Privacy policy

Effective date and last updated: to be set on publication.

Sections: 1. Scope and our role · 2. Information we collect · 3. How we use information · 4. AI and machine learning · 5. How we share information · 6. International data transfers · 7. Data retention · 8. Cookies and tracking · 9. Security · 10. Your privacy rights · 11. Children's privacy · 12. Marketing and text message communications · 13. Third-party sites and integrations · 14. Do Not Track · 15. Profiling and automated decisions · 16. Changes to this policy · 17. Contact us

Ceburu Systems Inc. ("Ceburu", "we", "us" or "our") respects your privacy and is committed to protecting the personal information we collect, use, share and store. This Privacy Policy explains how we handle personal information in connection with this website (the "Website"), our observability platform, account portal, related applications, probes, collectors, agents, APIs and any other products or services we provide that link to this Policy (collectively, the "Service").

This Policy applies to personal information of website visitors, prospective customers, customers' authorized users, and individuals whose information may be processed by us when our customers use the Service to monitor their IT environments. By accessing or using the Service, you acknowledge that you have read and understood this Policy.

This Policy should be read together with our Terms and Conditions, which govern your use of the Website, and our Cookie Policy.

If you have questions, you can reach us through the contact page.

1. Scope and our role

Ceburu as controller. For information collected through our Website, marketing activities and our direct relationship with our customers and users (such as account registration, billing and support), Ceburu acts as a "controller" (under the GDPR and UK GDPR) or a "business" (under U.S. state privacy laws).

Ceburu as processor or service provider. When our customers use the Service to monitor their own applications, networks, infrastructure, databases and logs, our customers are the controllers or businesses for the data flowing through their tenant. Ceburu processes that data on their behalf as a processor or service provider, governed by our customer agreement and any data processing addendum ("DPA"). If you are an individual whose information is processed because your employer or service provider uses Ceburu, please contact that organization to exercise your rights over that data; we will support them in responding to you.

2. Information we collect

We collect information in the categories below. Not every category applies to every individual.

2.1 Information you provide directly

Form submissions: when you book a demo, contact us or request an integration, the details you enter — your name, work email, phone number, company, job title, team size, the topics you select and your message.
Account and contact information: name, business email, phone number, employer, job title and login credentials.
Billing information: billing contact details and transaction records. Payment card details are handled by our payment processor; we do not store full card numbers on our systems.
Customer content and configuration: sites, monitored assets, alert rules, dashboards, automations, integrations and other configuration you choose to enter.
Communications: messages, support requests, survey responses, sales inquiries and feedback you send us.
Marketing preferences: subscription status and email preferences.

2.2 Information collected automatically (Website and portal)

Usage data: pages viewed, links clicked, features used, referring URL, session duration and similar telemetry. On the Website, this is collected only if you accept analytics in the cookie banner.
Device and connection data: IP address, approximate location derived from IP, browser type and version, operating system and language. Our hosting provider records this in server logs to deliver the Website and protect it from abuse, including rate-limiting form submissions.
Cookies and similar technologies: see Section 8 and our Cookie Policy.

2.3 Information collected through the platform

When our customers deploy Ceburu probes, collectors, agents or agentless connections across their IT environments, the Service collects the technical and operational data needed to monitor those environments. Depending on the modules a customer enables, this may include:

asset and inventory data (hostnames, addresses, device types, operating systems, installed software and hardware details);
performance and availability metrics (CPU, memory, disk, processes, services and uptime);
network data (interface counters, flow metadata, paths, latency, SNMP data, topology and connected devices);
application traces, errors and synthetic check results;
database metrics gathered by read-only queries;
log data forwarded from servers, network devices and applications;
user account information for the customer's authorized users (for example, identity, role, sign-in activity and the IP address used to access the portal); and
alerts, incidents, tickets and automation runs created through the Service.

To the extent any of this data identifies or relates to an individual (for example, a username, a person's device or activity attributable to a person), it is treated as personal information under this Policy. Ceburu processes this data as a processor or service provider on behalf of the customer.

2.4 Information from third parties

Single sign-on and identity providers, when you choose to sign in through them.
Systems your organization connects to the Service (for example, ticketing or directory tools).
Marketing, sales intelligence, enrichment and event partners (for example, business contact data and firmographics).
Service providers, resellers and channel partners involved in delivering the Service.
Public sources, such as professional networking sites, where permitted.

3. How we use information

We use personal information for the purposes below. Where the GDPR or UK GDPR applies, the legal basis for each purpose is shown.

Purpose	Legal basis (GDPR / UK GDPR)
Reply to form submissions and arrange the demo, conversation or integration you asked for.	Steps before a contract; legitimate interests
Provide, operate, secure and maintain the Service, including authentication, account management, support, monitoring, alerting and automation.	Performance of a contract; legitimate interests
Process payments and invoicing, and manage customer relationships.	Performance of a contract; legal obligation
Detect, prevent, investigate and respond to fraud, abuse, security incidents and other threats to the Website, the Service or its users.	Legitimate interests; legal obligation
Improve, develop and analyze the Website and the Service (including aggregated or de-identified analytics and product research).	Legitimate interests; consent for Website analytics
Evaluate and improve the AI features of the Service. See Section 4.	Legitimate interests; consent where required
Communicate with you about the Service, including security notices, policy changes and operational updates.	Performance of a contract; legal obligation
Send marketing communications about Ceburu products, events and offers, where permitted.	Consent; legitimate interests
Comply with legal, regulatory, audit and contractual obligations, and enforce our terms.	Legal obligation; legitimate interests
Carry out corporate transactions such as mergers, acquisitions, financing or asset sales, including due diligence.	Legitimate interests

We will not use personal information for materially different, unrelated or incompatible purposes without giving notice or, where required, obtaining consent.

4. AI and machine learning

The Service includes AI features, such as correlating signals, suggesting a likely cause with its evidence, and answering questions about your environment. The following principles apply:

Customer data: we do not use customer content (data processed by Ceburu on a customer's behalf through the Service) to train AI or machine-learning models that are made available to other customers, except where the data has been aggregated and de-identified so that it cannot reasonably be linked to any individual or customer.
Model improvement: we may use telemetry, model inputs and outputs, error data, and de-identified or aggregated data to monitor, evaluate, debug, secure and improve the AI features of the Service.
Third-party AI providers: where we use third-party AI services to power features, we contractually require those providers to act as processors or sub-processors, restrict their use of customer data to delivering the feature, and prohibit them from using customer data to train their general-purpose models, unless the customer has explicitly opted in.
Human oversight: AI outputs, such as a suggested cause or fix, are designed to assist, not replace, human decisions. Customers remain responsible for the actions they choose to take based on them.
Automated decision-making: we do not use AI to make decisions producing legal or similarly significant effects on individuals without human involvement. If that ever changes, we will give notice and meaningful information about the logic, significance and consequences, as required by law.

We share personal information only as described below. We do not sell personal information.

Within Ceburu: with affiliated entities under common control, bound by confidentiality and data protection obligations consistent with this Policy.
Service providers and sub-processors: including website and cloud hosting, form delivery, data storage and backup, analytics, customer support tools, communications, payment processing, security, identity, marketing automation and AI services. They access information only to perform services for us under written contract.
Customers and authorized users: data within a customer's tenant is accessible to that customer's authorized users in line with their own permissions.
Channel partners and resellers: where you purchased through, are supported by, or specifically authorize a partner, such as a managed service provider.
Professional advisors: such as auditors, accountants and lawyers, under confidentiality obligations.
Legal, safety and compliance: when we believe in good faith that disclosure is necessary to comply with law, valid legal process or a government request; to enforce our terms; to protect the rights, property or safety of Ceburu, our customers, users or others; or to detect, prevent or address fraud or security issues.
Corporate transactions: in connection with a merger, acquisition, financing, reorganization, asset sale or insolvency, in which case we will require the recipient to honor the commitments in this Policy or notify you of any changes.
With your direction or consent: for any other purpose disclosed when we collect the information, or with your consent.

We may disclose aggregated or de-identified information that cannot reasonably be used to identify you for any lawful purpose.

We do not sell, rent or share mobile phone numbers or SMS/text messaging consent with third parties or affiliates for their own marketing or promotional purposes. No mobile information collected through our text messaging program is shared with third parties for marketing under any circumstances.

Mobile phone numbers and messaging consent are used only to deliver the messages you asked to receive, and are disclosed only to the service providers strictly necessary to send them — for example, our messaging platform provider and the mobile carriers that transmit the message. Those providers are contractually restricted to that purpose and may not use, sell or share the information for their own purposes.

6. International data transfers

Ceburu is based in the United States and uses service providers in multiple countries. When we transfer personal information out of the European Economic Area, the United Kingdom, Switzerland or other jurisdictions with cross-border transfer restrictions, we rely on legally recognized transfer mechanisms, which may include:

the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the Swiss equivalent;
adequacy decisions issued by the relevant data protection authorities; and
other approved transfer mechanisms, such as derogations expressly permitted by applicable law.

You can ask us about the safeguards we use through the contact page.

7. Data retention

We keep personal information only for as long as necessary to fulfil the purposes for which it was collected, including to provide the Service, comply with legal obligations, resolve disputes and enforce our agreements. Specifically:

Form submissions are kept for as long as needed to respond and follow up, then deleted or anonymized.
Account and customer relationship data is kept for the duration of the relationship and for a reasonable period afterwards for legal, audit and tax purposes.
Data within a customer tenant is kept according to the customer's configuration and contractual terms; on termination, we delete or return it in line with the customer agreement and DPA.
Telemetry, logs and backups are kept for limited periods consistent with the purpose for which they were collected and applicable law.
Marketing data is kept until you unsubscribe or object, plus a short period to honor your preference.

8. Cookies and tracking

We and our service providers may use cookies, local storage and similar technologies to operate the Website and portal, remember preferences, analyze traffic and, with consent, measure marketing.

Categories we may use include:

Strictly necessary: required for sign-in, security and core functionality.
Functional: remember your choices and preferences, such as your colour theme.
Analytics and performance: help us understand how the Website is used.
Marketing: help us measure campaigns and reach relevant audiences.

On the Website, non-essential technologies stay off until you choose Accept in the cookie banner. You can withdraw or change your consent at any time with Cookie settings in the footer. You can also set your browser to block or delete cookies; doing so may affect how the Website works. Our Cookie Policy lists exactly what the Website stores.

9. Security

We maintain administrative, technical and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration or destruction, including access controls, monitoring and incident response procedures. How the platform connects to your environment is described on our security page.

No security program can guarantee absolute security. You are responsible for keeping your account credentials confidential and for telling us promptly about any suspected unauthorized use.

10. Your privacy rights

Depending on where you live, you may have some or all of the rights below for personal information that Ceburu controls. We support our customers in honoring these rights for data within their tenants.

10.1 Rights available to all eligible individuals

Access a copy of the personal information we hold about you.
Correct inaccurate or incomplete personal information.
Delete personal information, subject to legal exceptions.
Port your information to another provider in a structured, commonly used format.
Object to or restrict certain processing, including direct marketing.
Withdraw consent where processing is based on consent (without affecting earlier processing).
Opt out of "sales", "sharing" or targeted advertising as those terms are defined under applicable U.S. state laws.
Limit use of sensitive personal information, where applicable.
Not be discriminated or retaliated against for exercising your rights.

If you are in the European Economic Area, the United Kingdom or Switzerland, you may also lodge a complaint with your local data protection authority. We encourage you to contact us first so we can address your concerns.

10.3 U.S. state privacy rights

Residents of U.S. states with comprehensive privacy laws (including California, Virginia, Colorado, Connecticut, Utah and Texas) have rights to know, access, delete, correct and obtain a copy of their personal information, and to opt out of sales, sharing or targeted advertising, and certain profiling. To exercise these rights, see Section 10.5.

We do not knowingly sell or share for cross-context behavioral advertising the personal information of consumers we know to be under 16.

California "Shine the Light" (Civil Code §1798.83): California residents may ask about disclosures of personal information to third parties for their direct marketing purposes through the contact page.

10.4 Authorized agents

You may use an authorized agent to submit a request on your behalf. We may require proof of authorization and verification of your identity.

10.5 How to exercise your rights

Send your request through the contact page. We will verify your identity and respond within the time required by applicable law (generally 30 to 45 days), and may extend that period where permitted. There is no charge unless your request is manifestly unfounded or excessive.

If your data is held within a customer's tenant, we will route your request to that customer or ask you to contact them directly.

11. Children's privacy

The Website and the Service are intended for businesses and are not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, please tell us through the contact page and we will take appropriate steps to delete it.

12. Marketing and text message communications

You can opt out of marketing emails by clicking the "unsubscribe" link in any marketing message or by asking us through the contact page. Even if you opt out of marketing, we may still send you transactional or service-related communications (for example, billing, security and policy updates).

12.1 SMS and text messaging program

If you provide your mobile phone number and affirmatively opt in, Ceburu may send you text messages relating to your account, service and incident notifications, appointment and demo confirmations, support follow-ups and occasional product updates. Consent to receive text messages is not a condition of any purchase.

How you opt in: only by an affirmative action, such as checking an unchecked consent box on a Ceburu web form. Giving your phone number on a demo or contact form does not by itself opt you in.
Message and data rates: message and data rates may apply, depending on your mobile carrier and plan.
Opting out: reply STOP to any message to stop receiving texts at any time. You will receive a single confirmation message and no further messages unless you opt in again.
Help: reply HELP for assistance, or reach us through the contact page.
Carrier liability: mobile carriers are not liable for delayed or undelivered messages.
Your mobile number is not shared: as described in Section 5.1.

Our messaging program is also subject to our Terms and Conditions.

13. Third-party sites and integrations

The Website and the Service may link to or work with third-party sites, products or integrations that we do not control. Their privacy practices are governed by their own policies. We encourage you to review them before providing personal information.

14. Do Not Track

Our Website does not respond to "Do Not Track" browser signals, because no common standard has been adopted. Analytics on the Website stay off unless you accept them in the cookie banner.

15. Profiling and automated decisions

We do not engage in profiling that produces legal or similarly significant effects on individuals without meaningful human involvement. Where applicable law gives you the right to opt out of certain profiling, you may exercise that right as described in Section 10.5.

16. Changes to this policy

We may update this Privacy Policy from time to time. The date at the top of this page reflects the most recent revision. If we make material changes, we will give additional notice (such as a notice on the Website or an email). Your continued use of the Service after an update takes effect constitutes acceptance of the updated Policy.

17. Contact us

If you have questions, comments or complaints, or wish to exercise your privacy rights, contact Ceburu Systems Inc. through the contact page.

17.1 EU and UK representatives

If we are required to designate an EU or UK representative under Article 27 of the GDPR or UK GDPR, their contact details will be provided here. Until then, individuals in the EU and UK may contact us directly through the contact page.

17.2 Privacy team

You can reach our privacy team through the contact page.