Privacy Policy

This Privacy Policy (the "Policy") describes how Almondo Labs ("Almondo Labs", "we", "us", or "our") collects, uses, discloses, and protects information in connection with our website at https://almondo-labs.ai (together with its subdomains, content, trademarks, and services, the "Site").

This Policy is part of, and should be read with, our Terms of Use. Use of the Site constitutes acknowledgment of this Policy.

Almondo Labs may modify the Site or this Policy from time to time. If we make material changes, we will post the revised Policy and an updated date on the Site. Such modifications become effective seven (7) days following posting, and your continued use of the Site after that means you accept them.

1. Applicability and scope

This Policy applies to any individual or entity that accesses or uses the Site. With respect to data collected in connection with the Site and with communications you send us through it, Almondo Labs acts as the data controller. Almondo Labs is based in Israel and can be reached at shkedo@almondo-labs.ai.

2. Eligibility (age restriction)

The Site is intended for individuals aged eighteen (18) years or older. We do not knowingly collect personal data from individuals under 18, and if we identify such data we will delete it. If you are under 18, please do not visit or use the Site.

3. Data we collect and process

There are three ways we receive anything about you.

Information you send us through the trial request form

The form asks for, and transmits to us, exactly the following:

• Name and email address, so we can reply to you
• Organization or protocol name
• Chain or language selections (EVM, Solana, Sui, Aptos, AppSec, other)
• Repository or codebase URL, if you choose to provide one; the field is optional
• Scope description, meaning whatever you write about what should be covered
• Timeline, if you choose to provide one; the field is optional
• How you heard about Almondo, if you answer the follow-up question after submitting

Anything else you include in the free-text fields is also processed, so please do not paste credentials, keys, or personal data about other people into them.

Technical information

• Server logs. Our hosting provider processes standard request data in order to serve the Site and protect it from abuse. This may include IP address, user agent, requested URL, timestamps, and error information. We do not maintain our own separate log of visitors.
• Country code. When a trial request is submitted, our host adds a two-letter country code derived from the connection, and it reaches us with the request. We do not receive your IP address alongside it. The same country code is also used, on every page load, to decide which analytics mode applies to you; see section 4.

Usage information collected by analytics

Subject to the regional limits in section 4, our analytics provider receives the pages you view, the approximate time you spend on them, clicks on links and buttons, your browser, operating system, screen size, approximate location derived from IP address, and the referring page. Outside the EEA, the UK, Switzerland, and Gibraltar it additionally receives a recording of the session, comprising mouse movement, scrolling, clicks, and the rendered content of the pages you view. Text you type is masked in the browser and is not transmitted.

4. Cookies, analytics, and tracking

The Site uses PostHog for product analytics, so that we can see which pages are read and where the Site is confusing. There is no advertising, no ad network, no cross-site tracking, and no data broker. The Site's Content Security Policy names PostHog explicitly and forbids every other external origin, so no other third-party script can run here, even inadvertently.

How much PostHog is permitted to collect depends on the country your connection comes from, because we do not ask for consent and therefore only collect what may lawfully be collected without it.

If you are in the EEA, the United Kingdom, Switzerland, or Gibraltar, analytics runs in a restricted mode. Nothing whatsoever is stored on your device: no cookies, no local storage, no session storage, and no persistent identifier. We record page views and clicks on links and buttons only. There is no session recording, no mouse-movement capture, no profile, and no way to link one visit to another. We rely on our legitimate interest in understanding aggregate use of the Site (Article 6(1)(f) GDPR). Because nothing is stored on or read from your device, no consent is required under Article 5(3) of the ePrivacy Directive, and the Site therefore shows no cookie banner.

If you are elsewhere, analytics additionally sets a first-party cookie and local storage entry to recognise a returning browser, and records a replay of your session, which includes mouse movement, clicks, scrolling, and the content of the pages you view. You can switch this off at any time - see below.

What is never recorded. Session recording masks the contents of every input, text area, and selection in your browser before anything is transmitted, and the entire trial request form is additionally marked so that no text within it is captured. Your name, email address, organization, repository URLs, and scope description are never sent to PostHog. Request and response bodies are not recorded.

Turning it off. The Site honours the Global Privacy Control signal and the Do Not Track browser setting. If your browser sends either, no analytics of any kind loads and nothing is collected. Both can be enabled in your browser or through an extension, and doing so requires no action from us.

5. Purposes of processing

We process data to:

1. Respond to your trial request and correspond with you about it;
2. Evaluate whether the scope you describe is one we can take on;
3. Carry out the security work you ask us to do, where we agree to do it;
4. Provide, operate, maintain, and secure the Site;
5. Prevent fraudulent, abusive, or malicious activity, including automated form spam.

We do not use your details for advertising, and we do not send marketing email to people who only submitted a trial request.

6. Confidential material in a trial request

Repository locations, commit references, scope descriptions, and any source code you share with us are treated as confidential and used only to evaluate and perform the work you asked about, as set out in the Terms of Use. A mutual NDA is available on request, and we recommend putting one in place before sharing anything sensitive.

Automated analysis by AI

Almondo is an AI system, and it is how the work gets done. Material you send us in connection with a trial request or an engagement, including your scope description, repository location, and the source code we review, is analysed by large language models. To make that possible it is transmitted to one or more third-party AI model providers, which act as our processors and are bound by their own terms and by our instructions. The current list of providers is available on request, and we will name them in any NDA or engagement agreement we sign with you.

What this means in practice:

• Your material is sent to those providers only to produce your findings and your report, and for no other purpose.
• Your code is not used to train any model. We use these providers under terms that prohibit training on material submitted to them, and we do not permit it.
• Model output is not the final word. Every potential finding goes through automated validation, and a human reviews the report before you receive it.
• AI systems make mistakes in both directions. A finding may be wrong, and an absence of findings is not proof that your code is safe. See the Terms of Use for what we do and do not warrant.
• If you would prefer your code not be processed by a particular provider, say so before an engagement begins and we will tell you whether that is workable.

7. Feedback and contributions

Collection of feedback. We collect information you voluntarily provide through error reports, suggestions, or ideas about the Site or about Almondo ("Feedback").

Use of feedback. As set out in our Terms of Use, Feedback is owned by Almondo Labs. We process any personal data contained in Feedback to improve the Site and the product, develop features, and resolve technical issues.

Nature of provision. By providing Feedback, you acknowledge that any personal data included in it will be processed in accordance with this Policy.

8. Sharing, disclosures, and transfers

We do not sell personal data, and we do not share it with advertisers or data brokers. We rely on the following subprocessors:

• Cloudflare, which hosts the Site and runs the function that receives the form submission.
• Telegram, which is how the contents of a submitted request are delivered to us as a message. There is no database and no third-party form service between you and us.
• Third-party AI model providers, which run the analysis described in section 6. They receive the scope description, repository location, and source code involved in a trial or engagement. They do not receive analytics data, and they are not involved in serving this website. The current list is available on request.
• PostHog, which provides the analytics described in section 4. It receives usage data about your visit, and does not receive anything you type into the trial request form. We use PostHog's European infrastructure, so this data is stored on servers in the European Union and is not transferred to the United States.

Beyond those, we may disclose data where required to comply with lawful process, to enforce our Terms of Use, or to protect our rights or the safety of others. These subprocessors operate internationally, so data may be transferred and stored outside your country. Such transfers are subject to appropriate safeguards, including contractual protections or standard contractual clauses where applicable.

9. Data security and retention

• Security. The Site is served over HTTPS with HSTS and a strict Content Security Policy, and we apply commercially reasonable technical and organizational measures, including encryption in transit and access controls, to protect your data. No system is completely secure, and we cannot guarantee absolute security.
• Retention. We keep trial requests and the correspondence that follows for as long as needed to answer you, carry out any resulting work, and meet legal or legitimate business obligations, after which they are deleted. Server logs are retained by our hosting provider under its own retention schedule.

10. Your rights

Subject to applicable law, you may have the right to access, correct, delete, export, or restrict the processing of your personal data, and to object to processing or withdraw consent where processing relies on it. To exercise any of these, contact us as described below and we will respond within the period required by applicable law. Because we hold very little, a deletion request usually amounts to removing your request message and the email thread that followed it.

11. Third-party links

The Site links to third-party sites, including LinkedIn and Medium. We are not responsible for the privacy practices or content of those services, and we encourage you to read their policies before providing them with any personal information. Following such a link takes you outside this Policy's scope.

12. Governing law

This Policy shall be governed by the laws of the State of Israel, and the competent courts of Tel Aviv-Jaffa shall have exclusive jurisdiction over any disputes.

13. Contact us

If you have any questions about this Policy, or you want to exercise any of the rights described in section 10, email shkedo@almondo-labs.ai and say what you need. You can also send it through the request form. Every message is read and answered individually.