Privacy Policy

1. Scope

This policy applies to information we process through the ClickFix Guard service, browser extension, web console, and websites (the “Service”), operated by SRM Systems, LLC (“SRM Systems,” “we,” “us,” or “our”). Your use of the Service is also governed by our Terms of Service.

2. Our role

ClickFix Guard is a business-to-business product. When an organization (our “Customer”) deploys the Service to its users' browsers, the Customer decides what is collected and why, and therefore acts as the controller (or equivalent) of its users' personal data. We act as the Customer's service provider/processor and handle that data on the Customer's behalf and under our agreement with them. If you are an end user and have questions about monitoring in your workplace, please contact your own organization first.

3. Information we collect

Account information. When an administrator creates an account, we collect name, work email, organization name, hashed credentials, and authentication factors (such as TOTP or passkeys).

Billing information. Subscriptions are handled by our third-party payment processor. We do not store full card numbers; we retain limited billing metadata such as plan, seat counts, status, and subscription identifiers.

Security event data. This is the core of the Service. When a website attempts a programmatic clipboard write in an enrolled browser, the extension evaluates it and may record metadata about the event, including: the site/domain and page URL (stripped of query strings), a classification of the content (for example, that it resembled a shell command), the enforcement decision, a cryptographic hash and length of the content, and, where the content is identified as command-like, the command text itself. Content that is not identified as command-like is recorded only as a hash and length, not as readable text.

Browser and deployment metadata. To administer policy and reporting, we collect an installation identifier, an optional device/browser name (for example, a computer name provided during enrollment), platform, extension version, user-agent, and an optional user email supplied by the Customer's deployment.

Support and website data. If you contact us or use our websites, we may collect the information you provide and basic technical/log data. Our web console stores a session token in your browser's local storage to keep you signed in.

The Service is designed to inspect website-initiated clipboard writes to detect attacks. It is not designed to continuously read or exfiltrate the contents of a user's clipboard for general purposes.

4. How we use information

• To provide, operate, secure, and support the Service, including detecting and blocking clipboard-based attacks and handling access requests.
• To evaluate the reputation of domains involved in an event and to produce automated recommendations (see below).
• To process subscriptions, prevent fraud, and meet legal and accounting obligations.
• To maintain security, troubleshoot, and improve reliability and detection quality.
• To communicate with administrators about the Service (for example, security, billing, and service notices).

5. Automated analysis

To help triage access requests, the Service can submit the flagged command and the associated domain-reputation signals to a third-party automated analysis provider, which returns a recommendation (such as approve, deny, or escalate). A Customer controls whether this feature is enabled and whether it acts advisory-only or automatically above a configured confidence threshold. Automated analysis is designed to assist human reviewers, not to make final decisions about individuals, and it can be disabled.

6. How we share information

We do not sell personal information. We share information only as needed to run the Service:

• Service providers (subprocessors). We use vetted providers for hosting/infrastructure, payment processing, email delivery, domain and threat-intelligence lookups, and automated analysis. They may process relevant data (for example, a domain name sent for a reputation check, or a flagged command sent for analysis) only to provide their service to us. A current list of subprocessors is available on request.
• With the Customer. Security event and account data is made available to the Customer organization that owns it.
• Legal and safety. We may disclose information if required by law or to protect the rights, safety, and security of our users, the public, or SRM Systems.
• Business transfers. If we are involved in a merger, acquisition, or sale of assets, information may be transferred subject to this policy.

7. Data retention

We retain account and billing records for as long as an account is active and as needed for legal and accounting purposes. Security event data is retained according to the Customer's plan (for example, a shorter window on free tiers and longer windows on paid plans), after which it is pruned automatically; a short grace period may apply following a plan change. Upon termination, we make data available for a limited period and then delete it in the ordinary course.

8. Security

We use administrative, technical, and organizational measures appropriate to the risk, including encryption of data in transit, encryption at rest for sensitive stored secrets, access controls, and support for multi-factor authentication. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

9. International transfers

We and our providers may process information in countries other than the one in which you reside. Where required, we rely on appropriate safeguards for cross-border transfers. [Confirm your hosting regions and transfer mechanisms with counsel.]

10. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or restrict the processing of your personal data, or to port it. Because we typically process end-user data on behalf of a Customer, we will refer end-user requests to the relevant Customer and support that Customer in responding. Administrators can manage much of their data directly in the console. To exercise rights or ask questions, contact us using the details below.

11. Children's privacy

The Service is a workplace security tool intended for organizations and is not directed to children. We do not knowingly collect personal information from children.

12. Changes to this policy

We may update this policy from time to time. If we make material changes, we will update the “Last updated” date and, where appropriate, provide additional notice.

13. Contact us

SRM Systems, LLC
[REGISTERED MAILING ADDRESS]
Email: [email protected]