Privacy Policy

1. Introduction

Oligo Security, Inc. ("the Company," "we," "us," or "our") develops and runs the Oligo runtime security platform, an eBPF-native service that instruments Linux kernels at the syscall layer to identify active application security threats in production environments. Our address is One Sansome Street, Suite 3500, San Francisco, CA 94104; contact us at [email protected].

This Privacy Policy explains how the Company treats personal information gathered through oligosec.org (the "Site"), early-access enrollment, and account workflows. The Oligo platform separately handles kernel event telemetry, process execution traces, and host security data for enterprise customers under service agreements. Those activities are controlled by those agreements, not this Policy.

Your use of the Site indicates agreement with these practices. This Policy covers information gathered through the Site and direct communications with visitors and prospective users.

2. Information We Collect

2.1 Information You Provide

The Site collects information you provide, including:

• Name, work email, and phone supplied in an inquiry or early-access request form;
• Company and job role information you share when evaluating or enrolling in the Oligo platform;
• Email and hashed password used to create a Pilot or Team account through enrollment;
• Messages you send us, such as support inquiries and security questions.

2.2 Information Collected Automatically

oligosec.org also gathers limited technical information automatically:

• IP address and approximate city or region, not precise GPS coordinates;
• Browser, operating system, and device class;
• Visited pages, referring URLs, and time on page;
• Cookies and similar identifiers (see Section 5, Cookie Policy).

2.3 We Do Not Knowingly Collect Children's Data

oligosec.org serves business-to-business security products for security professionals and enterprise buyers, not children under 13. We do not knowingly gather children's personal information. If you believe a child submitted information, contact [email protected] and we will delete it.

3. How We Use Information

We use collected information to:

• Handle security product inquiries, demo requests, and early-access applications;
• Set up and run Pilot and Team accounts on the Oligo platform;
• Deliver product updates, Security Lab research notifications, and, where consent is required, marketing about our runtime security platform;
• Review Site engagement to improve content and product documentation;
• Identify, investigate, and prevent fraud or abuse aimed at the Service;
• Meet legal duties, including those applying to a California-based software company.

We do not sell personal information for monetary value. Without your explicit written consent, we do not use data from oligosec.org or account enrollment to train machine-learning models.

4. Sharing of Information

We share information only with:

• Providers working for us, such as infrastructure hosting, transactional email, and anonymized site analytics, subject to contractual confidentiality and data-processing duties;
• Legal authorities when law or court order requires it, or to safeguard the rights, safety, or property of the Company or others;
• A successor following a merger, acquisition, or asset sale, provided this Policy continues or a materially equivalent replacement is supplied.

We do not sell personal information to third parties or share it for cross-context behavioral advertising.

5. Cookies and Tracking

Cookies and similar technologies help operate the Site, retain session state and preferences, and measure use through self-hosted, anonymized analytics. See our Cookie Policy for the cookies we set and ways to manage them.

6. Data Retention

We keep personal information only as needed for the purposes in this Policy and for legal, accounting, or dispute-resolution duties:

• Account data (name, email, company, role) remains during the service relationship and 90 days after closure or early-access withdrawal;
• Contact forms and inquiry records remain for up to 24 months, then are deleted or anonymized;
• Server access logs remain for 90 days, then are aggregated or deleted;
• Marketing preference records remain until consent is withdrawn or you unsubscribe.

7. Security

The Company maintains administrative, technical, and physical safeguards suited to a security-focused software business, including TLS encryption in transit, restricted databases with least-privilege controls, and internal security reviews. No system is perfectly secure, so absolute protection from every threat cannot be guaranteed.

8. Your General Rights

Depending on your jurisdiction, you may be able to access, correct, or delete personal information we hold, and limit or object to certain processing. Send requests to [email protected]. We respond within the period required by applicable law.

9. California Residents (CCPA / CPRA)

The California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA") give California residents specific rights concerning personal information collected about them. This section adds to the Policy and describes duties of our San Francisco-based company under California law.

9.1 Categories We Collect

During the past 12 months, we collected these categories defined under Cal. Civ. Code §1798.140: identifiers (name, email, IP address); professional and employment-related information (company name, job role) submitted through contact and enrollment forms; commercial information (service tier enrollment inquiries, account type selection); internet activity (browsing behavior on oligosec.org); and inferences from these categories for service-improvement purposes. Separately, the Oligo platform processes runtime security telemetry (kernel event records, process execution traces, alert data) for enterprise customers under processing agreements; that information is outside this consumer-facing Policy.

9.2 Sources, Purposes, Disclosure

We receive this information from you and through automated Site instrumentation. It supports Service operation and improvement, product-inquiry responses, platform access, and legal compliance. Disclosure is limited to contracted service providers and legal authorities when required.

9.3 Your CCPA / CPRA Rights

• Right to Know: request the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: request deletion of personal information we collected from you, subject to legal exceptions.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: we do not sell personal information; we do not "share" it for cross-context behavioral advertising as defined under CPRA.
• Right to Limit Use of Sensitive PI: we do not collect or use sensitive personal information (as defined under Cal. Civ. Code §1798.140(ae)) for purposes beyond those permitted without authorization. None of the categories of data collected through oligosec.org or the account enrollment flow qualify as sensitive PI under this definition.
• Right to Non-Discrimination: we will not deny services, charge different prices, or provide a different level of service because you exercised a right.

9.4 How to Exercise

Submit a verifiable request by emailing [email protected] with the subject line "California Privacy Request." Include enough detail for us to verify you are the person whose information is the subject of the request. We respond within 45 days, with a possible 45-day extension for which we will notify you.

9.5 Authorized Agents

You may designate an authorized agent to make a request on your behalf. The agent must provide proof of authorization; we may also require you to verify your identity directly.

9.6 "Shine the Light"

California Civil Code §1798.83 entitles California residents to request information regarding our disclosure of personal information to third parties for direct marketing. We do not disclose personal information for third-party direct marketing.

9.7 Do Not Track and Global Privacy Control

Under the California Online Privacy Protection Act (Cal. Bus. & Prof. Code §22575), we disclose how we respond to "Do Not Track" (DNT) browser signals. Because there is no common industry standard for interpreting DNT signals, we do not currently respond differently to them. We do not authorize third parties to collect personally identifiable information about your activity across different websites when you use the Service. We honor an opt-out preference signal sent by a platform or browser that complies with the CPRA, such as the Global Privacy Control (GPC); when we detect a GPC signal, we treat it as a valid request to opt out of the sale or sharing of personal information for that browser or device.

10. Changes to This Policy

We may revise this Policy periodically. A material revision will receive a new "Last updated" date at the top of this page and, when appropriate, a Service notice. Using the Site after the revised Policy takes effect means you accept the changes.

11. Contact

Send Policy questions, requests, or complaints to: