# Privacy & Security Policy — OTFeed.com

**Last Updated:** August 19, 2026

**OTFeed.com** is a product of **Cyborama LLC**, an Alabama limited liability company.

## What We Collect

When you sign up for OTFeed, we collect:

- **Your email address** — for account creation, alert delivery, and account verification
- **Your organization name and sector** (optional) — to improve service relevance
- **Your device selections** — vendors, products, and protocols you tell us are in your environment
- **Usage data** — which articles you read, feed access frequency, API call patterns
- **Technical data** — IP address, browser type, access timestamps (standard server logs)

**We do NOT collect:** your name, phone number, physical address, or any other personal identifiers.

## What We Do With It

We use your information to:

1. **Deliver your custom alerts** — match security news to your selected devices
2. **Send alerts** — email and RSS delivery based on your preferences
3. **Improve the service** — understand which vendors, protocols, and sectors matter most
4. **Prevent abuse** — detect and prevent unauthorized access or scraping

## What We DON'T Do

- We **do not sell** your personal information to third parties
- We **do not share** your organization's identity, device inventory, or sector with vendors, other customers, or any external party
- We **do not publish** which organizations use OTFeed
- We **do not sell** your device data or infrastructure profile to threat intelligence brokers, advertising networks, or data aggregators
- We **do not** provide your organizational information to CISA, DHS, or any government agency without a valid legal order

## Anonymized Aggregate Data

We **do** reserve the right to collect, aggregate, and anonymize usage data across all customers to identify broad trends in OT threat exposure, vulnerability prevalence, and sector risk patterns. This "sterilized" data:

- Contains **no** organization names, email addresses, or identifying information
- Contains **no** device-level data tied to specific customers
- Is used only for **aggregate reporting**, research, and service improvement
- May be published as **industry-wide statistics** (e.g., "47% of OTFeed customers monitor DNP3 assets")

You cannot be identified in anonymized aggregate data. If we ever change this, we will update this policy.

## Data Retention

- **Active accounts:** Your data is retained as long as your account is active
- **Cancelled accounts:** Personal data is deleted within 30 days. Anonymized aggregate data derived from your account persists.
- **Server logs:** Retained for 90 days, then automatically purged

## Your Rights

- **Access:** Request a copy of all data we hold about you
- **Correction:** Update your email, sector, or device selections at any time via your account settings
- **Deletion:** Request full account deletion. Data will be removed within 30 days
- **Export:** Download your account data in standard formats (JSON/CSV)

## Security Architecture

We protect your data with multiple layers of technical controls:

**Encryption at Rest** — All customer data is encrypted with AES-256 (SQLCipher). Your database cannot be read without the encryption key.

**Physical Separation** — Your account information and your device selections are stored on two physically separate servers. Neither server alone reveals which devices you monitor. This means a breach of one system does not expose your complete profile.

**Minimal Data Collection** — We only require your email address. We do not store your name, phone number, or physical address. Less data = less risk.

**Access Controls** — All API access requires authentication keys. Every device resolution query is logged and rate-limited to prevent bulk enumeration.

**Secure Transit** — All web and API traffic is encrypted with HTTPS/TLS. API keys are transmitted in headers only — never in URLs where they could be logged.

**Infrastructure Hardening** — Our servers run with security headers (CSP, HSTS, Content-Security-Policy), XSS protection on all templates, and restricted SSH access with command-level controls.

**No Public Customer List** — Your use of OTFeed is not visible to other customers, vendors, or the public.

## Breach Notification

In the event of a confirmed data breach affecting your information, we will notify all affected users within 24 hours of confirmation. We will disclose what was accessed, when, and what steps we are taking.

## Children's Privacy

OTFeed is not intended for individuals under 18. We do not knowingly collect data from minors.

## Changes to This Policy

We will notify customers of material changes via email. Continued use of OTFeed after policy changes constitutes acceptance.

## Contact

For privacy questions, data requests, or complaints:
- **Email:** privacy@otfeed.com
- **Company:** Cyborama LLC, Alabama
- **EIN:** 41-4427011