Privacy Policy

Who we are

Biff Labs Ltd ("we", "us") is the data controller for personal data collected through this website. This website handles licence registration, activation and sales enquiries. The RaptorGRC product itself runs entirely inside your network and opens no connection to us. The only information we receive from a deployment is what you carry across by hand in an offline activation code, being the machine fingerprint the licence binds to, the edition and product version, and a one-time number that prevents replay. Earlier versions also included a usage summary of record and user counts. We no longer collect that, we discard it if an older deployment still sends one, and we have deleted what we previously held. See Data & Transparency for the detail.

Data we collect

• Registration & contact details. Your name, work email, organisation name, country, and any message you send us.
• Licence & activation records. Licence keys, edition, machine fingerprint, activation timestamps and product version.
• Sign-in security records. The time and country of your last sign-in, and the number and time of any failed sign-in attempts since it. We show these back to you when you sign in so you can spot an attempt that was not yours. We record the country only, never your IP address, and each value is overwritten at your next sign-in, so no sign-in history is built up.
• Account credentials. Passwords are stored only as salted hashes, never in plain text.
• Analytics. If you consent, Google Analytics collects usage data (see our Cookie Policy).

Lawful basis

• Contract. We need it to create your account and to issue and service your licence.
• Legitimate interests. We rely on this to respond to enquiries and to keep our records, always balanced against your rights.
• Consent. This covers optional analytics cookies, and you may withdraw it at any time.

What we do not do

• We do not sell or share your information with third parties for their marketing.
• We do not run advertising trackers.
• The on-premise product does not transmit any data back to us.

Retention

We keep licence and contact records for the duration of your relationship with us plus up to three years thereafter for legal and audit purposes, then delete or anonymise them. Sign-in security records are not retained as a history. Each is overwritten by your next sign-in, and all of them are removed with your account.

Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict or object to processing of your personal data, and to data portability. To exercise these rights, email privacy@bifflabs.co.uk. You also have the right to complain to the ICO (ico.org.uk).

Contact

Biff Labs Ltd
Privacy enquiries: privacy@bifflabs.co.uk