Privacy Policy
This policy explains what personal data Fibric Inc. ("Fibric," "we") processes, why, and the choices you have. It covers fibric.io, BearScope, and managed deployments that we provide under a customer agreement. The generalized Fibric kernel described in public materials is a reference architecture unless a customer agreement says otherwise. Customer Data that we process on a customer's behalf is governed by the applicable customer agreement and, where incorporated, our Data Processing Addendum.
Overview
We generally act as a data controller for personal data about website visitors, authorized users, and prospective customers. We act as a data processor only when and to the extent an applicable customer agreement requires us to process Customer Data on the customer's behalf. This policy describes our controller activities; the applicable agreement and incorporated DPA describe processor obligations.
At a glance: our privacy label
The short version, in the style of a nutrition label. The full detail follows below.
Information we collect
You give us
- Account & contact: name, work email, company, role when you sign up, request access, or contact us.
- Operation setup: the systems you connect and the intents and guardrails you configure during onboarding.
- Communications: messages you send to support, sales, or community channels.
We collect automatically
- Usage & device: pages viewed, actions taken, IP address, browser, and similar telemetry, used to operate and improve the service.
- Website referrals: after analytics consent, we store the consent version, a broad source category, and recognized referring domains, sources, and mediums from fixed lists. Unknown referring domains are omitted. This measurement does not store full URLs, page paths, campaign details, visitor identifiers, or form contents.
- Cookies: see Cookies below.
If you submit an access request while analytics consent remains active and Global Privacy Control is absent, we include this referral information as a separate field alongside your brief. It becomes part of the request record associated with your contact details. A source classified as "direct" means we could not observe a recognized origin; it does not establish how you found us.
How we use data
We use personal data to provide and secure our current services, authenticate provisioned accounts, respond to you, send service and (with consent where required) marketing communications, meet legal obligations, and improve the product. We do not currently sell personal data or share it for cross-context behavioral advertising. Customer Data is not used to train a shared model unless the customer expressly agrees in writing.
We use consented referral information to understand which search engines, AI services, and other recognized sources lead to access requests.
Legal bases
Where the GDPR or similar laws apply, we rely on: contract (to deliver the service you requested), legitimate interests (to secure and improve the platform), consent (for optional marketing, website referral measurement, and non-essential browser storage), and legal obligation (to comply with law).
Governed data & operators
Supported BearScope and contracted managed-deployment paths use tenant-scoped controls appropriate to those paths. Current BearScope production data tables use reseller and tenant identifiers and row-level access controls where implemented, and supported governed actions can produce attributable action records with duplicate-suppression controls. These controls do not mean that every reference-kernel component is deployed, that every event or row has identical enforcement, or that a downstream action can always be reversed. Any compensating recovery depends on the connected system and the applicable customer agreement. Where we process Customer Data as a processor, we do so on documented customer instructions and under the applicable agreement.
Retention
We keep personal data for as long as reasonably needed for the purposes above, to meet legal obligations, and to resolve disputes. For Customer Data, export, deletion, backup-cycle, and supported action-record retention are governed by the applicable customer agreement and any incorporated DPA. We then delete or anonymize data where required and technically feasible, subject to lawful retention requirements.
Referral information in your browser lasts for the tab session and is cleared when analytics consent is withdrawn or Global Privacy Control is detected. Referral information already submitted follows the retention of the access request. Clearing browser storage or withdrawing cookie consent does not delete a previously submitted request; you can exercise your privacy rights using the contact details below.
Security
For supported production services, we use technical and organizational measures designed to protect data, including encryption in transit and at rest, access controls, authentication, logging, and tenant-scoped controls where implemented. Measures vary by product, connected system, and contracted deployment; reference-architecture descriptions are not representations that every control is deployed on every path. No method is perfectly secure. See Security and our Responsible Disclosure policy.
Your rights (GDPR / UK GDPR / EEA)
If you are in the EEA, UK, or Switzerland, you may have the following rights over your personal data, subject to applicable conditions and exceptions. To exercise a right, email privacy@fibric.io. We respond within the period required by applicable law and will tell you if a lawful extension applies. We do not charge for a request or treat you adversely except where applicable law permits a reasonable fee or other limitation.
- Access (Art. 15) — get a copy of the personal data we hold about you.
- Rectification (Art. 16) — correct inaccurate or incomplete data.
- Erasure (Art. 17) — ask us to delete your data ("right to be forgotten").
- Restriction (Art. 18) — limit how we process your data while a dispute is resolved.
- Portability (Art. 20) — receive your data in a structured, machine-readable format.
- Objection (Art. 21) — object to processing based on legitimate interests, and to direct marketing at any time.
- No automated decisions (Art. 22) — we do not make legal or similarly significant decisions about you by solely automated means.
- Withdraw consent — where processing is based on consent, withdraw it at any time (for cookies, use Cookie preferences in the footer).
You may also lodge a complaint with your local supervisory authority. We'd appreciate the chance to resolve it first, but you don't have to give us one.
Your rights (California and other US states)
If you are a resident of California (CCPA/CPRA), Colorado, Connecticut, Virginia, Utah, or another state with a comprehensive privacy law, you may have some or all of the following rights, subject to applicable conditions and exceptions:
- Know / access — what personal information we collect, use, and disclose, and to receive a copy.
- Delete — ask us to delete personal information we collected from you.
- Correct — fix inaccurate personal information.
- Opt out of sale or sharing — we do not currently sell personal information or share it for cross-context behavioral advertising. Where required by law, we treat a recognized opt-out preference signal, such as Global Privacy Control, as a request to opt out.
- Limit sensitive personal information — as of this policy's effective date, we do not use sensitive personal information for purposes that require offering this right.
- Non-discrimination — we will not unlawfully discriminate against you for exercising an applicable privacy right.
Submit requests to privacy@fibric.io. We verify requests using information appropriate to the request and respond within the period required by applicable law. You may use an authorized agent; we may ask for proof of authorization. As of this policy's effective date, we have not sold or shared personal information as those terms are defined by the CCPA during the preceding 12 months.
International transfers
We may process data in countries other than yours. Where applicable law requires a transfer mechanism, we use the mechanism specified in the relevant customer or service-provider agreement, which may include Standard Contractual Clauses.
Changes to this policy
We may update this policy as the product and law evolve. We will post the new version here and update the date above; material changes will be communicated where appropriate.
Contact
Questions about this policy or your data? Email privacy@fibric.io, or write to Fibric Inc., Attn: Privacy. For data-processing matters, see the DPA.