Privacy Policy

1. Who we are

UMBREN is operated by [Company legal name — to be completed], with its registered address at [Registered address — to be completed] (“UMBREN”, “we”, “us”).

UMBREN provides DDoS mitigation for infrastructure that business customers own or are authorized to register. This policy covers the website, the dashboard, the API and the verification agent (together, the “Service”).

The Service is offered to businesses. It is not directed at consumers or at children, and it is not designed to collect information about them.

2. Our role

For the data we need to run accounts, bill customers, secure the Service and communicate with the people who use it, we decide how and why the data is processed.

Traffic to a protected endpoint is filtered because a customer has instructed us to protect that endpoint. For the data processed in doing so, we act on the customer's behalf. [Controller and processor roles under the applicable law — to be confirmed by counsel]

3. The data we process

3.1 Account and organization data

• Name, email address and sign-in credentials of each member.
• Two-factor authentication settings and recovery codes.
• The organization a member belongs to, the role they hold, and invitations sent to others.
• Session records, which let a member see their active sessions and revoke them.

3.2 Infrastructure data

• The endpoints a customer registers: service name, category, origin IP address, protocol, ports, preferred region and notes.
• Ownership verification records, including the address a verification request arrived from and its outcome.
• For manual verification, the statement and reference the customer submits, and the result of the review.
• Mitigation policies and every version of them.
• Notification channels: email addresses, webhook URLs, and delivery records.

An IP address can be personal data where it relates to an identifiable individual. Origin addresses registered with the Service normally identify business infrastructure.

3.3 Telemetry and incident data

For each protected endpoint the Service records what the protection network measured: bandwidth, packets per second, protocol distribution, and allowed versus mitigated traffic, together with records of incidents.

Filtering takes place on the network of an upstream scrubbing provider. To filter traffic, that network necessarily handles the packets sent to the protected endpoint, including the source addresses of whoever sent them. UMBREN's control plane does not carry that traffic.

[Whether telemetry or incident records held by UMBREN include individual source addresses, and in what form — to be completed]

3.4 Audit data

Sensitive actions are recorded in an append-only audit log: who acted, what they did, and when. The log includes actions taken by UMBREN staff on a customer's organization. [Technical details recorded with each audit entry, such as IP address — to be completed]

3.5 Billing data

Payment details are collected and processed by our payment processor. UMBREN keeps the subscription status, plan and invoice records it needs to operate the account and to meet its accounting obligations.

3.6 Communications

If you contact us, we process your contact details and the content of your message in order to reply and to keep a record of the exchange.

3.7 Website and technical data

Like any web service, the Service processes technical data about requests, such as IP address, browser type and time of request, to deliver pages, keep the Service secure and diagnose faults. [Cookies and any analytics used on the website — to be completed]

4. What the Service does not collect

The Service is designed to protect an address, not to observe what is behind it.

• UMBREN is not a VPN provider. It does not handle the subscribers of a customer's VPN service, their accounts, their keys or the contents of their tunnels.
• UMBREN does not connect to, scan or probe a customer's origin server to verify ownership.
• The verification agent makes one outbound HTTPS request that carries a one-time challenge. It sends nothing else, opens no port, installs nothing and exits.
• Verification challenges are stored only as a hash.
• Origin addresses are never included in webhook payloads.

5. Why we process data

[Legal bases for each purpose under the applicable law — to be completed]

[Statement on sale of personal data and on use of data for advertising — to be confirmed]

6. Subprocessors and other recipients

We use the following categories of service provider to operate the Service. Each receives only the data its function requires.

[Legal entity and processing location of each subprocessor — to be completed]

Data is also disclosed in these cases:

• At a customer's direction. When a customer configures a Discord webhook or a custom webhook, event data is sent to the destination the customer chose.
• Where the law requires it. We disclose data to courts and authorities when we are legally required to do so.
• In a business transfer. If the business that operates UMBREN is reorganized or sold, data may pass to the successor under the terms of this policy.
• To professional advisers. Where necessary, under obligations of confidentiality.

7. International transfers

Our service providers may process data in countries other than the one in which a customer is established. [Countries involved and the transfer safeguards relied on — to be completed]

8. Retention

We keep data for as long as it is needed for the purpose it was collected for, and then delete or anonymize it. The audit log is append-only: entries are not edited or removed during the period for which the log is kept.

[Retention periods for account data, infrastructure data, telemetry, incident records, audit log, billing records and backups — to be completed]

9. Security

The Service includes the following controls. No system is perfectly secure, and we do not claim that this one is.

• Email verification, and passwords of at least 12 characters.
• Two-factor authentication using time-based one-time passwords, with one-time recovery codes.
• A list of active sessions for each member, with the ability to revoke them.
• Roles that limit what each member and each API credential can do.
• Isolation of the data of each organization. A request for another organization's resource returns 404.
• API credentials and webhook signing secrets that are shown once, when they are created.
• An append-only audit log of sensitive actions, including actions taken by UMBREN staff.

[Personal data breach notification procedure — to be completed]

10. Your rights

Depending on the law that applies to you, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive a copy of it in a portable form, and to complain to a data protection authority.

To exercise a right, contact us using the details in section 12. Where we process data on behalf of a customer, we will refer your request to that customer.

[Rights available under the applicable law, response times and the competent supervisory authority — to be completed]

11. Changes to this policy

We will update this policy when the Service or the law changes. The current version is published on this page. [How customers are notified of material changes — to be completed]

12. Contact

Privacy questions and requests can be sent to [Privacy contact email — to be completed], or by post to [Registered address — to be completed]. General enquiries can be sent through the contact page.

[Data protection officer or local representative, if one is required — to be completed]

This policy should be read with the Terms of Service and the Acceptable Use Policy.