Privacy policy

Words with capitalized first letters have the meanings given below, and those meanings apply whether the words appear in singular or plural form.

For the purposes of this Privacy Policy:

• Account means the unique account created for you to access the Service.
• Company, we, us, and our refer to Bintracer, LLC.
• Cookies are small files placed on your device by a website.
• Personal Data means information that relates to an identified or identifiable individual.
• Service means the Bintracer platform and the bintracer.com website.
• Service Provider means a third party that processes information on our behalf or provides services used to operate the Service.
• Submitted Content means Uploaded Files together with the other content you provide through the Service, such as custom detection rules (for example, YARA or EQL rules), scan names, labels, and notes, and configuration data and metadata associated with your submissions.
• Uploaded Files means files, archives, software, scripts, disk images, packages, or other content that you submit to the Service for analysis.
• Usage Data means data collected automatically when you interact with the Service.
• You means the individual accessing or using the Service, or the organization on whose behalf that individual is accessing or using the Service.

While using the Service, we may collect Personal Data that can be used to contact or identify you. This may include:

• Email address
• First and last name
• Organization or company information
• Account and authentication information
• API keys and API activity associated with your Account
• Billing and subscription information
• Demo and meeting information you provide when you book a demo
• Communications you send to us
• Usage Data
• Personal Data contained in Submitted Content, as described below

We collect Personal Data from the following categories of sources:

• Directly from you, such as when you create an Account, submit Uploaded Files or other Submitted Content, purchase a subscription, book a demo, or communicate with us.
• Automatically from your use of the Service, in the form of Usage Data.
• From an organization that creates or administers your Account, such as your employer.
• From Service Providers that support the Service, such as our authentication, payment, and scheduling providers.
• From other customers and users of the Service, when Personal Data relating to you is contained in Submitted Content: an Uploaded File, or the technical artifacts and analysis results generated during an analysis. The Personal Data about people who do not use Bintracer section describes this processing.

If you purchase a paid Service, payment information is processed by our payment provider. We may receive billing information, transaction identifiers, payment status, and related information, but we do not store your full payment card number.

Usage Data is collected automatically when you use the Service.

Usage Data may include your IP address, browser type and version, device and operating-system information, pages or features you access, the time and date of your activity, the time spent using the Service, unique device identifiers, and diagnostic, performance, security, and error information.

We use this information to operate, secure, maintain, and improve the Service.

Bintracer is a malware-analysis platform. When you submit an Uploaded File, we process that file in order to perform the analysis you request. We process other Submitted Content the same way: custom detection rules you create or upload are stored, validated, compiled, and evaluated against analyses run under your Account, and we do not share them with other customers or use them to build detection content for others; and scan names, labels, notes, and configuration settings you provide are stored with the associated scan.

We may generate and retain information derived from Uploaded Files, including cryptographic hashes, file metadata, extracted artifacts, behavioral information, indicators, detection-rule matches, analysis reports, and other technical results.

Each scan has a visibility setting. Depending on your plan, you may be able to choose between private and public visibility when you submit an Uploaded File; scans submitted on the Free plan are public. Within the Service, private scans and their analysis results are not publicly available and are accessible only through your Account or, for organization Accounts, by members of your organization. Bintracer personnel and our Service Providers may access or process private scans only in the limited circumstances described in this Privacy Policy. Public scans are part of the public scan archive: the Uploaded File, its analysis results, and information derived from them may be viewed, searched, copied, or downloaded by other users and the public, including visitors without an Account; may be indexed by search engines; and may be used by Bintracer and by others for security research, threat intelligence, detection development, education, and the operation and improvement of the Service, including to provide results to other customers who submit the same file. We do not display your name, email address, Account, or organization on public scan pages; however, the contents and metadata of a public file may themselves contain information that identifies an individual or organization. Review your visibility selection before you submit; the Public Samples section of our Terms of Service describes public scans and these uses in more detail.

When a scan is public, the publicly available information currently includes:

• the Uploaded File's original file name, size, type, and cryptographic hashes (MD5, SHA-1, and SHA-256);
• static-analysis results, including the file type and code-signing details such as signing identifiers, certificate names, Apple Team IDs, entitlements, and notarization status;
• behavioral analysis results, including observed network activity and DNS resolutions, file activity, process activity with full command lines, and loaded libraries;
• strings extracted from the file and imported-library information;
• the inventory of an app bundle, installer package, or disk image, including the names, paths, hashes, and code-signing details of contained files, Info.plist content, and the full text of contained scripts;
• files dropped, modified, or captured during the analysis, including their names and file-system paths;
• matches from Bintracer's built-in detection rules and associated MITRE ATT&CK technique information;
• the automatically generated summary of the scan;
• the analysis configuration selected for the scan, including any free-text values it contains, such as a custom installation directory path; and
• the existence and configuration of other public scans of the same file, without identifying their submitters.

The following are not made public, even for a public scan: your name, email address, Account, and organization; your custom detection rules, including their names, content, matches, and findings; and internal error diagnostics. Because the analysis configuration is public, do not enter Personal Data or confidential information in free-text analysis options for a public scan.

Do not submit files containing Personal Data, account credentials, confidential information, trade secrets, or regulated data to a public scan unless you have the authority to make that information public. To report Personal Data, credentials, or confidential information contained in a public scan, contact support@bintracer.com or privacy@bintracer.com and include the scan URL or file hash; reports sent to either address enter the same review process, described in our Public Content and Takedown Policy. We may restrict or remove public content where appropriate.

We do not sell Uploaded Files. Except as described in the Disclosure of your information section, including where disclosure is required by law or occurs in connection with a business transaction, we do not disclose private Uploaded Files or their contents to antivirus vendors, threat-intelligence services, public malware repositories, or other third parties for their independent purposes. We may provide private Uploaded Files to Service Providers acting on our behalf to the extent necessary to operate the Service, subject to applicable contractual and confidentiality obligations, and we do not submit private Uploaded Files or their cryptographic hashes to third-party reputation services. Scan reports may include links you can choose to follow to look up a file hash on a third-party service; that service receives the hash only if you follow the link.

We store file content once per unique file. If another customer independently uploads the same file, each scan references the same stored content, and deleting your scan does not remove the file for a customer who uploaded it independently.

Some features of the Service, such as automatically generated scan summaries, are produced using hosted artificial-intelligence models operated by our Service Providers. To generate these features, we send the model only selected information derived from your scan: file-type and code-signing information, behaviors observed during the analysis, detection-rule findings, and the status of the analysis, such as whether the sample was executed. Observed behaviors are analysis telemetry and can include text originating from the Uploaded File, such as file paths, process command lines, network destinations, and the submitted file name. For private scans, the detection-rule findings may include the descriptive finding text produced by your custom detection rules; we do not send the rules themselves or their names, and summaries for public scans are generated without reference to your custom detection rules. We do not send the Uploaded File itself or information identifying you or your Account to the model provider. Our AI infrastructure provider does not use this information to train AI models or to improve its own or third parties' services, and providers may retain it for a limited period to secure and operate their services.

We may access or inspect Uploaded Files and analysis results when reasonably necessary to provide support, troubleshoot the Service, detect or prevent abuse, maintain the security and integrity of the Service, enforce our agreements, or comply with legal obligations.

We may use aggregated or de-identified technical information derived from use of the Service to operate, secure, analyze, and improve Bintracer, provided that the information does not identify you or disclose the contents of your Uploaded Files. We maintain de-identified information in de-identified form and do not attempt to reidentify it, except as permitted by applicable law to test or validate our de-identification measures. If we disclose de-identified information to another party, we require that party to maintain it in de-identified form and not attempt to reidentify it. Information that is merely pseudonymized, or that remains reasonably capable of being linked to an identifiable individual, is not treated as de-identified and continues to be treated as Personal Data.

Submitted Content may incidentally contain Personal Data, including sensitive information or information relating to third parties, such as credentials, communications, financial information, or location information embedded in a malware sample. We do not require or intentionally request sensitive Personal Data in order to provide the Service. Unless we have expressly agreed otherwise in writing, the Service is not intended for protected health information, payment-card data, government-classified information, or other data whose processing would require specialized contractual or security controls; our Terms of Service describe these restrictions. You are responsible for ensuring that you have the right and authority to submit content to the Service, should avoid submitting Personal Data that is unnecessary for the analysis being performed, and must never include Personal Data, credentials, or regulated information in a public scan.

Certain Personal Data is required to create and maintain an Account, authenticate you, provide requested analyses, or process a paid subscription. If you do not provide required information, we may be unable to create your Account, provide the relevant part of the Service, or complete your purchase. Other information is optional.

We use Cookies and similar technologies to operate the Service, maintain security, authenticate users, remember preferences, and understand how the Service is used. Cookies may include session Cookies, which are removed when you close your browser, and persistent Cookies, which remain on your device for a period of time.

The technologies we currently use are:

• Essential Cookies and storage. Our identity provider sets an authentication Cookie so you can sign in and stay signed in, Cloudflare Turnstile is used to distinguish people from automated traffic when files are uploaded, and preferences such as your theme, along with your cookie-consent choice itself, are stored in your browser. These are required for the Service to function and are always active.
• Analytics. With your consent, we use PostHog to understand how the Service is used, such as which pages and features are visited. When you are signed in, analytics information is associated with your Account. PostHog sets Cookies and browser-storage entries (with names beginning "ph_") only after you accept analytics; if you decline or later withdraw consent, we stop analytics collection and remove them.
• Error reporting. We use Sentry to collect diagnostic information when the Service encounters an error. Error reporting is a strictly necessary diagnostic technology: reports are relayed through our own infrastructure, may include the page you were viewing, browser and device information, and technical details of the error, are not associated with your name or email address, and are not used for advertising.
• Embedded services. The demo-scheduling page embeds Cal.com. When that page loads, Cal.com receives standard request information from your browser, such as your IP address, browser information, and referrer, and it collects the information you enter to book a demo under its own privacy policy. Our pages load fonts from Google Fonts, which receives standard request information such as your IP address.

We use non-essential Cookies and similar technologies, such as analytics, only after you accept them through our cookie banner. You can change or withdraw your choice at any time using the "Cookie settings" link in the footer of every page. Declining analytics does not affect your ability to use the Service.

You can also instruct your browser to refuse Cookies or notify you when a Cookie is being set. Some parts of the Service, including authentication and account functionality, may not work correctly if required Cookies are disabled.

We do not permit third parties to collect Personal Data about your online activities over time and across unrelated websites or online services for cross-context behavioral advertising. Service Providers may collect limited device, browser, usage, or diagnostic information on our behalf for analytics, security, fraud prevention, error reporting, or performance monitoring, as described in this Privacy Policy.

We do not sell your Personal Data or use it for targeted advertising or cross-context behavioral advertising.

We may use Personal Data:

• To provide, operate, maintain, and improve the Service.
• To create and manage your Account.
• To authenticate users and protect Accounts.
• To perform malware analysis and provide analysis results.
• To process subscriptions, billing, and payments.
• To communicate with you about your Account, the Service, security matters, support requests, and material changes to the Service.
• To respond to questions, requests, and customer-support inquiries.
• To send product announcements, educational materials, offers, or other marketing communications where permitted by law, including following up on a demo request.
• To monitor performance and understand how the Service is used.
• To detect, investigate, and prevent fraud, abuse, security incidents, and violations of our agreements.
• To comply with legal obligations and respond to lawful requests.
• To establish, exercise, or defend legal claims.
• To evaluate or complete a merger, acquisition, financing, restructuring, sale of assets, or similar business transaction.

Where applicable law requires us to identify a legal basis for processing, we rely on the following bases:

• Performance of our contract with you: creating and managing your Account, providing the Service and the analyses and features you request (including AI-generated summaries), providing support, and processing subscriptions and payments.
• Legal obligation: retaining billing, tax, and accounting records, and responding to binding legal requests.
• Legitimate interests: securing the Service, security logging, preventing fraud and abuse, troubleshooting and improving the reliability and performance of the Service, communicating with customers, sending direct marketing to existing customers where permitted, enforcing our agreements, and administering our business.
• Legitimate interests (public scan archive): where Personal Data is contained in a Public Sample or its analysis results, operating the public scan archive and making Public Samples and their analysis results available and reusable for security research, threat intelligence, detection development, education, and the operation and improvement of the Service, in our legitimate interest and the legitimate interest of the security community in analyzing and defending against malicious software. The safeguards that accompany this processing, and how to object to it or request removal, are described in the Personal Data about people who do not use Bintracer section.
• Consent: optional analytics, and marketing communications where applicable law requires consent. You may withdraw consent at any time; withdrawal does not affect processing that occurred before it.

Right to object: where we process Personal Data based on our legitimate interests, you may object to that processing on grounds relating to your particular situation, and you may object to processing for direct marketing at any time, as described in the Your privacy rights section.

You may opt out of marketing communications at any time by using the unsubscribe mechanism included in the message or by contacting us at support@bintracer.com. You will continue to receive transactional, security, billing, and other non-marketing communications about your Account and the Service.

We do not use Personal Data to make decisions about you based solely on automated processing that produces legal or similarly significant effects concerning you.

The table below summarizes how the main categories of information we process are used, the legal bases we rely on where applicable law requires one, who typically receives them, and how long they are kept. The other sections of this Privacy Policy provide more detail.

We may disclose information in the following circumstances:

Service Providers. We may provide information to Service Providers that help us operate the Service, including providers of hosting, storage, databases, authentication, payment processing, email delivery, scheduling, analytics, monitoring, security, customer support, and hosted artificial-intelligence services. These providers may process information only as necessary to provide their services to us and subject to applicable contractual obligations. Some recipients, such as our payment processor, may also process certain information as independent controllers under their own privacy notices, including for fraud prevention, regulatory compliance, and their own legal obligations.

Legal requirements and security. We may disclose information if we reasonably believe disclosure is required by law, legal process, or a valid governmental request, or when necessary to protect the rights, property, or safety of Bintracer, our users, or others; investigate fraud or abuse; or protect the security and integrity of the Service.

Business transfers. We may disclose or transfer information in connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction involving all or part of our business.

With your direction or consent. We may disclose information when you direct us to do so or otherwise consent to the disclosure.

We do not sell your Personal Data.

We retain Personal Data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Service, maintain security, comply with legal obligations, resolve disputes, and enforce our agreements.

Uploaded Files, other Submitted Content, and related analysis results are retained while your Account remains active, or until you delete the associated scan or your Account. If your plan includes a shorter retention period, that period is described through the Service or in an applicable order form, and content may be deleted automatically after it expires. Plans that include scan deletion can delete individual scans from the dashboard, and deleting your Account removes your samples and analysis results on any plan. The availability of scan-deletion features under a particular plan does not limit any privacy rights available to you under applicable law.

When you delete a scan or your Account, we remove the scan record, your Account's association with the scan, your analysis results, and any underlying stored content that is not still required for another customer's independently submitted scan from our active systems within 24 hours. Content that another customer independently uploaded remains for that customer. For public scans, copies that other people or search engines have already obtained cannot be retrieved; where applicable law requires, however, we will take reasonable steps to notify relevant recipients or other controllers of a valid erasure request and to request removal or deindexing of links to or copies of the content. In addition, to the extent permitted by applicable law, de-identified indicators, detections, and threat-intelligence material already derived from a public scan may be retained where it does not identify an individual and does not disclose the contents of a private Uploaded File, as described in the Public Samples section of our Terms of Service.

Temporary processing data generated during an analysis, such as sandbox telemetry evaluated against detection rules, is automatically deleted within approximately one hour after the analysis completes.

Backup copies expire or are overwritten within 30 days of deletion from active systems.

Account information is retained while your Account remains active. After your Account is deleted, we retain a limited record of the deletion, including the email address that was associated with the Account, for up to 24 months where necessary to prevent fraud and abuse, enforce our agreements, and comply with legal obligations.

Analytics information is retained for up to 12 months. Diagnostic and error information is retained for up to 90 days. Security and abuse-prevention logs are retained for up to 12 months, unless a longer period is necessary to investigate an incident, enforce our agreements, or comply with a legal obligation.

Support, demo, and other communications are retained for up to 24 months after our last interaction with you. If you unsubscribe from marketing communications, we keep a minimal record of that choice so that we do not contact you with marketing again.

Certain billing, tax, transaction, and business records may be retained for longer periods where required by law.

We use reasonable administrative, technical, and organizational safeguards designed to protect Personal Data and Uploaded Files against unauthorized access, loss, misuse, alteration, or disclosure.

However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

If your Account is part of a Team or Enterprise organization, that organization controls your Account and the content associated with it. Members of your organization can view the scans, analysis results, and custom rules associated with the organization, including your name and email address as the submitter of a scan, and may be able to manage or delete organization scans. Organization Accounts are created and removed by the organization: contact your administrator to change or delete your Account, and contact your organization for information about its own privacy practices. You may also contact Bintracer directly at privacy@bintracer.com regarding Personal Data that Bintracer processes for its own purposes, such as website, billing, security, support, and marketing information.

For Personal Data that we collect and use for our own business purposes, such as Account, billing, security, and website information, Bintracer generally acts as the controller or business responsible for that information. Bintracer also acts as a controller of the public scan archive: when we make public scans available and reuse them as described in this Privacy Policy and the Public Samples section of our Terms of Service, we determine the purposes of that processing.

When Bintracer processes Personal Data contained in Uploaded Files or other customer content on behalf of a business customer, the customer generally determines the purposes of that processing and Bintracer acts as a processor or service provider on the customer's behalf. When an individual user submits Uploaded Files for their own purposes, Bintracer processes that content as described in this Privacy Policy in order to provide the Service to that user.

Where required by applicable law or our agreement with a customer, this processing is governed by a data processing agreement between Bintracer and the customer, such as our Data Processing Addendum. The Data Processing Addendum also describes how to obtain our current list of Subprocessors and subscribe to notifications of changes to it.

Malware and the other content analyzed by the Service can contain Personal Data about people who have no relationship with Bintracer. If you do not use Bintracer, Personal Data relating to you may still reach us from:

• another customer or user who submits content to the Service;
• an Uploaded File, such as a malware sample containing stolen credentials, communications, financial information, or location information; or
• the technical artifacts and analysis results generated when that content is analyzed.

We do not seek out this information: it arrives incidentally inside the content that a user submits for analysis, and we do not use it to contact you, to market to you, to build profiles about you, or to make decisions about you.

Our role in this processing depends on the scan. Where the content was submitted privately by a business customer, Bintracer processes it as a processor or service provider on that customer's instructions, and requests concerning the information are best directed to that customer; if you contact us about information processed on a customer's behalf, we will forward your request to the customer where we can identify them. Where the content was submitted by an individual user, or is part of the public scan archive, Bintracer acts as a controller, and processes the information to provide the Service to the submitting user, to secure and operate the Service, and, for Public Samples, to operate the public scan archive on the legal bases described in the How we use your Personal Data section.

For private scans, this information is disclosed only as described in the Disclosure of your information section. For public scans, the Uploaded File and its analysis results are publicly available and may be viewed, copied, downloaded, and indexed by other users, security researchers, search engines, and other members of the public, as described in the Collecting and using your Personal Data section. The information is retained with the associated scan, as described in the Retention of your information section.

You do not need a Bintracer account to exercise privacy rights or to request removal of your information. If Personal Data about you appears in a scan, contact privacy@bintracer.com and include the scan URL or the file hash if you have it, or report public content under our Public Content and Takedown Policy. We may remove or restrict public content in response to a report, and the rights described in the Your privacy rights section, including the rights to object and to request deletion, are available to you regardless of whether you use the Service.

Depending on where you live, you may have rights regarding your Personal Data, including the right to:

• Request access to Personal Data we maintain about you.
• Request correction of inaccurate Personal Data.
• Request deletion of Personal Data.
• Request a copy of certain Personal Data in a portable format.
• Object to or request restriction of certain processing.
• Withdraw consent where processing is based on your consent.
• Appeal our response to a privacy request where applicable law provides that right.

Where applicable law provides these rights, you may also opt out of the sale of Personal Data, the processing of Personal Data for targeted advertising, or profiling in furtherance of decisions that produce legal or similarly significant effects, and you may have the right to limit certain uses or disclosures of sensitive Personal Data. Bintracer does not sell Personal Data, process Personal Data for targeted advertising, or engage in profiling that produces legal or similarly significant effects.

These rights may be subject to exceptions and limitations under applicable law.

You may submit a privacy request by contacting us at privacy@bintracer.com. We may need to verify your identity before completing your request; information you provide for verification is used only to process the request and is deleted when it is no longer needed for that purpose. We will respond within the time required by applicable law. We do not charge a fee to process a privacy request unless it is excessive, repetitive, or manifestly unfounded, in which case we may charge a reasonable fee or decline the request where applicable law permits.

Where applicable law permits, you may use an authorized agent to submit a privacy request on your behalf. We may require the agent to provide proof of authorization and may require you to verify your identity or confirm the request directly with us.

To appeal a decision we have made regarding a privacy request, email privacy@bintracer.com with the subject line "Privacy Appeal" and explain the basis for your appeal. We will review your appeal and respond as required by applicable law. If we deny an appeal, we will provide information about any additional complaint rights available to you, such as the ability to contact your state attorney general.

You will not receive discriminatory treatment for exercising privacy rights provided by applicable law.

Data-protection complaints for UK individuals. If UK data-protection law applies to our processing, you may submit a complaint about how we handle your Personal Data by emailing privacy@bintracer.com with the subject line "Privacy Complaint". We will acknowledge your complaint within 30 days, investigate it as appropriate, keep you informed where necessary, and communicate the outcome without undue delay. You also have the right to complain to the UK Information Commissioner's Office.

If you are located in the European Economic Area, United Kingdom, or another jurisdiction that provides a right to complain to a supervisory authority, you may also have the right to submit a complaint to the applicable data-protection authority.

Some browsers provide a "Do Not Track" setting. Because there is no uniform standard governing how websites must respond to these signals, the Service does not currently respond to browser Do Not Track signals.

We do not sell Personal Data, and we do not share or process Personal Data for targeted advertising or cross-context behavioral advertising. Where applicable law requires us to recognize a legally valid opt-out preference signal, we will process that signal as required by law.

Bintracer is based in the United States, and information we process may be transferred to, stored in, or processed in the United States or other countries where we or our Service Providers operate.

Those countries may have data-protection laws that differ from the laws where you live. Where applicable law requires safeguards for international transfers of Personal Data, we rely on lawful transfer mechanisms as applicable, such as transfers to countries or recipients covered by an adequacy decision; standard contractual clauses approved by the European Commission; for transfers subject to UK law, the UK International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses; or other lawful transfer mechanisms.

You may contact us at privacy@bintracer.com for more information about the safeguards applied to a particular transfer.

The Service is intended for professional and business use and is not available to anyone under the age of 18. Consistent with our Terms of Service, you must be at least 18 years old to use the Service, and we do not knowingly permit anyone under 18 to create an Account.

We also do not knowingly collect Personal Data online directly from a child under the age of 13. If we learn that we have collected Personal Data from a person who is not eligible to use the Service, we will take appropriate steps to delete it.

If you believe a child has provided Personal Data to us, please contact us at privacy@bintracer.com so that we can take appropriate action.

We may update this Privacy Policy from time to time.

When we make changes, we will update the "Last updated" date at the top of this page. Where required by applicable law, we will provide additional notice of material changes, and we may also provide notice through the Service, by email, or through another appropriate method.

We encourage you to review this Privacy Policy periodically for changes.

If you have questions about this Privacy Policy or would like to make a request regarding your Personal Data, contact us at:
Bintracer, LLC
c/o Legalinc Corporate Services Inc.
131 Continental Dr, Suite 305
Newark, DE 19713, United States
Email (privacy requests): privacy@bintracer.com
Email (general support): support@bintracer.com