Privacy Policy.

This Privacy Policy describes the personal data processed by Ground Plane Studio, LLC (“WarpKVM,” “we,” “us”) in connection with the WarpKVM website at warpkvm.com, the WarpKVM web and mobile apps, and the WarpKVM device firmware (the “Service”). It applies to information you give us directly and to information we collect automatically when you interact with the Service.

1. Personal data we collect

Information you give us

• Waitlist signup. Your email address. We may also note which page you submitted from and your browser's user-agent string so we can debug abuse and segment launch communications.
• Orders, pre-orders, and deposits. Checkout is run by Stripe, which collects your card details and billing information directly. From Stripe we receive your name, email address, what you ordered, the amount paid, and, for anything that ships, your shipping address. We store those to fulfill and support your order. We never see or store your card number or full billing address.
• Contact and quote forms. Your name, email address, the body of your message, and, for quote requests, your company name and the product you were viewing.
• Beta program application. Your full name, email address, city and US state, your answers about the machines you would test on, the devices and networks you would use, your experience, and how you would like to contribute, plus anything you write in the free-text fields and any links you choose to share. We also record your browser's user-agent string to help us spot abuse. We ask for your city and state so we can pick testers spread across the country. If you are selected, we will ask for a shipping address separately.

Information collected automatically

• Server logs. Our hosting provider records standard request metadata (IP address, request path, response code, timestamp, user agent). We retain these logs for 30 days to investigate abuse and operational issues.
• Usage analytics. We use Vercel Web Analytics to understand aggregate traffic: which pages are viewed, the site that referred you, and general device and country information. It is privacy-friendly and cookieless: it sets no cookies, stores nothing in your browser, builds no profile of you, and does not track you across other websites. Vercel derives an anonymous, non-reversible visitor count without storing your IP address. We use no advertising or cross-site tracking providers.

Cookies and similar technologies

We don't set advertising cookies or use third-party tracking pixels. Our usage analytics (Vercel Web Analytics) is cookieless and sets nothing in your browser, and the website itself stores nothing in your browser. Stripe may set cookies during the checkout flow; see Stripe's Privacy Policy for details.

What we don't collect

We don't see the contents of your remote sessions. WarpKVM hardware captures video and USB at the cable, encodes it on-device, and delivers it directly from the device to your browser through a tunnel keyed to your account. The video stream and keyboard / mouse input never traverse our servers.

We also don't set marketing or advertising cookies, don't sell your personal data, and don't enrich your email address with data brokers.

2. How we use personal data

• To send launch announcements and product updates to people who join the waitlist.
• To process orders, pre-orders, and reservation deposits, and to send order confirmations.
• To respond to messages and quote requests you send us.
• To review beta program applications, choose testers, contact applicants about their application, and run the program with the testers we select.
• To detect and prevent abuse of our forms and infrastructure.
• To fulfill orders, ship hardware, handle cancellations and refunds, and provide warranty service.
• To operate, maintain, and improve the Service.
• To comply with applicable law and respond to lawful requests.

3. Sharing and disclosure

Service providers

We share personal data with vendors who process it on our behalf and only on our instructions:

• Supabase, Inc. Managed Postgres database hosting waitlist entries, contact messages, beta program applications, and order records, in US West.
• Stripe, Inc. Payment processing for orders, pre-orders, and reservation deposits. Stripe collects and stores your payment information under their own privacy policy and PCI compliance program. We do not store card data.
• Resend, Inc. Sends our transactional email, such as form confirmations, and delivers form submissions to our inbox. See Resend's Privacy Policy.
• Vercel, Inc. Hosts the website, serves requests, and provides privacy-friendly, cookieless usage analytics (Vercel Web Analytics). See Vercel's Privacy Policy.

Business transfers

If WarpKVM is acquired or sells assets, your personal data may transfer to a successor. We'll notify you by email before any new entity becomes responsible for your data.

Legal disclosure

We may disclose personal data when required by law, to protect our rights, to investigate fraud, or to protect the safety of any person.

4. Data retention

• Waitlist entries are retained until twelve months after the public launch announcement, then deleted unless you remain an active customer.
• Order and deposit records, including shipping addresses, are retained for as long as tax, accounting, warranty, and consumer-protection obligations require.
• Contact and quote messages are retained for two years.
• Beta program applications are retained until twelve months after the beta program ends, then deleted. If you are selected, the records we need to ship hardware and meet tax obligations are kept for as long as the law requires.

You can request earlier deletion at any time; see §6.

5. Security

We use industry-standard technical and organizational safeguards, including encryption in transit, encryption at rest in our database, and scoped access controls. Payment data is handled entirely by Stripe under their PCI-DSS-certified infrastructure; we never touch raw card numbers.

Responsible disclosure. Security researchers acting in good faith should email security@warpkvm.com. We commit to acknowledging reports within 72 hours and not pursuing legal action against researchers who follow responsible-disclosure practices.

6. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate information.
• Export a copy of your data in a portable format.
• Delete your data.
• Object to or restrict certain processing.
• Opt out of any future sale or sharing of your data (we don't do either today).

Email privacy@warpkvm.com with your request and we'll respond within 30 days. We may need to verify your identity before acting.

California residents (CCPA / CPRA)

California residents have all rights listed above, plus the right to designate an authorized agent. We will not discriminate against you for exercising any of these rights. We do not sell or share personal information as defined under the CCPA.

7. International transfers

Personal data submitted from outside the United States is transferred to servers in US West for processing. Where required by law, we rely on Standard Contractual Clauses to cover the transfer.

8. EEA / UK residents (GDPR)

Controller

Ground Plane Studio, LLC. We do not currently have an establishment in the EEA or UK.

Lawful basis for processing

• Waitlist signup and product updates: your consent (Article 6(1)(a)). Withdraw at any time by unsubscribing or contacting us.
• Orders, pre-orders, and deposits: performance of a contract with you (Article 6(1)(b)).
• Beta program applications: steps taken at your request before entering into an agreement with you (Article 6(1)(b)).
• Responding to messages: performance of a request you have made (Article 6(1)(b)).
• Detecting abuse and complying with law: legitimate interests and legal obligation (Article 6(1)(f) and 6(1)(c)).

Your GDPR rights

In addition to §6, you have the right to:

• Withdraw consent at any time where processing is based on consent.
• Restrict or object to processing based on our legitimate interests.
• Lodge a complaint with your local supervisory authority. UK: ico.org.uk. EEA: see edpb.europa.eu.

Automated decision-making

We do not make decisions about you using solely automated processing that produces legal or similarly significant effects.

9. Children

WarpKVM is not directed to people under 16. If we learn we have collected personal data from a child without verifiable parental consent, we will delete it.

10. Do Not Track

Our Service does not respond to “Do Not Track” signals, because we do not perform cross-site tracking. If that changes, we'll update this section.

11. Updates to this policy

We'll update this page when our practices change and revise the “Last updated” date above. Material changes will also be announced via email to waitlist and account holders.

12. Contact

• Email: privacy@warpkvm.com
• Security: security@warpkvm.com
• Or use the contact form

California residents may contact the California Department of Consumer Affairs at 1625 N. Market Blvd., Suite S-202, Sacramento, CA 95834, or +1-800-952-5210.