Privacy Notice
Version 1.0. Effective 2026-10-16. Previous versions are kept and available.
BETA BLOCKS PTE. LTD. (trading as openbinary), UEN 202513462K, of 68 Circular Road #02-01, Singapore 049422, runs openbinary. This notice explains what personal data we process for ourselves, why, for how long, and what you can do about it. It applies to everyone whose data we process — customers, their users, visitors, and people who appear in our work without ever having dealt with us.
Who is responsible, and what this notice covers
We are the controller of the data described here: your account and billing relationship, your use of our website and Service, our security and abuse records, and the public corpus.
This notice does not cover your workspace content. The files you submit and their analysis are processed on your instructions, as your processor, and are covered by our Data Processing Addendum. If you are a member of someone else's workspace, that organisation is the controller of your work there, and you should ask them about it.
What we process, and why
| Purpose | Data | Basis | Retention |
|---|---|---|---|
| Creating and running your account; workspaces, membership, roles; sign-in | Email address, name, workspace membership, sign-in events, API keys | Contract | While the account is open, then 30 days |
| Providing the Service: upload, analysis, results, exports | Workspace content, on your instructions | Contract, as a processor | Per the DPA and Terms, not this notice |
| Billing, invoices, tax, refunds | Name, email address, billing address, tax identifiers, plan, transaction records | Contract; legal obligation | 5 years, or 10 where tax law requires |
| Support and correspondence | Your messages, contact details, request history | Contract; legitimate interests in helping you | 3 years after the request closes |
| Product analytics: what is used, what breaks, what is slow | Page and event data, session identifiers, IP address, user agent, referrer | Legitimate interests in operating and improving the Service | 12 months |
| Server and security logs, abuse and fraud prevention, incident response | IP address, request metadata, timestamps, account identifiers, tokens | Legitimate interests in security; legal obligation | 90 days; 12 months where part of an incident |
| Marketing email to business contacts, and our newsletter | Name, email address, organisation, engagement | Consent, or legitimate interests for existing customers | Until you unsubscribe, then 2 years |
| Licences and updates for self-hosted software: activation, version and support checks | Licence key, product version, host and user counts, feature events | Contract; legitimate interests in supporting what we sold | 2 years after the licence ends |
| Building and publishing the corpus, including analysis of software we obtain from public sources | See "Personal data in the public corpus" below | Legitimate interests in security research and software transparency; the permissions of those who publish | Corpus records are kept indefinitely; see below |
| Deciding who we can serve: sanctions, export control, eligibility | Name, organisation, country, screening results | Legal obligation; legitimate interests | 5 years after the relationship ends |
We do not sell personal data. We do not run advertising or third-party marketing trackers on the Service, and we do not use your data for interest-based advertising. We do not make decisions about you with legal effect by automated means alone.
What we do and do not do with your workspace content. We never show your files or their analysis to another customer, and we never publish them — unless you direct us to, by making a file public, by sending a share link, or by using a plan whose uploads are public by design. We do use them to improve our analysis — the fingerprint, similarity and function libraries, the statistics, and the models we train to analyse files — which is what makes the analysis better over time. That use never discloses your content to anyone, and produces nothing that can be resolved back to your files.
If you send a share link, the person you send it to is a recipient of your data for our purposes. We do not know who they are, we do not meter what they read, and we cannot tell you afterwards who opened it.
Anonymised data is not personal data. We may anonymise personal data so that it can no longer be associated with you, and use the result indefinitely for research, statistics and improvement without further notice to you. We do not attempt to re-identify anonymised data, and we maintain measures that prevent it.
Crime in samples is not crime about you. We do not knowingly collect special-category personal data, or data about criminal convictions and offences, about you as a user. Samples and analyses may describe offences and offenders — that is threat intelligence, and it is covered above, not attributed to you.
Personal data in the public corpus
A corpus of software contains personal data, and we would rather say so than pretend otherwise. It reaches us two ways: we analyse software we obtain from public sources, and users publish files they have analysed.
What can appear. Threat intelligence about malicious activity — indicators, hostnames, URLs, and material a sample carries about the people and systems it was built to attack. Developer and publisher identifiers — names, usernames, email addresses, build paths, machine names, certificate details. Credentials, keys and tokens extracted from a file, which can identify a person or unlock an account and are treated as high-risk personal data where they do. And data belonging to third parties that the analysed software embeds or references.
Why we may publish it. Our legitimate interests in operating a security research and analysis service and in the public interest in software transparency and threat identification, together with the rights and permissions of those who publish files. We have documented that assessment and a data protection impact assessment for the corpus and for secrets extraction. We will give the substance of both to a supervisory authority or to you on request, so far as we can without exposing security measures.
How we limit it. We aggregate or anonymise where the useful result does not need the identifying detail. We redact personal data that analysis surfaces incidentally where redaction does not destroy the value of the finding, and where it does, we describe the finding without reproducing the data. We do not knowingly publish special-category data, and we remove it when we learn of it. We do not publish the analysed file itself. We do publish credentials, keys and tokens extracted from a public file: they are part of the analysis, they are findings, and a credential inside a shipped binary is usually why the analysis was wanted. Where the file is private, they are visible only to the workspace holding it.
What we never do. We use corpus data to build and improve the analysis engine — the libraries, indices, statistics and models described above, and the data feeds we licence. We do not use it to profile individuals, to build identity or reputation products, to send marketing, or to train models whose purpose is to identify people.
If you are in the corpus, you can ask to see what we hold, have it corrected, have it removed or redacted, or object to the processing — write to legal@openbinary.ai. We answer within the times in "Your rights" below, and we will remove personal data from public display where your interest outweighs the interest in publishing it. Two limits are deliberate and worth knowing before you ask:
- A file's existence and its factual properties stay. If you ask us to remove a record because you published it and changed your mind, or because it describes your product, we will stop displaying the analysis and will not republish it, but we will not assert the file was never analysed, and we will not withdraw findings already relied on in our own security work.
- We cannot recall what has been read. Analysis that was public may have been exported, cached or indexed. Removal stops future access; it cannot undo past access.
If you would rather not be connected to a record, ask for de-attribution — removing the attribution while leaving the analysis in place. For a file published from a workspace, that is usually the proportionate answer, and we will offer it.
Copyright complaints are a different route: legal@openbinary.ai, and the process is in our removal policy.
Retention. Corpus records are kept indefinitely, because a corpus that forgets is not useful for the question people bring to it — whether something has been seen before. We remove a record when it is unlawful, when a valid notice or order requires it, when we conclude it violates a person's rights, or when keeping it serves no legitimate purpose. We do not remove one because the software is old or because a publisher has left. Private files are separate: they are yours, they are not part of the corpus, and they are deleted as described below.
Analytics
Product analytics, logs and metrics are collected by Tell, our own analytics software, on our own infrastructure in the same EU region as the Service. It is not a third-party service and there is no separate company receiving your data. We record page views, events, request logs and errors, and use them to see what is used, what breaks and what is slow.
Telemetry between our own systems and our servers stays inside our network and is restricted by firewall to our own addresses. We do not describe our internal network topology in this notice, and we will not, because it is not information that helps you and it is information that helps someone attacking us.
Who receives your data
Our processors. Hosting, authentication, payments and model-generated features are provided by the companies listed in Annex III of our Data Processing Addendum, with their roles and locations. That list is the operative one and we give 30 days' notice of changes to customers who subscribe to those notices.
Public. Anything in the corpus, as described above. Anything you publish is public.
Authorities. Where the law requires it, where we must to protect rights or safety, or to defend a claim. We tell you unless we are prohibited.
A successor. If we merge, are acquired, or sell assets, data may transfer to the acquirer on the same terms, and we will tell you first.
Transfers outside your country
Our production infrastructure is in Germany. We are a Singapore company, and our staff and contractors may access systems from Singapore and elsewhere; our processors are in the countries listed in Annex III, which includes the United States.
Where personal data moves out of the EEA we rely on an adequacy decision or the European Commission's Standard Contractual Clauses, with a transfer impact assessment. Out of the UK, the UK Addendum applies. Out of Singapore, we comply with the PDPA transfer limitation obligation. We will send you the mechanism on request.
Our data protection officer can be reached at legal@openbinary.ai, and if you are in the EEA or the UK you can also raise anything with the supervisory authority where you live or work.
Cookies and storage in your browser
We use what the Service needs to work — session and authentication state, and your preferences — and first-party analytics that let us see product usage. We do not use advertising cookies, and we do not set third-party tracking cookies on the marketing site.
Where the law requires consent for anything beyond what is strictly necessary, we ask for it before setting it, and you can refuse or later withdraw it. Refusing does not break sign-in or uploads.
Retention, and what deletion means
Retention is set out in the table above. When we delete, we delete from live systems, and the substance of the retention schedule has been followed. Copies remain for a limited period in encrypted backups before those backups are overwritten: up to 90 days. We will not restore data from backup to answer a request for data we have deleted.
The file store is permanent; what we remove is the link. Analysis is keyed to a file's hash, so identical files share a single record and a single analysis, and we keep that store rather than deleting it. That is not an oversight: a corpus that cannot compare a file with what it has seen before is not useful, and re-analysing identical bytes wastes work. What you can end is the connection:
- Delete an item in your workspace. We remove it and the private records that point at it, so the Service stops surfacing it. We delete the file and its analysis on request, unless the same bytes are held by another workspace or are in the corpus; we will tell you which applies.
- Delete your account or workspace. We remove the workspace, its memberships and the records that reference its files, and we delete your personal data within 30 days, except where the table above sets a longer period. Files whose bytes nothing else depends on are deleted on request.
- A record you published. The corpus record stays; we offer de-attribution.
We do not keep a durable link between a deleted workspace and the files it held, so we may not be able to tell you which hashes were yours after the fact. If you want a deletion on record, ask before the workspace goes.
Your rights
Depending on where you are, you can: see what we hold about you; have it corrected; have it deleted; restrict or object to how we use it; receive a copy in a portable form; and withdraw consent where consent was the basis. We do not discriminate against you for asking.
Write to legal@openbinary.ai. We answer within one month under the GDPR or 30 days under the PDPA, and if we need longer we will tell you why. We may ask you to confirm who you are before we act. Where a request concerns content in someone else's workspace, we will direct you to the organisation that controls it.
We have appointed a data protection officer, who can be reached at legal@openbinary.ai.
If you are unhappy with our answer you can complain to a supervisory authority: the Personal Data Protection Commission in Singapore, the authority where you live or work in the EEA, or the Information Commissioner's Office in the UK.
Security
We protect data with encryption in transit and at rest, access restricted to those who need it, tenancy separation between workspaces, and logging of operator access. A credential extracted from a private file is visible only to the workspace holding that file; a credential extracted from a public file is part of the public analysis, and we remove a live credential on request from its owner or the affected service. No system is perfectly secure, and we will tell you if a breach affects you. If you find something in the corpus that should not be public, tell security@openbinary.ai and we will treat it as a security report.
Children
The Service is for professional use and is not directed at children. We do not knowingly process personal data of anyone under 16. If you believe we hold data about a child, contact us and we will delete it.
Changes
We will post a new version with a new date, keep the previous versions available, and give at least 30 days' notice of any change that materially affects you.
Contact
legal@openbinary.ai for anything in this notice, including requests about the corpus and copyright complaints. security@openbinary.ai to report a vulnerability or a leak. 68 Circular Road #02-01, Singapore 049422 if you prefer paper.