Privacy Policy

1. Who we are

This Privacy Policy explains how Shubham Gupta trading as Watch Dog ("Watch Dog", "we", "us") handles personal information when you visit our websites, install the extension, or use the organization dashboard. Contact: support.watchdogdlp@gmail.com.

2. Roles

• Website & marketing visitors: we are the controller of limited contact and analytics data.
• Individual / free extension users: scanning stays local; we generally do not receive file content or upload telemetry.
• Organization accounts: your organization is the controller of audit metadata about its users; we act as a processor / service provider under our DPA.

3. Data we access in the extension

Watch Dog only reads files that a user explicitly selects or drops into the browser to upload. We do not access browsing history, cookies, location data, or unrelated personal information beyond what is required to intercept and scan that upload.

4. What happens to your files

• File content is loaded into memory on the device for scanning.
• Pattern, metadata, and content checks run locally.
• File bytes are discarded after scanning and are never transmitted to Watch Dog servers.

5. Audit metadata (organization accounts)

For organization accounts we may store content-free audit metadata such as:

• Event type (e.g. warn / block)
• Rule category matched (not the sensitive value itself)
• Destination domain
• User and organization identifiers
• Timestamp

Metadata is stored in your organization's isolated database (Supabase) with row-level security so tenants cannot read each other's events.

6. Account & billing data

When you create an account or purchase a plan we process identity and billing data (name, work email, company, seat counts, Stripe customer and subscription identifiers). Payment card data is processed by Stripe; we do not store full card numbers.

7. Website data & cookies

Our marketing site and dashboard may use cookies or similar technologies as described in the Cookie Policy (e.g. essential session cookies, optional analytics).

8. Purposes & legal bases

We process data to:

• Provide and secure the service (contract / legitimate interests)
• Bill and support customers (contract)
• Improve product reliability (legitimate interests; aggregated/technical)
• Comply with law

9. Sub-processors

We use Supabase (auth and org-isolated audit database) and Vercel (hosting). Stripe processes payments. Details and updates appear on our Security page. Organization customers are covered by the DPA.

10. International transfers

Infrastructure may process data in regions offered by our sub-processors (including outside Australia). Where required, we use appropriate safeguards (such as Standard Contractual Clauses with sub-processors) as described in the DPA.

11. Retention

• Audit metadata: retained for the period configured on your plan (or until org deletion), then deleted or anonymized.
• Account records: kept while the account is active and for a reasonable period afterward for billing disputes and legal compliance.
• Marketing contact forms: retained as needed to respond to your request.

12. Security

We use technical and organizational measures appropriate to our early-access stage, including tenant isolation via row-level security and least-privilege extension permissions. See Security & privacy posture. No method of transmission or storage is 100% secure.

13. Your rights

Depending on your location (including Australia APPs and, where applicable, GDPR), you may have rights to access, correct, delete, port, or restrict processing of personal information, and to lodge a complaint with a regulator. Organization users should contact their admin first for audit-log related requests; we will assist the organization as processor. Email support.watchdogdlp@gmail.com.

14. Breach notification

If we become aware of a personal data breach affecting organization customer data we process, we will notify the customer without undue delay and help meet applicable notification duties, as further set out in the DPA.

15. Children

Watch Dog is not directed to children under 16. We do not knowingly collect their personal information.

16. Changes

We may update this Policy and will revise the "Last updated" date. Material changes for org customers will be communicated where practicable.

17. Governing law

This Policy is designed for operations under the laws of Western Australia, Australia.