1. Introduction and Acceptance

This Privacy Policy ("Policy") is a legally binding agreement between you ("User," "you," or "your") and Triglavis LLC, a limited liability company organized under the laws of California ("Triglavis," "Company," "we," "us," or "our"), regarding your use of the WorkspaceOS software application and related services (collectively, the "Service").

BY ACCESSING, DOWNLOADING, INSTALLING, OR USING THE SERVICE, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO BE BOUND BY THIS PRIVACY POLICY. IF YOU DO NOT AGREE TO THIS POLICY, YOU MUST NOT ACCESS OR USE THE SERVICE.

This Policy applies to all users of the Service, including without limitation users who are visitors, registered users, premium subscribers, and contributors of content. This Policy applies to all platforms on which the Service operates, including desktop applications, web interfaces, and mobile applications.

2. Definitions

For purposes of this Policy, the following definitions shall apply:

• "Personal Information" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household.
• "Processing" means any operation or set of operations performed on Personal Information, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, deletion, or destruction.
• "Data Controller" means the entity that determines the purposes and means of Processing Personal Information.
• "Data Processor" means an entity that Processes Personal Information on behalf of a Data Controller.
• "Sensitive Personal Information" means Personal Information that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sex life or sexual orientation.

3. Information Collection Practices

3.1 Categories of Personal Information Collected

We collect the following categories of Personal Information, as defined by applicable privacy laws including the California Consumer Privacy Act (CCPA) and the General Data Protection Regulation (GDPR):

3.2 Screen Capture and Visual Data

The Service collects and processes visual information from your device screen, which may include:

• Screenshots of all active applications, windows, and desktop environments
• Text content extracted through optical character recognition (OCR) technology
• Visual patterns, UI elements, and interface components across all applications
• Application states, transitions, and user interface changes
• Potentially sensitive information visible on screen including but not limited to passwords, financial information, personal communications, and confidential business data

IMPORTANT NOTICE: Screen capture may inadvertently collect Sensitive Personal Information, protected health information (PHI), personally identifiable information (PII), and other confidential data. Users are responsible for ensuring compliance with applicable laws when such information may be captured.

3.3 Behavioral and Usage Data

We collect detailed information about your interaction patterns and work behaviors, including:

• Complete records of all application usage, including timing, duration, and frequency
• Detailed workflow patterns, task sequences, and repetitive behaviors
• Application switching patterns and multitasking behaviors
• Keyboard shortcuts, mouse movements, and interaction patterns
• Command execution history, including shell commands and their outputs
• File access patterns, including creation, modification, and deletion activities

3.4 System and Technical Information

We automatically collect technical information about your device and system, including:

• Device identifiers, including hardware IDs, serial numbers, and MAC addresses
• Operating system type, version, configuration, and system settings
• Hardware specifications, including CPU, memory, storage, and peripheral devices
• Network information, including IP addresses, network names, and connection metadata
• Software inventory, including installed applications and their versions
• System performance metrics, resource utilization, and optimization statistics
• Error logs, crash reports, debugging information, and diagnostic data

3.5 Location Information

While we do not directly collect GPS data, we may infer location information from:

• IP addresses and network information
• Time zone settings and system locale
• Wi-Fi access points and Bluetooth beacons

4. Use of Information

4.1 Primary Purposes

We Process your Personal Information for the following purposes:

• Service Provision: To provide, maintain, and improve the Service's core functionality
• Pattern Recognition: To identify, analyze, and learn from your work patterns and behaviors
• Automation Services: To execute automated tasks and provide predictive assistance
• Performance Optimization: To optimize system performance and resource utilization
• Security and Fraud Prevention: To detect, prevent, and respond to fraud, security threats, and prohibited or illegal activities
• Legal Compliance: To comply with applicable laws, regulations, legal processes, and governmental requests
• Contract Enforcement: To enforce our Terms of Service and other legal agreements

4.2 Secondary Purposes

Subject to applicable law and your consent where required, we may also use your information for:

• Research and development of new features and services
• Statistical analysis and trend identification
• Machine learning model training and improvement
• Quality assurance and testing
• Customer support and communication
• Marketing and promotional activities (with explicit consent)

4.3 Automated Decision-Making

The Service engages in automated decision-making processes that may produce legal or similarly significant effects. These processes include:

• Automated task execution based on learned patterns
• Predictive suggestions for workflow optimization
• Security threat detection and response
• Resource allocation and performance optimization

You have the right to request human review of automated decisions that significantly affect you.

5. Data Storage, Retention, and Security

5.1 Data Storage Locations

Your Personal Information is stored and processed in the following locations:

• Local Storage: Primary data storage occurs on your device using encrypted databases
• Cloud Infrastructure: Optional cloud services utilize servers located in the United States
• Backup Systems: Encrypted backups may be stored in geographically distributed data centers
• Content Delivery Networks: Static resources may be cached globally for performance

5.2 Data Retention Periods

We retain Personal Information for the periods necessary to fulfill the purposes outlined in this Policy, unless a longer retention period is required or permitted by law:

• Screen Captures: 30 days from capture date (configurable by user)
• Workflow Patterns: Duration of account plus 90 days
• System Logs: 90 days for operational logs, 2 years for security logs
• Usage Analytics: 3 years in aggregated form
• Legal Hold Data: As required by applicable legal obligations
• Backup Data: 180 days from creation

5.3 Security Measures

We implement appropriate technical and organizational measures to protect Personal Information, including:

• Encryption: AES-256 encryption for data at rest, TLS 1.3 for data in transit
• Access Controls: Role-based access control (RBAC) with principle of least privilege
• Authentication: Multi-factor authentication for administrative access
• Monitoring: Continuous security monitoring and intrusion detection systems
• Incident Response: Documented incident response procedures and breach notification protocols
• Physical Security: Secured data center facilities with 24/7 monitoring
• Employee Training: Regular security awareness training for all personnel
• Vendor Management: Security assessments of all third-party processors

5.4 Data Breach Notification

In the event of a data breach affecting your Personal Information, we will:

• Notify affected users within 72 hours of discovery, where feasible
• Provide details about the nature and scope of the breach
• Describe measures taken to address the breach
• Offer appropriate remediation, which may include credit monitoring services
• Notify relevant supervisory authorities as required by law

6. Data Sharing and Disclosure

6.1 No Sale of Personal Information

We do not sell, rent, or lease your Personal Information to third parties. We have not sold Personal Information in the preceding twelve (12) months.

6.2 Categories of Recipients

We may share your Personal Information with the following categories of recipients:

• Service Providers: Third parties who perform services on our behalf under strict confidentiality agreements
• Business Partners: Partners with whom you choose to interact through the Service
• Legal Authorities: Law enforcement, courts, or regulatory authorities when legally required
• Corporate Transactions: Potential buyers or investors in connection with mergers, acquisitions, or asset sales
• Professional Advisors: Lawyers, accountants, and other professional advisors bound by confidentiality
• Consent-Based Sharing: Other parties with your explicit consent

6.3 Legal Bases for Disclosure

We may disclose your Personal Information when:

• Required by law, subpoena, court order, or governmental request
• Necessary to protect the rights, property, or safety of Triglavis, our users, or others
• Necessary to detect, prevent, or address fraud, security, or technical issues
• Necessary to enforce our Terms of Service or other agreements
• You have provided explicit consent for the disclosure
• The information has been aggregated or de-identified so it cannot identify you

6.4 International Data Transfers

Your Personal Information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws different from those in your country. We ensure appropriate safeguards are in place for such transfers, including:

• Standard Contractual Clauses approved by relevant authorities
• Binding Corporate Rules where applicable
• Adequacy decisions by relevant data protection authorities
• Your explicit consent where required by law

7. Your Rights and Choices

7.1 Rights Under GDPR (European Users)

If you are located in the European Economic Area (EEA), you have the following rights:

• Right of Access: Obtain confirmation of whether we Process your Personal Information and access to such information
• Right to Rectification: Correct inaccurate or incomplete Personal Information
• Right to Erasure: Request deletion of your Personal Information under certain circumstances
• Right to Restrict Processing: Request restriction of Processing under certain circumstances
• Right to Data Portability: Receive your Personal Information in a structured, commonly used format
• Right to Object: Object to Processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Withdraw consent at any time where Processing is based on consent
• Right to Lodge a Complaint: File a complaint with your local supervisory authority

7.2 Rights Under CCPA (California Residents)

California residents have the following rights under the California Consumer Privacy Act:

• Right to Know: Request disclosure of Personal Information we collect, use, disclose, and sell
• Right to Delete: Request deletion of Personal Information we collected from you
• Right to Opt-Out: Opt-out of the sale of Personal Information (we do not sell Personal Information)
• Right to Non-Discrimination: Not receive discriminatory treatment for exercising privacy rights
• Right to Correct: Request correction of inaccurate Personal Information
• Right to Limit Use: Limit use and disclosure of Sensitive Personal Information

7.3 Exercising Your Rights

To exercise any of these rights, please contact us using the information in Section 13. We will respond to your request within the timeframe required by applicable law. We may need to verify your identity before processing your request.

8. Legal Basis for Processing

8.1 Lawful Bases Under GDPR

We Process your Personal Information under the following legal bases:

• Consent: Where you have given clear consent for Processing
• Contract: Where Processing is necessary for the performance of our contract with you
• Legal Obligation: Where Processing is necessary for compliance with legal obligations
• Vital Interests: Where Processing is necessary to protect vital interests
• Legitimate Interests: Where Processing is necessary for legitimate interests pursued by us or third parties

8.2 Legitimate Interests

When we rely on legitimate interests, these interests include:

• Providing and improving the Service
• Ensuring network and information security
• Preventing fraud and illegal activities
• Direct marketing (where permitted by law)
• Internal administrative purposes

You have the right to object to Processing based on legitimate interests.

9. Children's Privacy

The Service is not intended for individuals under the age of eighteen (18) years ("Minors"). We do not knowingly collect Personal Information from Minors. If you are a parent or guardian and believe your Minor child has provided us with Personal Information, please contact us immediately at privacy@triglavis.com.

If we become aware that we have collected Personal Information from a Minor without verification of parental consent, we will take steps to delete that information from our servers immediately.

We encourage parents and guardians to monitor their children's online activities and to help enforce this Policy by instructing their children never to provide Personal Information through the Service without their permission.

10. Third-Party Services and Links

The Service may contain links to third-party websites, services, or applications that are not owned or controlled by Triglavis. This Policy does not apply to any third-party services.

We are not responsible for the privacy practices or content of third-party services. We encourage you to review the privacy policies of any third-party services you access through the Service.

The Service may integrate with third-party services that you authorize. When you authorize such integrations, you grant us permission to access and use your information from these services as necessary to provide the Service to you.

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and store information when you use the Service. These technologies may include:

• Cookies: Small data files stored on your device
• Local Storage: Browser-based storage mechanisms
• Session Storage: Temporary storage during your session
• Device Fingerprinting: Collection of device characteristics for identification
• Analytics Tools: Third-party analytics services to understand usage patterns

You can control cookies through your browser settings. Disabling cookies may limit certain features of the Service.

12. Changes to This Privacy Policy

We reserve the right to modify this Policy at any time. If we make material changes, we will notify you by:

• Updating the "Last Updated" and "Effective Date" at the top of this Policy
• Providing prominent notice on our website or within the Service
• Sending you an email notification (if we have your email address)
• Requiring your affirmative consent for material changes affecting your rights

Your continued use of the Service after the effective date of any changes constitutes your acceptance of such changes. If you do not agree to the modified Policy, you must discontinue use of the Service.

We encourage you to review this Policy periodically to stay informed about our information practices.

13. Contact Information

For questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us through one of the following methods:

• Primary Email: support@triglavis.com
• Data Protection Officer: privacy@triglavis.com
• Website: https://tryworkspaceos.com
• Mailing Address:
  Triglavis LLC
  Attn: Privacy Officer
  P.O. Box 120224
  San Diego, CA 92112
  United States

Response Time: We will acknowledge receipt of your inquiry within 48 hours and provide a substantive response within 30 days, or as required by applicable law.

Security Incidents: To report security vulnerabilities, please contact security@triglavis.com using our responsible disclosure program.

14. Additional Provisions

14.1 Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, TRIGLAVIS SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS OR REVENUES, WHETHER INCURRED DIRECTLY OR INDIRECTLY, OR ANY LOSS OF DATA, USE, GOODWILL, OR OTHER INTANGIBLE LOSSES RESULTING FROM YOUR USE OF THE SERVICE.

14.2 Disclaimer of Warranties

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED. WE DISCLAIM ALL WARRANTIES, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

14.3 Indemnification

You agree to indemnify, defend, and hold harmless Triglavis, its officers, directors, employees, agents, and affiliates from any claims, liabilities, damages, losses, costs, or expenses arising from your use of the Service or violation of this Policy.

14.4 Governing Law and Jurisdiction

This Policy shall be governed by and construed in accordance with the laws of the State of California, United States, without regard to its conflict of law provisions. Any disputes arising under this Policy shall be subject to the exclusive jurisdiction of the state and federal courts located in San Diego County, California.

14.5 Severability

If any provision of this Policy is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.

14.6 Entire Agreement

This Policy, together with our Terms of Service, constitutes the entire agreement between you and Triglavis regarding the use of the Service and supersedes all prior agreements and understandings.

14.7 No Waiver

Our failure to enforce any right or provision of this Policy shall not be considered a waiver of those rights.

14.8 Assignment

We may assign or transfer our rights and obligations under this Policy to any party at any time without notice to you. You may not assign or transfer your rights under this Policy without our prior written consent.

15. Acknowledgment and Consent

BY USING THE SERVICE, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY AND AGREE TO BE BOUND BY ITS TERMS. YOU FURTHER ACKNOWLEDGE THAT THIS POLICY MAY BE UPDATED FROM TIME TO TIME AND THAT YOU ARE RESPONSIBLE FOR REVIEWING THE MOST CURRENT VERSION.

If you have any questions about this Privacy Policy, please contact us before using the Service.