Privacy Policy

1. Australian Privacy Principles (APPs) Compliance

CAMMIO Industries complies fully with the 13 Australian Privacy Principles set out in Schedule 1 of the Privacy Act 1988 (Cth):

• Open and Transparent Governance (APP 1): We clearly state the types of information collected (operator email, domain ownership verification proofs, scan summaries).
• Anonymity and Pseudonymity (APP 2): Free perimeter assessments can be initiated with operational aliases without providing personal identifiers.
• Collection of Solicited Information (APP 3): We only collect personal information reasonably necessary to maintain subscription credentials and deliver security scan deliverables.
• Direct Marketing Protections (APP 7): We do not engage in untracked direct marketing or permit third-party tracking pixels on authenticated application consoles.
• Access & Correction (APPs 12 & 13): You maintain an absolute right to access your stored records or request rectification of inaccurate profile data.

2. European Union GDPR Standards (Articles 13–22)

For operators and organizations located within the European Economic Area (EEA) and the United Kingdom, CAMMIO Industries guarantees complete adherence to GDPR Data Subject Rights:

• Right of Access (Article 15): Request a complete dossier of personal data and asset inventory records held by our platform.
• Right to Rectification (Article 16): Update or correct organizational details, billing contacts, and branding metadata at any time.
• Right to Erasure / "To Be Forgotten" (Article 17): Permanently delete your user account, scan histories, verified domains, and custom branding assets.
• Right to Restriction of Processing (Article 18): Pause active monitoring or freeze scheduled vulnerability audits upon request.
• Right to Data Portability (Article 20): Instantly export your profile, verified assets, and scan history in structured machine-readable JSON format via your Account Hub.
• Right to Object (Article 21): Object to automated processing or notification dispatches.

3. Ephemeral In-Memory Scanning & Code Confidentiality

Static Code Security (SAST): Source code, scripts, and repository files uploaded for security analysis are unpacked in memory within isolated, ephemeral micro-containers. Once analysis completes, uploaded artifacts are immediately scrubbed from volatile storage.

Zero AI Model Ingestion: Proprietary scripts, internal code architectures, and scan deliverables are never ingested, logged, or utilized to fine-tune machine learning models.

4. Sovereign Storage & Infrastructure (Sydney Region)

KuroSec's core databases, authentication registry, and scan workers are deployed within the Google Cloud Sydney Region (australia-southeast1), adhering to Australian data residency standards and ISO 27001 physical security controls.

5. Submit an Actionable Data Request (DSAR Form)

To exercise your statutory rights under the Australian Privacy Act 1988 or EU GDPR, you may use our authenticated Account Settings export button or file a request below. Our Data Protection Officer will process your request within the statutory 30-day window.

6. Data Protection Officer & Corporate Contact

For inquiries regarding our privacy posture, sub-processors, or regulatory filings:

CAMMIO Industries Pty Ltd
Attention: Data Protection & Privacy Officer
Email: privacy@camm.io · Security: security@camm.io
Corporate Web: https://camm.io →