Privacy Policy

CloFix WAF ("we", "our", or "us") develops and operates the CloFix WAF mobile application (the "App"). This Privacy Policy explains how we handle information when you use our Android application. Protecting your data is a top priority, and we are committed to transparency and compliance with Google Play Store requirements.

1. Information We Collect

The CloFix WAF Android application is designed to provide real-time web application firewall monitoring, security analytics, and alerts. We do not collect sensitive personal information (such as names, email addresses, financial data, or precise geolocation) unless you voluntarily provide it through direct support inquiries.

To ensure the App functions correctly and delivers security notifications, our systems may process the following limited technical data:

• Firebase Cloud Messaging (FCM) registration token - used exclusively to deliver push notifications for real‑time security alerts.
• App diagnostic & crash logs - anonymized information about app performance, stability, and potential errors to improve user experience.
• API metadata & device tokens - necessary communication metadata to authenticate your infrastructure and display security analytics from our backend.
• Device platform & OS version (non‑identifiable) - used for compatibility and troubleshooting.

If you contact our support team via email (support@clofix.com), any personal information you choose to share (e.g., email address, name) will be used solely to respond to your inquiry and never sold or rented.

2. Firebase Cloud Messaging (FCM) & Third-Party Services

CloFix WAF relies on Firebase Cloud Messaging (FCM), a service provided by Google, to send real-time threat alerts and push notifications. FCM may collect certain device identifiers and metadata as described in Google's Privacy Policy. We do not control how Google collects or processes data via FCM, but we ensure that the tokens we receive are used only for notification delivery.

Google Privacy Policy: https://policies.google.com/privacy

Additionally, our App communicates with a secure backend API hosted on trusted infrastructure. All data exchanged between the App and our servers is encrypted using industry-standard TLS protocols.

3. How We Use Information

The limited information processed by the App is used only for the following legitimate purposes:

• 🎯 Displaying accurate security analytics, WAF events, and monitoring dashboards.
• 🔔 Sending real-time push notifications about threat detections, blocked attacks, or infrastructure status changes.
• ⚙️ Improving app stability, diagnosing crashes, and enhancing performance.
• 🔐 Maintaining secure communication with backend services and authenticating your access.

We never use your data for any machine learning, user profiling, or marketing campaigns.

4. Data Sharing & Disclosure

We do not sell, rent, trade, or otherwise share your personal information with third parties for marketing or advertising purposes.

Limited data may be shared only with essential service providers that enable core functionality:

• Google (Firebase) - for push notifications and crash diagnostics, subject to Google’s privacy commitments.
• Secure cloud infrastructure providers (e.g., hosting and API gateways) - only for data transport and storage; these providers are contractually obligated to maintain confidentiality and security.

We may also disclose information if required by law, regulation, legal process, or to protect the rights, property, or safety of CloFix WAF, our users, or the public.

5. Data Retention & Deletion

We retain device notification tokens and diagnostic data only as long as necessary to provide push notifications, maintain App functionality, and ensure security monitoring continuity.

• FCM tokens: Stored until the App is uninstalled or the token becomes invalid. Tokens are automatically removed after 90 days of inactivity.
• Crash logs & diagnostics: Anonymized logs are kept for up to 90 days to identify and fix issues.
• Backend analytics data: Security event data tied to your account (e.g., blocked attacks) is retained according to infrastructure retention policies, but does not include personal identifiers beyond account references.

Upon request, we will delete any residual information associated with your device or account. To request deletion, email support@clofix.com with the subject "Data Deletion Request". We will respond within 30 days.

6. Your Privacy Rights (GDPR, CCPA & Global Rights)

Depending on your jurisdiction (including the European Economic Area, United Kingdom, California, Brazil, or other regions), you may have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Correct any inaccurate or incomplete data.
• Erasure (Right to be forgotten): Request deletion of your data.
• Restriction of processing: Limit how we use your data.
• Data portability: Receive your data in a structured, machine-readable format.
• Opt-out of notifications: Disable push notifications at any time via device settings or in-app preferences.

To exercise any of these rights, contact us at support@clofix.com. We will not discriminate against you for exercising your privacy rights.

7. Data Security

We implement robust security measures to protect all information processed by the App and backend infrastructure. These include:

• 🔒 End‑to‑end encryption (TLS 1.3) for all API communications.
• 🛡️ Regular security audits, penetration testing, and dependency updates.
• 🔐 Strict access controls and authentication mechanisms for backend services.
• 📱 Code obfuscation and secure storage practices (no sensitive data stored permanently on device).

While no system is 100% secure, we continuously evolve our security posture to protect against unauthorized access, disclosure, or misuse.

8. Children's Privacy

Our application is not intended for children under the age of 13 (or the relevant age of digital consent in your region). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us immediately, and we will take steps to delete such information.

9. International Data Transfers

CloFix WAF and its service providers (including Google Firebase) may operate globally. Your information may be transferred to and processed in countries other than your own. When we transfer data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) or equivalent legal mechanisms to ensure your data remains protected.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Any revisions will be posted on this page with an updated "Effective Date". For significant changes, we will notify you via the App (e.g., pop-up notice or push notification) or email (if available). Your continued use of the App after the revised policy becomes effective indicates your acceptance of the updated terms.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out to our Data Protection Officer (DPO) team:

🌐 Website: https://clofix.com
📧 Email: support@clofix.com
📬 Mailing address: CloFix Infotech, Agargoan, Dhaka-1207, Bangladesh.(available upon request via email).

---