Privacy Policy

1. Who we are

plasmatic dev (“plasmatic”, “we”, “us”) is the controller of the personal data described in this policy.

This policy covers plasmatic.dev, the ZeroDay desktop app, purchases from our website and our support channels. It does not cover websites we link to, or the payment processor’s own processing of your payment details, which is described in the processor’s privacy notice.

Questions about privacy go to privacy@plasmatic.dev.

2. What we collect and why

2.1 Website visitors

• No tracking. Our website uses no analytics, no advertising or tracking cookies and no third-party embeds, and our fonts are self-hosted. Loading our pages does not tell any third party that you visited. See the Cookie Policy.
• Server and CDN logs. Like any web server, ours and our content delivery network record your IP address, browser user agent, the time of the request and the page path requested. We use these logs only to keep the site secure, prevent abuse and fix problems, and keep them for up to 30 days.
• Contacting us. Our Contact links open our Discord server on Discord’s own website and app. What you send there is handled by Discord under its own privacy policy, and our staff can read it in order to help you.

2.2 The ZeroDay app

ZeroDay does not require an account, and we do not ask for your name or email address to use it. Here is what it sends to us:

• Reputation lookups (always on). To check whether a file is known to be safe or harmful, ZeroDay sends the file’s SHA-256 hash plus minimal metadata: its size, type and digital signer (the publisher named in its code signature, if any). Like any internet connection, the request also reveals your device’s IP address. A hash is a one-way fingerprint: it cannot be turned back into your file, although it can tell us that a device has a copy of a file we have seen before.
• Update checks (always on). ZeroDay checks for definition and app updates and sends an anonymous install ID (a random identifier created when ZeroDay is installed) and the app version, so we can deliver the right updates and understand which versions are in use.
• Sample sharing (opt-in, off by default). If you turn on the “Sample sharing” setting, ZeroDay uploads full copies of suspicious files so we can analyse new threats and improve detection for everyone. A flagged file could contain personal information, for example if it is a document, so please consider this before turning the setting on. You can turn it off at any time, which stops future uploads.
• Crash reports and usage diagnostics (opt-in, off by default). If you turn these on, ZeroDay sends technical information about crashes and how the app’s features perform, such as app and operating system version, error details and feature usage counts. We use it to fix bugs and improve the app.

ZeroDay does not show ads, we do not sell its data, it does not upload your files unless Sample sharing is on, and it does not send us your browsing history. Scan history and quarantined items are kept on your device.

We keep hash verdicts and derived metadata that do not contain file content (for example, a file’s hash, type, size and detection results) to improve detection for all our users and customers. We act as a controller for this detection data, and we do not use it to profile individuals.

2.3 Purchases

When you buy a digital good or a paid plan, we collect your name, email address, billing address or country, tax ID if you are a business, and order details such as the product, price, date and licence keys. Payments are handled by a third-party payment processor: your card details go directly to them, and we never receive or store full card numbers. We may receive limited information such as card type, last four digits, expiry date and payment status. The processor may also use payment data to prevent fraud, as described in its own privacy notice.

2.4 Support and communications

When you email us, we keep your message, any attachments (for example, a file you report as a false positive) and our replies. Messages in our Discord server are kept by Discord. We send service emails such as receipts, security notices and notice of changes to our terms. We do not send marketing emails unless you have asked to receive them, and any such email includes an unsubscribe link.

2.5 Security researchers

If you report a vulnerability to security@plasmatic.dev, we keep your name or handle, contact details and the contents of your report so we can investigate, fix the issue and, with your permission, thank you publicly.

3. Legal bases for processing

If you are in the European Economic Area or the UK, the GDPR and UK GDPR require us to have a legal basis for each use of your personal data. Ours are:

Where we rely on legitimate interests, we have weighed them against your rights and you can object (see section 8). Where we rely on consent, you can withdraw it at any time without affecting processing that has already happened.

4. How long we keep data

When a retention period ends, we delete the data or irreversibly anonymise it. Deleted data can remain in encrypted backups for a short time until those backups are overwritten. We may keep data longer if we are legally required to, or need it to deal with a legal claim or an active security investigation.

5. Who we share it with

We do not sell personal data, we do not share it for advertising, and we do not work with data brokers. We share personal data only:

• With service providers that process it on our behalf under contract, such as hosting, content delivery, cloud infrastructure and email delivery providers. They may use it only to provide their services to us. You can ask us for a current list.
• With our payment processor, to take payments and prevent fraud. For some of this processing, such as regulatory and fraud checks, the processor acts as an independent controller.
• With professional advisers such as lawyers and accountants, under confidentiality obligations.
• When the law requires it, in response to valid legal process. We review requests carefully, push back on ones that are overly broad and, where we are allowed to, tell the affected customer first.
• To protect people and the Services, where reasonably necessary to investigate fraud, abuse or security incidents, or to protect the rights and safety of our users, customers or the public.
• In a business transfer, such as a merger or acquisition, in which case this policy will continue to apply to your data or we will tell you about any change.
• With your consent, or at your direction.

6. International transfers

We and our service providers may process personal data in countries other than the one you live in, including outside the European Economic Area and the UK. When we transfer EU or UK personal data to a country that does not have an adequacy decision, we use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, together with additional measures where needed. You can ask us for a copy of the relevant safeguards at privacy@plasmatic.dev.

7. Security

We protect data with encryption in transit and at rest, least-privilege access controls, isolated sandboxes for analysing files and short default deletion periods. Our Security page describes these practices in more detail. No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant authorities as the law requires.

8. Your rights in the EU and UK

If the GDPR or UK GDPR applies to you, you have the right to:

• access the personal data we hold about you and get a copy;
• correct data that is inaccurate or incomplete;
• erase your data in certain circumstances;
• restrict how we use your data in certain circumstances;
• data portability, meaning a copy of data you gave us in a machine-readable format;
• object to processing based on legitimate interests, and to direct marketing at any time;
• withdraw consent where we rely on it, for example by turning off Sample sharing or diagnostics in ZeroDay.

We do not make decisions about people based solely on automated processing that have legal or similarly significant effects. Our verdicts are about files and URLs, not about you.

You also have the right to complain to a data protection authority: in the EU, the authority in the country where you live or work; in the UK, the Information Commissioner’s Office (ICO). We would appreciate the chance to sort out your concern first, so please consider contacting us before you do.

9. Your rights in California

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”), gives you additional rights. This section is our notice at collection and privacy policy for the CCPA.

Categories we have collected in the past 12 months: identifiers (such as name, email address, IP address, ZeroDay install ID and account ID); customer records (such as billing address and limited payment details); commercial information (purchases and subscriptions); internet or network activity (server logs and ZeroDay lookups); professional information (company name, where you give it); and account login credentials, which are sensitive personal information that we use only to let you sign in. We collect these from you, from your device when you use ZeroDay, and from our payment processor. We use them for the purposes in section 3, keep them for the periods in section 4, and disclose them only to the recipients in section 5, for business purposes.

We do not sell or share your personal information. We do not sell personal information or share it for cross-context behavioural advertising, and we have not done so in the past 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16. Because there is nothing to opt out of, we do not need a “Do Not Sell or Share” link, but we honour Global Privacy Control signals anyway. We do not use sensitive personal information to infer characteristics about you, so the right to limit its use does not apply.

Your rights: you can ask us to tell you what personal information we collect, use and disclose and to give you a copy; to delete it; and to correct it. We will not discriminate against you for exercising these rights. You can use an authorised agent, in which case we may ask for proof of the agent’s authority and verify your identity directly. We respond within 45 days, which we may extend by another 45 days where necessary, and we will tell you if we do.

10. Children

Our Services are not directed to children under 16, and we do not knowingly collect personal data from them. ZeroDay may run on a family device, but it does not ask for or collect information that identifies who is using it. If you believe a child has given us personal data, contact privacy@plasmatic.dev and we will delete it.

11. How to exercise your rights

Email privacy@plasmatic.dev with your request. To help us find your data, tell us how you use our Services (website or ZeroDay) and include the email address on your account or order.

• Verification. We will verify your identity before acting on a request, normally by confirming that it comes from the email address we hold. We only use the information you give us for verification to handle your request.
• ZeroDay data. ZeroDay data is not linked to your name or email address, so we may not be able to find it unless you can give us your install ID.
• Timing and cost. We respond within one month under the GDPR and UK GDPR (extendable by two further months for complex requests, in which case we will tell you) and within the CCPA time limits above. Requests are free unless they are manifestly unfounded or excessive.

Wherever you live, we will consider and respond to privacy requests in line with the rights described above, as far as we reasonably can and subject to local law.

12. Changes to this policy

We will update this policy when our practices or the law change, and post the new version here with a new “Last updated” date. If a change is material, for example a new use of your data, we will tell you by email or with a notice on the website before it takes effect, and we will ask for your consent where the law requires it.

13. Contact

plasmatic dev
privacy@plasmatic.dev

For our terms, see the Terms of Service. For browser storage, see the Cookie Policy.