1. Controller and Contact Information

QUATTROBIT, Inc. is the controller of personal data described in this Policy. If a separate written data-processing agreement identifies QUATTROBIT as a processor for a business customer, that agreement governs the processing performed on that customer's behalf. Some third-party services act as independent controllers under their own terms.

QUATTROBIT, Inc.
1111B South Governors Ave, Suite 24469
Dover, Delaware 19904, United States
Email: support@octron.ai

2. How Octron Is Structured

Octron connects authorized clients to a computer or server registered to your account (a "Spire"). A Spire may be your own computer, an Octron device, or, when offered and purchased, a Managed Spire. The Octron account service is the source of truth for identity, linked sign-in methods, registered clients and Spire references, entitlements, and authorization records. The Host Runtime on the selected Spire owns the workload, files, terminal and agent state, and local credentials. The account service is not intended to be general storage for that working data.

When you use a feature that sends commands, files, events, notifications, or results between authorized clients and a Spire, the data needed for that feature is transmitted and may be retained as described below. If we offer a Managed Spire, its plan and checkout disclosures will identify the included infrastructure, storage, backup, and deletion terms. Data sent to an AI provider through an agent is processed under the account and terms you maintain with that provider.

3. Personal Data We Collect

• Account and identity data: name, email address, username, authentication provider identifiers, account status, and an optional phone number when needed for billing, delivery, support, or account security.
• Authentication and security data: password hashes for email accounts, session and refresh-token records, linked sign-in methods, verification status, IP address, timestamps, security events, and fraud-prevention signals.
• Device and application data: installation identifier, platform, operating system, app version, locale, timezone, notification preferences, push tokens, and Live Activity identifiers and tokens.
• Spire and operational data: Spire identifier, name, type, online status, capabilities, health and resource metrics, software version, session and approval status, connection metadata, diagnostics, and audit events.
• User content: prompts, messages, files, terminal input and output, approvals, browser interactions, audio, images, clipboard content, and agent results only when you use a feature that requires that content to be transmitted or stored.
• Communications: support requests, feedback, survey responses, and communications about your account or the Service.
• Transaction data: plan, subscription status, invoices, transaction identifiers, and limited billing metadata. Full payment-card details are handled by the payment provider identified at checkout.
• Website and network data: IP address, browser type, request metadata, necessary cookie identifiers, and security logs. We may infer an approximate region from an IP address, but Octron does not require precise location access.

We collect this data directly from you; automatically from the website, Octron applications, and registered Spires you use; and from services you choose to connect, such as identity, application-store, communications, infrastructure, and payment providers. We do not obtain personal data from data brokers.

4. Device Permissions

Depending on the feature you choose, Octron may request access to notifications, camera, microphone, photos, files, clipboard, local network, or biometric authentication provided by your device. These permissions are used to perform the action you request. You can change them in your operating-system settings. Biometric templates remain under the control of the device platform and are not received by QUATTROBIT.

5. How We Use Personal Data

• Provide accounts, connect authorized devices and Spires, and synchronize Service state.
• Deliver commands, agent events, approvals, notifications, Live Activities, files, and results.
• Provision, operate, support, and secure a Managed Spire when you purchase one.
• Process subscriptions, maintain entitlements, and prevent payment or account fraud.
• Diagnose failures, maintain reliability, develop features, and provide customer support.
• Protect users, investigate abuse and security incidents, and enforce our Terms.
• Comply with law, valid legal process, sanctions, tax, and accounting obligations.

We do not sell personal data, share it for cross-context behavioral advertising, or use user content to train our own or third-party general-purpose AI models.

6. Legal Bases

• Contract: creating and authenticating your account, connecting authorized clients and Spires, delivering requested actions and results, providing support, and administering a subscription you purchase.
• Legitimate interests: securing the Service, preventing fraud and abuse, maintaining reliability, diagnosing failures, and improving features using operational telemetry that is reasonably necessary for those purposes.
• Consent: optional device permissions, non-essential communications, and any processing for which we specifically ask for consent.
• Legal obligations: tax, accounting, sanctions, lawful requests, and other duties imposed by applicable law.

You may withdraw consent at any time, without affecting processing already performed lawfully. Where we rely on legitimate interests, you may object as described in Section 13.

7. User-Owned Spires and Managed Spires

For a user-owned Spire, QUATTROBIT does not create a general backup of the computer. You control local retention and deletion. Octron transmits data needed to perform requested remote actions and may keep limited operational metadata needed for identity, delivery, synchronization, security, and recovery.

If you purchase a Managed Spire, QUATTROBIT and the infrastructure providers identified for that service store the files, runtime state, and logs needed to operate it. A backup or recovery period exists only when the applicable plan or checkout expressly includes one. The stated schedule, retention, limits, and deletion terms for that plan control. You should export critical data independently.

8. AI Providers and Other User-Directed Services

Octron can operate third-party AI agents and services that you install, authorize, or sign into, such as coding agents or model providers. Those providers process data under their own agreements with you. QUATTROBIT does not receive ownership of your third-party account and does not treat a provider selected under your own account as an Octron subprocessor. Review the provider's terms and privacy policy before sending sensitive data.

9. Disclosure of Personal Data

We may disclose personal data:

• To service providers and subprocessors that help operate and secure the Service.
• To a third-party service when you request a connection, sign-in, command, or data transfer.
• To comply with law, valid legal process, or an enforceable governmental request.
• To protect the rights, safety, and security of users, QUATTROBIT, and the public.
• In a merger, financing, reorganization, acquisition, or sale of assets, subject to appropriate safeguards.

Our current providers and their functions are listed at octron.ai/subprocessors.

10. Retention

• Account data is retained while the account is active and ordinarily deleted or de-identified within 30 days after we verify and complete a valid deletion request.
• Device, session, push, and linked-identity records are retained until revoked, unlinked, expired, or the account is deleted, then ordinarily for no more than 30 days.
• Security and audit logs are ordinarily retained for 90 days.
• Support communications are ordinarily retained for 24 months.
• Pre-launch Connect submissions are retained for up to 12 months or until consent is withdrawn.
• Control-plane disaster-recovery backups are encrypted and retained for up to 30 days.
• Billing, tax, and accounting records may be retained for up to seven years or longer when required by law.
• Managed Spire data, if that service is purchased, follows the retention and deletion period disclosed for the applicable plan and at checkout.

We may retain limited records longer where required by law, necessary to resolve a dispute, or needed to protect the Service from fraud or abuse. Data already de-identified so that it can no longer reasonably identify a person may be retained.

11. Security

We use administrative, technical, and physical safeguards designed for the nature of the data and the Service, including access controls, encryption in transit, encrypted disaster-recovery backups where configured, credential separation, and audit logging where appropriate. No system is completely secure. Keep your devices, recovery methods, and third-party credentials protected, and notify us promptly of suspected unauthorized use.

12. International Transfers

QUATTROBIT is based in the United States, and our providers operate in the United States, European Economic Area, and other countries. Where required, we use recognized transfer mechanisms such as the European Commission's Standard Contractual Clauses and apply supplementary safeguards appropriate to the transfer. You may request information about the applicable safeguards, including a copy where available, by contacting support@octron.ai.

13. Your Privacy Rights

Depending on your location, you may have rights to access, correct, delete, export, restrict, or object to processing of personal data; withdraw consent; appeal a decision; or complain to a supervisory authority. You may also request account deletion and unlink or revoke devices and sign-in methods through available account controls or by contacting support when a control is not yet available in your client.

Submit a request through available account settings or email support@octron.ai. We may verify your identity before acting. Authorized agents may submit requests where permitted by law. We will not discriminate against you for exercising a privacy right.

14. United States State Disclosures

In the preceding 12 months, we may have collected the categories described in Section 3, including identifiers and account records; commercial and subscription information; internet, network, device, and application activity; approximate location inferred from an IP address; communications and user content you chose to transmit; and security or fraud-prevention inferences. The sources are described after Section 3, the business purposes are in Section 5, and the categories of recipients are in Section 9.

Residents of California and other states with applicable privacy laws may exercise applicable access, correction, deletion, portability, opt-out, and appeal rights. We do not sell personal data or share it for cross-context behavioral advertising and therefore do not offer a sale or targeted-advertising opt-out. We do not knowingly use sensitive personal data to infer characteristics about users.

15. Automated Decisions

QUATTROBIT does not use personal data to make solely automated decisions that produce legal or similarly significant effects about you. Agents may perform user-directed automated tasks on a Spire, but those tasks do not determine your legal rights, credit, employment, insurance, housing, or eligibility for an essential service on QUATTROBIT's behalf.

16. Cookies and Similar Technologies

The website uses cookies and local storage that are necessary for authentication, security, preferences, and basic operation. We do not currently use third-party behavioral advertising cookies. If this changes, we will update this Policy and provide any consent controls required by law.

17. Age Requirement

The Service is intended only for people who are at least 18 years old. We do not knowingly collect personal data from anyone under 18. Contact us if you believe a person under 18 has created an account.

18. Changes to This Policy

We may update this Policy as the Service, providers, or law changes. We will post the revised version with a new effective date and provide additional notice when a change materially affects your rights.

19. Contact

For privacy questions or requests, contact support@octron.ai or write to the address in Section 1.