How Zeroday IQ Cyber Pte. Ltd. ("Zeroday IQ", "we", "our", "us") collects, uses, shares, and protects information in connection with our website, dashboard, scanners, AI agents, and related services.
This notice explains how Zeroday IQ handles information collected through our website at zerodayiq.com, our dashboard, our scanner pipeline, and any agents or integrations that connect to our service. It applies to website visitors, registered users, customers, and anyone who contacts us.
If your organisation has signed a Master Service Agreement, an Order Form, or a Data Processing Addendum with us, that document controls to the extent of any conflict with this notice.
Zeroday IQ Cyber Pte. Ltd. is a private company registered in Singapore, with its registered office at 9 Raffles Place, #29‑05, Republic Plaza, Singapore 048619.
We are the controller of personal information collected through our website, marketing operations, and dashboard for our own customers. When customers run scans on assets they control, we act as a processor in respect of personal data that may be incidentally captured during those scans.
We collect only what we need to deliver the service and run our business. The categories below are exhaustive.
When you run a scan you provide one or more targets and, optionally, credentials or tokens that allow us to test authenticated surfaces:
We treat scan inputs as confidential customer data. They are encrypted at rest, scoped to the user account that created them, and only processed for the scans that account requests.
Findings and supporting evidence produced by the scanner pipeline and AI agents:
You own this data. We hold it on your behalf so you can re‑open it, query it from chat, and generate PDFs. You can export or delete any scan from the dashboard.
Standard server logs and product telemetry:
We retain technical data on a short cycle and never link it to advertising or third party identifiers.
We use the information described in section 3 for:
Where the EU GDPR or UK GDPR applies, we process personal information under one of the following legal bases:
Where the Singapore Personal Data Protection Act (PDPA) applies, we rely on the consent and legitimate interest bases provided under the Act, including the deemed consent and legitimate interest exceptions.
We do not sell, rent, or disclose personal information for advertising. We share information only with the categories of recipient listed below, all under written agreements that require equivalent or stronger safeguards than this notice.
| Subprocessor | Purpose | Region |
|---|---|---|
| Hosting and database | Application hosting, MongoDB‑backed scan storage, log retention | Asia (primary), with redundancy where applicable |
| OpenAI | AI inference for scan analysis, intent classification, and chat answers | United States |
| Anthropic | Alternative AI inference (selected per scan) | United States |
| Shodan | Internet asset enrichment during recon | United States |
| VirusTotal | File and URL reputation lookups during scans | United States |
| NVD (NIST) | CVE matching | United States |
| Email provider | Transactional and lead notification email | Asia / United States |
| Payment processor | Card processing for paid plans | United States |
Subprocessors process data only on documented instructions from Zeroday IQ. We will notify customers of material additions or replacements with at least 30 days' notice through the dashboard or email, where contractually required.
We may also disclose information when compelled by valid legal process. We will challenge over‑broad requests where lawful and notify you unless the law forbids us from doing so.
Zeroday IQ is registered and headquartered in Singapore. Some of the subprocessors named above operate in the United States, the European Union, and other jurisdictions. When personal data leaves your home jurisdiction, we rely on appropriate safeguards, including the European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum, and adequacy decisions where available.
We protect personal information using industry standard controls, including:
No system can be guaranteed against every adversary. If you discover a vulnerability in our platform, please report it through the Security disclosure address.
Depending on where you live you may have the right to:
To exercise any of these rights please contact us using the details in section 14. We respond within 30 days, or sooner where required by law. We may need to verify your identity before acting on a request.
The service is not intended for, and we do not knowingly collect personal information from, individuals under 16. If you believe a child has provided us with personal information, please contact us so we can delete it.
The marketing site at zerodayiq.com uses no third party analytics, no advertising pixels, and no cross site tracking cookies. The dashboard at /app uses a single first party authentication cookie to keep you signed in, and a localStorage entry for theme preferences. We do not embed third party fonts or trackers that profile your browsing across sites.
We will update this notice when our practices change. The "Effective" date at the top of this page reflects the latest revision. For material changes that affect how we use personal information we will notify you in advance through email or the dashboard.
For questions about this notice, requests to exercise your rights, or to nominate a data protection contact at your organisation, you can reach us through: