software version used.

4.6 Automatically Collected Technical Data

When you visit cirtyn.com, we automatically collect IP address, browser type and version, operating system, pages visited, time on site, referring URL, session duration, and cookie identifiers (see Section 8).

5. What Cirtyn Does Not Collect

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use sensitive personal information for purposes beyond those listed in this Policy.

6. How We Use Personal Information

We use personal information only for specific, disclosed, and legitimate business purposes:

• Providing and operating the Cirtyn service.
• Generating device health reports and QC certificates.
• Account management, authentication, and license issuance.
• Processing payments via third-party processor.
• IT asset lifecycle management for enterprise clients.
• Customer support and dispute resolution.
• Fraud detection and platform security.
• Improving diagnostic accuracy and software reliability (anonymized/aggregated telemetry).
• Sending transactional communications (license confirmations, updates, security notices).
• Sending marketing communications (with opt-in consent or where permitted by law).
• Complying with legal obligations (court orders, regulatory requirements, law enforcement).
• Certificate verification for third-party buyers, insurers, and auditors.

7. Sharing and Disclosure of Personal Information

We do not sell personal information and do not share it for cross-context behavioral advertising. We disclose personal information only in limited circumstances:

7.1 Service Providers (Processors)

Cloud infrastructure and hosting providers, analytics platforms (anonymized), customer support software, and payment processors — all contractually prohibited from using information for any other purpose.

7.2 Enterprise Clients

Device diagnostic data is shared with the authorized enterprise administrator(s), governed by the Enterprise License Agreement and a Data Processing Addendum (DPA).

7.3 Third-Party Integrations

Cirtyn may integrate with enterprise ITAM systems or repair workflow tools as contracted, disclosed at onboarding.

7.4 Certificate Verification

Scanning a certificate QR code returns a read-only summary of the device health report. No personally identifiable information about the device owner is included.

7.5 Payment Processor

Transactions are processed by a third-party PCI-DSS compliant processor (e.g., Stripe). We do not receive or store your full card number, CVV, or bank credentials.

7.6 Legal Requirements

We may disclose information when required by law, court order, subpoena, or valid legal process, and will notify affected users where permitted by law.

7.7 Business Transfers

In a merger, acquisition, or asset sale, information may be transferred, with notice to affected users and equivalent privacy obligations imposed on any successor.

7.8 Aggregate and De-Identified Data

We may share aggregated or anonymized information that cannot reasonably identify you. We do not attempt to re-identify de-identified data.

8. Cookies, Tracking Technologies, and Do Not Track

We use essential cookies (core functionality), performance/analytics cookies (with consent), functional cookies (preferences), and marketing cookies (opt-in only — never for cross-context behavioral advertising).

On your first visit you will see a cookie consent banner allowing you to accept or decline non-essential cookies by category. You may update preferences anytime via the Cookie Settings panel. We honor opt-out requests submitted via recognized universal opt-out mechanisms, including the Global Privacy Control (GPC) signal. You may opt out of Google Analytics via the official browser add-on at tools.google.com/dlpage/gaoptout.

9. Cirtyn Software Permissions

A complete and transparent disclosure of every permission Cirtyn requires and why:

You can review and revoke permissions at any time in your operating system's application settings.

10. California Consumer Privacy Rights (CCPA / CPRA)

This section applies to residents of California under Cal. Civ. Code §§ 1798.100–1798.199. Your rights include the Right to Know, Right to Delete, Right to Correct, Right to Opt-Out of Sale/Sharing, Right to Limit Use of Sensitive Personal Information (not applicable — we do not collect SPI), Right to Non-Discrimination, and Right to Data Portability.

To exercise your California rights, email [email protected] with the subject "California Privacy Request". We acknowledge requests within 10 business days and respond within 45 days (extendable by a further 45 days with notice). We will verify your identity before processing. You may designate an authorized agent.

Shine the Light (Cal. Civ. Code § 1798.83): We do not share personal information with third parties for their direct marketing purposes.

11. Privacy Rights for Residents of Other States

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and other states with comprehensive privacy laws have rights to access, correct, delete, port their data, opt out of sale and targeted advertising, opt out of profiling, and appeal a denial. Exercise any of these by emailing [email protected]. We respond within the timeframes required by applicable state law (generally 45 days, with a possible 45-day extension).

12. Children's Privacy — COPPA Compliance

Cirtyn is intended for professional and enterprise use and is not directed at children. We comply with COPPA as amended by the FTC's 2025 amendments. We do not knowingly collect personal information from children under 13. Users confirm they are 13 or older at registration. For users aged 13–17, we do not sell their personal information or share it for targeted advertising without affirmative opt-in consent. Parents or guardians may contact [email protected] to request review and deletion.

13. Data Security

We implement appropriate technical and organizational security measures, including:

• TLS/HTTPS encryption for data in transit and industry-standard encryption at rest.
• Passwords stored as one-way cryptographic hashes — never recoverable in plain text.
• Role-based access controls and multi-factor authentication for enterprise access.
• Regular security audits, vulnerability assessments, and penetration testing.
• Contractual data security obligations on all service providers and sub-processors.
• Incident response and breach notification procedures compliant with US state laws.

No method of transmission or storage is completely secure. Report any suspected unauthorized access to [email protected] immediately.

14. Automated Decision-Making and Profiling

Cirtyn uses automated algorithms to calculate device health scores from diagnostic data — this is an inherent and disclosed function of the product. This processing does not produce legal effects on individuals without human review. As required by the CPPA's 2025 ADMT regulations, we provide notice, honor applicable opt-out requests, and conduct risk assessments where required.

15. Data Retention

Upon account deletion, residual copies in secure backups are purged within 90 days.

16. International Data Transfers

Personal information collected from US users may be transferred to and processed in India and other countries where we or our service providers operate. We implement appropriate safeguards, including Standard Contractual Clauses (SCCs) and Data Processing Agreements (DPAs). Enterprise customers requiring US-only data residency may contact [email protected].

17. Email Communications — CAN-SPAM Act

We identify commercial email as advertising, include our physical mailing address, honor opt-out requests within 10 business days, and never use deceptive subject lines. To unsubscribe, click the link in any marketing email or email [email protected]. Unsubscribing does not affect transactional account emails.

18. Complaints and Regulatory Bodies

You may lodge a complaint with the relevant regulatory authority for your state, including the California Privacy Protection Agency (cppa.ca.gov), your State Attorney General, or the Federal Trade Commission (ftc.gov/complaint). We encourage you to contact us first at [email protected] so we can address your concern.

19. Changes to This Privacy Policy

We may update this Policy periodically. For material changes we will post the updated Policy with a revised effective date, email registered users, and display in-app notifications. Where required by law, we will seek fresh consent for new or materially expanded processing.

20. Contact Us