Privacy Policy

1. Information We Collect

1.1 Account & License Information

When you purchase or register for VisuaLeaf, we collect:

• Email address (for account creation and license delivery)
• Name (first and last name)
• Company domain (automatically extracted from your email address for analytics purposes)
• Payment information (processed securely by Stripe; we do not store credit card details)
• License key (generated for your purchase)
• Machine identifier (hashed hardware fingerprint for license activation limits)

1.2 Application Architecture & Local Data Storage

VisuaLeaf consists of two components:

1. Desktop Application (Frontend) - Electron-based user interface

2. Local Backend Service - Runs on localhost:8086 to handle database operations

The following data is stored exclusively on your computer and is never transmitted to our servers:

• MongoDB connection configurations (hosts, credentials, SSH tunnels, SSL certificates)
• Query history and saved queries
• Workspaces, layouts, and preferences
• Dashboard configurations
• Export job configurations
• Shell scripts and snippets
• User preferences (language, UI settings)
• Connection credentials (stored in local backend database)

We do NOT have access to this data. It is stored locally on your device:

• macOS: `~/Library/Application Support/VisuaLeaf/` (frontend) and local backend database
• Windows: `%APPDATA%\VisuaLeaf\` (frontend) and local backend database
• Linux: `~/.config/VisuaLeaf/` (frontend) and local backend database

1.3 License Validation Data

When VisuaLeaf validates your license, we collect:

• License key
• Machine identifier (for activation limit enforcement - max 2 devices per license)
• Activation/deactivation timestamps
• License status requests
• Machine name (user-friendly device name)

1.4 Optional Third-Party Service Data

Only if YOU enable these features:

AI Query Generation (Optional)

• VisuaLeaf can integrate with AI services for query generation
• AI requests are sent through the local backend service to our AI API
• Data sent includes:
• MongoDB schema information
• Sample data (only if you enable "use sample data")
• Your queries for AI assistance
• Collection relationship information

The AI service processes requests on our infrastructure. You do not need to provide your own API key.

Email Notifications (Optional)

• If you configure SendGrid integration using your own API key, VisuaLeaf will send:
• Email addresses you specify
• Export job completion notifications

We do NOT provide the API key. You must use your own SendGrid account for this optional feature.

Feedback Submissions (Optional)

• If you submit feedback via the app, we collect:
• App version and platform (Windows/macOS/Linux)
• Your description of the issue/suggestion
• Your email address (optional, only if you provide it)
• Environment information (OS, browser version)

Feedback is sent to our GitHub repository via the GitHub API and may be publicly visible.

1.5 Analytics & Tracking

We collect the following analytics data through our license management portal:

User Behavior Analytics

• Event tracking: Login, logout, registration, password reset, page visits, license requests, license purchases, license activations/deactivations, checkout initiated, payment completed/failed, admin actions
• Session tracking: Session IDs to track user sessions across pages
• Navigation tracking: Page paths, referrer URLs, query parameters
• Event metadata: Custom metadata associated with specific events

Technical Information

• IP addresses (collected and stored for analytics, geolocation, and security purposes)
• Geographic location: Country, country code, city, region, latitude, and longitude (derived from IP address via IP-API.com)
• Browser fingerprinting: Browser name and version, operating system, device type (Desktop, Mobile, Tablet)
• User agent strings (full user agent for parsing)

Company Analytics

• Company domain: Automatically extracted from your email address (e.g., "company.com" from "user@company.com")
• Email type detection: Whether you're using a generic email provider (Gmail, Yahoo, Outlook, etc.) or a company domain

Download Analytics

When you download VisuaLeaf, we collect:

• Platform downloaded (Windows, macOS Intel, macOS ARM, Linux)
• App version
• Geographic location (country, city, region, coordinates via IP address)
• Browser and device information
• Download source (download page vs releases page)
• Session ID and referrer URL
• Time spent on download page

Important Notes:

• We use IP-API.com as a third-party service to convert IP addresses to geographic locations
• Analytics data is stored indefinitely in our database for business intelligence and product improvement
• We do NOT use third-party analytics services like Google Analytics, Mixpanel, or similar platforms
• We do NOT use cookie-based cross-site tracking
• We do NOT sell or share analytics data with advertisers

1.6 Affiliate & Referral Tracking

If you use a referral code when purchasing:

• Referral code used (stored with your transaction)
• Affiliate attribution (which affiliate referred you)
• Discount applied (from referral code)

Your referral code is cleared from your user profile after your first purchase. We maintain records of referral transactions for affiliate commission tracking and payout purposes.

2. How We Use Your Information

2.1 License Management

• Deliver license keys via email
• Validate license activation and enforce device limits (maximum 2 devices)
• Send license expiration warnings and renewal notices
• Process refunds and license changes
• Track license sharing and invitations

2.2 Customer Support

• Respond to support requests
• Investigate and resolve technical issues
• Send important product updates and security notifications

2.3 Payment Processing

• Process payments via Stripe (our payment processor)
• Generate invoices and receipts
• Handle billing inquiries and disputes
• Track affiliate commissions and referral discounts

2.4 Product Improvement

• Analyze aggregate usage patterns (e.g., most popular features)
• Identify and fix bugs
• Develop new features based on feedback
• Understand geographic distribution of users
• Analyze company adoption and industry trends

2.5 Analytics & Business Intelligence

• Track user engagement and retention
• Monitor download statistics and platform preferences
• Analyze referral program effectiveness
• Generate reports on license activations and renewals
• Identify top companies and referral sources

3. Data Sharing & Third Parties

3.1 Service Providers

We share your information with trusted third-party service providers:

Data Processing Agreements (DPAs): We have DPAs in place with Stripe and SendGrid to ensure GDPR compliance.

3.2 Legal Requirements

We may disclose your information if required by law, such as:

• Responding to subpoenas or court orders
• Investigating fraud or security incidents
• Protecting our legal rights
• Complying with tax and accounting regulations

3.3 Business Transfers

If SozoCode Inc. is acquired or merged with another company, your information may be transferred to the new owner. We will notify you before this occurs.

3.4 Affiliate Partners

We share limited information with our affiliate partners:

• Transaction amounts (for commission calculation)
• Referral code usage
• Purchase dates

We do NOT share your personal information (name, email, address) directly with affiliates.

3.5 NO Data Sales

We will NEVER sell your personal information to third parties.

4. Data Security

4.1 Security Measures

We implement industry-standard security practices:

• Password hashing: BCrypt encryption (strength 12) for account passwords
• TLS/HTTPS: All data transmitted to our servers is encrypted
• Secure authentication: JWT tokens with RSA-256 signing (1-hour expiration)
• Database encryption: Production databases encrypted at rest
• Access controls: Role-based access to internal systems (USER, ADMIN roles)
• Regular updates: Security patches applied promptly
• License key encryption: RSA-2048 encryption for license keys

4.2 Local Data Security (Desktop App)

Your local VisuaLeaf data is as secure as your computer:

• Optional encryption: You can enable AES-256 encryption for the local database
• File system permissions: Data stored in standard OS-protected directories
• No cloud sync: Your MongoDB credentials never leave your device
• Backend security: Local backend service stores data in encrypted MongoDB database

Important: MongoDB connection passwords are stored locally on your computer in the backend database. If you enable database encryption in VisuaLeaf settings, this data is encrypted. Otherwise, it is stored in plaintext in the local database.

4.3 Data Breach Notification

If we experience a data breach affecting your personal information, we will:

• Notify you via email within 72 hours (GDPR requirement)
• Inform relevant authorities as required by law
• Provide details about the breach and steps we're taking

5. Your Rights (GDPR & CCPA)

You have the following rights regarding your personal information:

5.1 Right to Access

Request a copy of all personal data we hold about you.

How to exercise: Email admin@sozocode.com with subject "Data Access Request"

5.2 Right to Deletion ("Right to be Forgotten")

Request deletion of your account and associated personal data.

How to exercise:

• Email admin@sozocode.com with subject "Account Deletion Request"
• Or use the "Delete Account" button in your account settings

What happens: We will delete or anonymize your personal information within 30 days. Note:

• We may retain your email address in hashed form for 12 months to prevent trial abuse
• We must retain transaction records for 7 years for tax/accounting purposes (anonymized)
• Analytics data containing your information will be anonymized
• Local data on your computer must be deleted manually (see Section 6.2)

5.3 Right to Rectification

Correct inaccurate or incomplete personal information.

How to exercise: Update your profile in account settings or email admin@sozocode.com

5.4 Right to Data Portability

Receive your personal data in a machine-readable format (JSON).

How to exercise: Email admin@sozocode.com with subject "Data Export Request"

5.5 Right to Object

Object to certain types of data processing (e.g., marketing emails, analytics).

How to exercise: Click "Unsubscribe" in emails or email admin@sozocode.com

5.6 Right to Restrict Processing

Request temporary restriction of data processing.

How to exercise: Email admin@sozocode.com

5.7 Right to Withdraw Consent

Withdraw previously given consent for data processing.

How to exercise: Email admin@sozocode.com or disable features in app settings

Response Time: We will respond to all requests within 30 days.

6. Data Retention

6.1 License & Account Data

6.2 Analytics Data

Current Retention Policy:

• Analytics events (user behavior, login, registrations): Stored indefinitely for business intelligence
• Download analytics: Stored indefinitely
• Audit logs: Stored indefinitely (permanent audit trail for compliance)
• IP addresses: Stored indefinitely as part of analytics events (not anonymized)
• Login attempts: 5 minutes (automatically deleted)

Note: We are working to implement automated data retention policies that will anonymize analytics data after 12-24 months. This policy will be updated when implemented.

6.3 Local Application Data

YOU control retention of local data. To delete all local data:

macOS:

```bash

rm -rf ~/Library/Application\ Support/VisuaLeaf

```

Windows:

```

Delete folder: %APPDATA%\VisuaLeaf

```

Linux:

```bash

rm -rf ~/.config/VisuaLeaf

```

7. Cookies & Tracking

7.1 Essential Cookies

Our website uses minimal cookies for:

• Session management: Keep you logged in (session cookies)
• License validation: Verify your license status
• Security: CSRF protection

These cookies are necessary for the service to function and cannot be disabled.

7.2 Analytics Tracking

We use server-side analytics tracking to understand website usage:

• Page views and navigation patterns
• Download statistics
• Feature usage (aggregate only)
• Session tracking

You can limit tracking by:

• Using browser "Do Not Track" settings (we respect DNT headers)
• Installing browser extensions like uBlock Origin
• Disabling JavaScript for visualeaf.com (may break functionality)

7.3 Third-Party Cookies

• Stripe: Payment processing (session cookies)
• SendGrid: Email delivery tracking (pixel in transactional emails)
• OAuth Providers: Authentication session cookies

We do NOT use:

• Advertising cookies
• Social media tracking pixels
• Cross-site tracking cookies
• Third-party analytics services (Google Analytics, Mixpanel, etc.)

8. Children's Privacy

VisuaLeaf is not intended for children under 13 years old (or 16 in the EU). We do not knowingly collect personal information from children. If we discover we have collected data from a child, we will delete it immediately.

Universities/Student licenses are intended for individuals 18+ or educational institutions purchasing on behalf of students.

9. International Data Transfers

Data Location: Your personal data may be transferred to and stored in:

• United States (SozoCode Inc. headquarters - California)
• Cloud infrastructure (MongoDB Atlas, AWS, Google Cloud for database hosting)

GDPR Compliance: For EU/EEA users, we ensure adequate protection through:

• Standard Contractual Clauses (SCCs) with cloud providers
• GDPR-compliant Data Processing Agreements with Stripe and SendGrid

Your MongoDB Data: Stays on YOUR MongoDB servers. We do not host, transfer, or store your actual database content.

10. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements.

How we notify you:

• Updated "Last Updated" date at the top
• Email notification for material changes
• In-app notification on next login

Your consent: Continued use of VisuaLeaf after changes constitutes acceptance of the updated policy.

11. Contact Us

Questions about this Privacy Policy or your data?

SozoCode Inc.

Email: admin@sozocode.com

Website: https://visualeaf.com

Data Protection Officer: admin@sozocode.com

Response Time: We aim to respond within 48 hours.

12. Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases:

13. Your California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act:

13.1 Right to Know

You have the right to know what personal information we collect, use, and share.

This Privacy Policy serves as your CCPA disclosure.

13.2 Categories of Personal Information Collected

We collect the following categories of personal information:

• Identifiers: Name, email address, company domain, IP address, device identifiers
• Commercial information: Purchase history, payment records, license information
• Internet activity: Browsing history, page views, downloads, interactions with website
• Geolocation data: Country, city, region, coordinates (derived from IP address)
• Professional information: Company domain (inferred from email)

13.3 Right to Delete

You can request deletion of your personal information (subject to legal exceptions).

How to exercise: Email admin@sozocode.com

13.4 Right to Opt-Out of Sale

We do NOT sell your personal information. This right does not apply.

13.5 Right to Non-Discrimination

We will not discriminate against you for exercising your CCPA rights.

13.6 Authorized Agent

You may designate an authorized agent to make CCPA requests on your behalf by providing written authorization to admin@sozocode.com.

14. Nevada Privacy Rights

Nevada residents: We do not sell covered personal information (as defined by Nevada law). If we change this practice, we will update this policy and provide opt-out options.

15. Automated Decision-Making

We do NOT use automated decision-making or profiling that significantly affects you.

License validation is automated but based on straightforward rules (e.g., device limit reached, license expired). You can always contact support to review decisions.

By using VisuaLeaf, you acknowledge that you have read and understood this Privacy Policy.