Privacy Policy

The data controller responsible for your personal information is:

We understand that your User Content — the binaries and code you submit for fuzzing — may be proprietary, sensitive, or subject to confidentiality obligations. We treat this data with the highest level of care:

• Your submitted binaries and seed corpora are used solely to execute fuzzing jobs on your behalf and are not analyzed, reverse-engineered, shared with third parties, or used to train any models.
• Fuzzing jobs are executed in isolated environments. We implement logical and physical isolation between customers' workloads.
• Crash reports and Results generated from your jobs are stored in association with your account and are accessible only to you and authorized Zenofex personnel for support purposes.
• Upon account termination, your User Content and Results are retained for up to 90 days to allow for export, after which they are permanently deleted from our systems.

We use the information we collect to:

• Provide, operate, and maintain the Service;
• Process transactions and send billing-related communications;
• Authenticate users and maintain account security;
• Respond to support requests, questions, and other communications;
• Send important account notifications (e.g., subscription renewals, policy changes);
• Monitor and analyze usage patterns to improve the Service;
• Detect, investigate, and prevent fraudulent activity and security incidents;
• Comply with legal obligations and enforce our Terms of Service;
• Send optional product updates and newsletters, where you have consented to receive such communications (you may opt out at any time).

We do not sell your personal information to any third party, and we do not use your personal information for advertising purposes.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data on the following legal bases:

• Contract performance: Processing necessary to provide the Service you have subscribed to (account information, billing, job execution).
• Legitimate interests: Security monitoring, fraud prevention, and Service improvement, where these interests are not overridden by your rights.
• Legal obligation: Compliance with applicable laws and valid legal process.
• Consent: Marketing communications, where you have provided explicit consent.

We retain your information for as long as necessary to provide the Service and as follows:

• Account information: Retained while your account is active and for up to 3 years after termination for legal and business purposes.
• Billing records: Retained for 7 years as required by applicable tax and financial regulations.
• Fuzzing job data and Results: Retained while your account is active and for up to 90 days after termination.
• Support tickets: Retained for 3 years following resolution.
• Security and access logs: Retained for up to 1 year for security investigation purposes.

You may request deletion of your personal data at any time (see Section 9). Deletion may be delayed where retention is required by law or legitimate business necessity.

We implement technical and organizational security measures designed to protect your information against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit using TLS;
• Encryption of sensitive data at rest (including API keys using AES-256-GCM);
• Access controls limiting personnel access to personal data on a need-to-know basis;
• Isolated execution environments for fuzzing workloads;
• Regular security assessments and monitoring.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.

Zenofex is based in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States. By using the Service, you consent to this transfer.

For transfers of personal data from the EEA, UK, or Switzerland to the United States, we rely on appropriate transfer mechanisms, including the EU-U.S. Data Privacy Framework (where applicable) or Standard Contractual Clauses approved by the European Commission. Contact us for more information about our transfer mechanisms.

The Service is not directed to, and we do not knowingly collect personal information from, individuals under the age of 18. If you become aware that a minor has provided us with personal information without parental consent, please contact us and we will take steps to delete such information.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will notify you by email or by posting a prominent notice on the Service, at least 14 days before the changes take effect. We encourage you to review this Policy periodically. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised Policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

We aim to respond to all privacy-related inquiries within 30 days.