Privacy Policy

1. Who this applies to

This Privacy Policy describes how [COMPANY LEGAL NAME] ("SnT Networks", "we", "us") collects, uses, and protects information when you use SnT AutoTool (the "Service"), including the web application, the desktop and CLI execution agents, and related APIs.

2. Information we collect

• Account information: name, work email, company, and role you or your administrator provide when creating an account.
• Network and device configuration: topology diagrams, device identifiers, IP addresses, and — where you choose to store them — device SSH/administrative credentials, so the Service can run tests against your infrastructure.
• Test and execution data: generated test cases, execution results, command output, and evidence artifacts produced by running the Service.
• Usage and diagnostic data: login sessions, audit/event logs, and agent health/version telemetry needed to operate and secure the Service.

3. How we use information

We use the information above to operate the Service (running and reporting on tests you request), maintain security (audit logs, session management, abuse prevention), provide support, and improve the product. We do not sell customer data.

4. AI processing and subprocessors

Certain features (product/capability discovery, AI-generated test cases, semantic test synthesis) send relevant technical context — product names, inferred capabilities, and topology metadata — to a third-party AI provider ([Google Gemini / other provider name]) to generate results. [Describe here: is device credential data ever included in these calls? If not, state that explicitly, since it's the detail customers and their security teams will ask about first.] A full list of subprocessors should be maintained and linked here.

5. Data retention

[State concretely how long test results, execution history, and audit/event logs are retained, and what happens to data after a customer account is closed or a subscription ends.]

6. Security

We use encryption in transit (TLS) for all Service traffic. Stored device credentials are encrypted at rest using [describe the actual mechanism and confirm it is enabled in production before this line is published — do not state this is true unless it is]. Access to production systems is restricted and logged. [Add any relevant certifications, pen-test cadence, or incident-response commitments once they exist.]

7. Your rights

Depending on your location, you may have rights to access, correct, export, or delete your personal data. Contact us at [privacy@yourdomain.example] to make a request. [Add region-specific language — GDPR/UK GDPR, CCPA, India's DPDP Act, etc. — for every region you'll actually sell into; this needs a lawyer's input on which apply to you.]

8. Contact

Questions about this policy: [privacy@yourdomain.example]. See also our support page.