Privacy Policy

Effective Date: September 29, 2026

This Privacy Policy describes how Zystem, Inc., doing business as Zymtrace (“Zymtrace,” “we,” “our,” or “us”) handles information in connection with Zymtrace, our self-hosted, on-premise GPU and CPU application optimization software.

This policy describes our information-handling practices. Your use of Zymtrace is governed by the applicable agreement with Zymtrace, including the Terms of Service where applicable. This policy does not override a separately agreed data processing agreement or negotiated contractual protections.

Scope

This Privacy Policy applies to:

• Users of Zymtrace software
• Product telemetry from Zymtrace components, including the profiler and user interface
• Our website visitors at zymtrace.com
• Technical documentation and support portals
• Diagnostic materials and information provided for support

Definitions

For the purposes of this Privacy Policy, the following terms have the specified meanings:

• “Customer Environment” refers to the on-premise infrastructure within which Zymtrace is deployed, including production, staging, and development environments.
• “Telemetry Data” means technical information about Zymtrace’s own operation, performance, reliability, and usage, including operational metrics, version and environment information, deployment or user identifiers, usage events, and diagnostic information. Application Data and confidential information do not lose their ownership or protections merely because they are included in telemetry or diagnostic materials.
• “Application Data” refers to your application’s code, configurations, performance data, and associated metadata.
• “User” refers to any individual who accesses or uses the Zymtrace software.
• “Services” refers to the software, support, and related offerings we provide in connection with Zymtrace.

Information Collection and Use

Zymtrace’s product telemetry has separate ingest and browser paths. The profiler sends profiling information and host metadata to the customer’s configured collection endpoint. The ingest service may then send operational telemetry to Zymtrace, while the browser may send diagnostic and usage information to Sentry.

Ingest Telemetry

When enabled, the ingest service sends operational metrics to Zymtrace’s telemetry collector, hosted on Google Cloud. These metrics include agent performance and health, profiling-event counts, CPU and GPU inventory, operating-system and driver versions, sampling settings, and metric labels. Records may also include hostnames, persistent machine identifiers, session identifiers, project identifiers, and process identifiers.

The collector derives a hashed identifier from the source IP address. Hosting and network services may also process source IP addresses and request metadata. These identifiers and operational records are not necessarily anonymous and may identify a customer, deployment, device, or individual.

Browser Telemetry

When enabled, the product’s browser interface uses Sentry for error reporting, performance monitoring, and sampled session replay. This may include errors and stack traces, page or route URLs, request metadata, browser and device information, IP addresses, and recordings of interface interactions. Diagnostic context may contain customer information; we do not represent that all diagnostics are anonymous or free of Application Data.

Browser telemetry also includes software versions, customer or license identifiers, company names, license attributes, authentication type, and infrastructure-capacity metrics associated with project identifiers. Session replay and performance sampling may differ for ordinary sessions and sessions in which an error occurs.

Purposes

We process product telemetry to maintain, troubleshoot, secure, and improve Zymtrace, including evaluating its performance, reliability, and feature usage. This processing does not transfer ownership of customer information to us.

Product Telemetry Controls

Product telemetry is enabled in the shipped default configuration. The two paths have independent controls:

• Ingest telemetry: administrators can disable outbound ingest telemetry by setting telemetry.enabled to false in the ingest-service configuration.
• Browser telemetry: administrators with a commercial license can disable browser telemetry by setting disable-all-telemetry to true in the web-service configuration. The web service does not honor that disablement setting for trial licenses.

Despite its name, the web-service setting does not disable ingest telemetry. Administrators must configure both paths separately where the license permits. These controls do not disable customer-configured external integrations, replace network-access controls, or remove separately agreed license-compliance and usage-reporting obligations.

Website Analytics

The public website separately uses Google Analytics and cookie-consent tooling delivered through jsDelivr. Website requests may expose IP addresses and request metadata to those providers. Analytics cookie storage is configured as denied by default and updated according to the visitor’s cookie choices. Website cookie choices do not control product telemetry.

Customer Application Data

Zymtrace’s application processing and storage take place in the Customer Environment. Self-hosting does not by itself mean there are no external connections: product telemetry may leave that environment as described in this policy, and customers may separately configure external integrations or authorize disclosures for support.

Customers retain their rights in Application Data and confidential information. Zymtrace does not acquire ownership of that information through telemetry or diagnostic collection, and this policy does not grant us general access to customer systems. Application Data or confidential information included in diagnostics remains subject to applicable contractual and data-protection obligations.

Support Data

Customers may separately provide diagnostic materials or authorize access to their environment for support. We use that information only to provide the requested support and meet applicable legal obligations, with access limited to personnel and service providers who need it for that purpose and are subject to confidentiality obligations.

Customers should redact credentials, secrets, and unnecessary personal or sensitive information before sharing support materials. Where the agreed support requires us to process personal data on a customer’s behalf, an appropriate data processing agreement must be in place before that processing begins.

Data Security

Customers are responsible for securing their own deployments, including access controls, credentials, backups, and Application Data. We protect telemetry and support information we receive using reasonable administrative, technical, and organizational safeguards, including encryption in transit and at rest and access restrictions appropriate to the information.

Access is limited to personnel and service providers who need the information for the purposes described in this policy and are subject to confidentiality obligations. No security measure eliminates all risk.

Data Retention

All data within your environment is retained according to your organization’s policies and requirements.

We retain product Telemetry Data only for the purposes described in this policy and for no longer than twelve (12) months, after which we delete it. Shorter periods may apply to particular telemetry categories or providers.

We retain support materials and website-related information only as long as needed for the relevant support, operational, or legal purpose, subject to applicable contractual and legal requirements. You may request information about retention or earlier deletion by contacting [email protected]. Disabling future telemetry collection does not itself delete information previously received.

Data Sharing and Business Terms

We may share Telemetry Data with service providers that help us collect, host, analyze, secure, and troubleshoot product telemetry or provide support. Their access must be limited to the relevant purpose and subject to confidentiality obligations.

These providers include Google Cloud for ingest-telemetry hosting and analysis, Sentry for browser diagnostics, performance monitoring, and session replay, and Google Analytics and jsDelivr for the website functions described above.

We do not sell, rent, or lease Telemetry Data to third parties.

We may disclose information:

• In response to lawful requests by public authorities
• To comply with a legal obligation
• To protect our rights or property
• In an emergency to protect public safety

International Data Transfers

Telemetry and related information may be transferred to, stored, and processed outside your country, including in the European Union and the United States. The ingest-telemetry infrastructure is configured for Google Cloud’s EU locations, while the product’s production browser-telemetry endpoint uses Sentry’s US region. This is not a guarantee that every provider, support activity, or related processing operation is confined to those locations. Applicable data-protection laws and agreed contractual transfer safeguards continue to apply.

Children’s Privacy

Zymtrace is designed for use by businesses and enterprises. We do not knowingly collect or solicit personal information from children under 13 years of age. If we become aware that we have collected such information, we will promptly delete it from our records.

Your Rights and Choices

Administrators can use the component- and license-specific product controls described above. Website visitors can manage analytics cookie choices separately. Depending on applicable law, individuals may also have rights to access, correct, delete, restrict, or object to processing of their personal information, and to withdraw consent where processing relies on consent.

You may request information about telemetry or deletion of historical information, or opt out of non-essential communications, by contacting [email protected]. We will handle requests in accordance with applicable law and may need to verify the requester’s identity or authority. Where we process information on a customer’s behalf, we may refer the request to that customer or assist it in responding.

Business Transfers

If Zymtrace is involved in a merger, acquisition, or sale of all or a portion of its assets:

• Data held solely in the Customer Environment is not transferred by Zymtrace as part of that transaction.
• Telemetry and support data we hold may be transferred subject to applicable confidentiality, contractual, and data-protection obligations.
• We will notify affected customers of material changes to the handling of their information.

Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify customers of material changes and post updates on our website.

Contact Information

Zystem, Inc. d/b/a Zymtrace 251 Little Falls Drive Wilmington, New Castle County, Delaware 19808. USA

Email: [email protected]

Governing Law

This Privacy Policy is governed by the laws of the State of Delaware, United States, without regard to its conflict of law provisions.