Privacy Policy

1. Introduction

FaultRay ("we", "our", or "us") is committed to protecting your personal data. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data when you use our infrastructure chaos engineering platform at https://faultray.com (the "Service").

2. Data We Collect

We collect the following categories of data:

3. Data Storage & Infrastructure

Your data is stored using the following third-party infrastructure providers:

• •Supabase — Database and authentication. Data is stored in the us-east-1 region (AWS). Supabase is SOC 2 Type II certified.
• •Vercel — Hosting and edge network. The primary deployment region is Tokyo (hnd1). Your requests may be processed at edge nodes globally, but persistent data is not stored on Vercel infrastructure.
• •Stripe — Payment processing. We do not store full credit card numbers. Stripe is PCI DSS Level 1 certified.

4. Third-Party Data Sharing

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

We may share data with third parties only in the following limited circumstances:

• •Service providers necessary to operate the Service (Supabase, Vercel, Stripe), bound by data processing agreements.
• •When required by law, court order, or government authority.
• •In connection with a merger or acquisition, with prior notice to you.

Your infrastructure configuration data (topology files, component graphs) is used exclusively to run simulations on your behalf and is never shared with or disclosed to other customers or third parties.

5. Cookies

We use the following types of cookies:

• •Essential cookies — Required for authentication sessions and basic Service functionality. Cannot be disabled.
• •Analytics cookies — Help us understand how the Service is used (e.g., Vercel Analytics). You may opt out via browser settings or by contacting us.
• •Preference cookies — Remember your language selection and UI preferences.

6. GDPR — Rights for EU/EEA Residents

If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):

• •Right of access — Request a copy of the personal data we hold about you.
• •Right to rectification — Request correction of inaccurate or incomplete personal data.
• •Right to erasure — Request deletion of your personal data ("right to be forgotten").
• •Right to restriction — Request that we restrict processing of your personal data.
• •Right to data portability — Receive your data in a structured, machine-readable format.
• •Right to object — Object to processing of your personal data for direct marketing purposes.
• •Right to withdraw consent — Withdraw any consent you have previously given, without affecting lawfulness of prior processing.

The legal basis for processing your data is: (a) performance of a contract (to provide the Service), (b) legitimate interests (security, fraud prevention), and (c) your consent (analytics cookies).

To exercise any of these rights, contact us at privacy@faultray.com. We will respond within 30 days.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. The table below defines retention periods by data category:

If you delete your account, we will delete or anonymize your personal data within 90 days, except where legally required to retain it (e.g., financial records for 7 years). You may request early deletion by emailing privacy@faultray.com.

8. Security

We implement industry-standard security measures including TLS encryption in transit, encryption at rest (AES-256), role-based access controls, and regular security audits. However, no system is completely secure. If you believe your account has been compromised, contact us immediately at privacy@faultray.com.

9. Children's Privacy

The Service is not directed to children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a prominent notice in the Service at least 30 days before the change takes effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

11. Contact Us

For privacy-related inquiries or to exercise your rights, contact: