Privacy Policy

1. Who we are and what this covers

This Privacy Policy explains how Breneshold LLC, a limited liability company organized under the laws of the State of Florida, United States, registered at the postal address stated in the customer's account and on every invoice ("Witnio", "we"), handles personal data.

It covers this website, the Witnio account and dashboard, the API, and the observation service. It applies to visitors to the website, to the people who administer a customer account, and to personal data contained in the Evidence a customer's checks generate.

Witnio serves businesses. We do not offer the service to consumers and we do not knowingly collect data from anyone under 18.

This policy is in force from the effective date shown at the top of this page.

2. Our two roles

Witnio acts in two different roles, and the rules differ between them.

Controller. For account data, billing data, support correspondence, waitlist and contact submissions, and website usage, Witnio decides why and how the data is processed. This policy governs that processing.

Processor. For personal data contained in the Evidence generated by a customer's checks, the customer decides why and how, and Witnio acts on the customer's documented instructions. The Data Processing Addendum governs that processing, and prevails over this policy for that data.

If you are an individual whose data appears inside a customer's Evidence, contact that customer first. We will forward your request to them and support them in answering it.

3. Data we collect as controller

Account data: company name; the name, business email, business telephone and role of the people who administer the account; users, roles, sessions and devices; and API key metadata.

Verification data: corporate email domain, declared use case, and the ownership or authorisation evidence you give us for a domain, a number or a sender.

Billing data: billing contact, billing address, tax identification number, plan, invoices, payment status, and the brand and last four digits of a card as returned by the payment provider. Witnio never receives or stores a full card number or a bank credential — payment details are entered on Stripe's or PayPal's own hosted pages.

Support and sales data: the messages you send us, the waitlist and contact forms you submit (email, company, product interest), and our replies.

Technical data: IP address, user agent, request metadata, timestamps, and the error and audit logs needed to operate, secure and debug the service.

Website data: this site sets two cookies and no third-party tracker. See the Cookies section.

4. Data we process as processor

Running a check produces Evidence. Depending on the product, an Evidence record may contain: the observed sender or calling identifier; the destination number under Witnio's control; the message body after masking, together with a hash of the original; timestamps and latency; device, operating system, dialer, SIM, carrier and corridor context; screenshots and, for some products, video of the device screen; HTTP, DNS and TLS results; the redirect chain; cookies and consent-banner state observed on the target; and the signed manifest that binds all of it together.

Some of that may be personal data — a telephone number, a caller name, or a person visible in a screenshot. The customer chooses the targets and the traffic, and is therefore the controller of that data.

Witnio's instruction to its customers is explicit: send test traffic, not the real communications of your end users, and do not submit personal data beyond what the check needs.

5. Masking and minimisation

Before anything is persisted, and before anything is sent to an AI provider through Witnio's AI router, Witnio masks or minimises: one-time passcodes; third-party telephone numbers; other sensitive content; tokens; cookies; and identifiers not needed for the result.

A one-time passcode is never stored in the clear. Every run of four or more digits in a message body is masked before that body is written to storage, and the stored body is truncated. Sender and destination identifiers are stored masked. A hash of the original content lets integrity be checked without keeping the content.

Masking is applied on the way in, not on the way out: the unmasked value is never written to a database, a log, a trace or an AI request.

6. Purposes and legal bases

Where the GDPR or an equivalent law applies, Witnio relies on these bases as controller:

• Performance of a contract, article 6(1)(b) — creating and administering your account, delivering the service you ordered, billing, and support.
• Legitimate interests, article 6(1)(f) — securing the platform; preventing, detecting and investigating abuse and fraud; verifying that a customer is entitled to monitor what it configures; keeping audit logs; improving the service with aggregated, de-identified data; and establishing or defending legal claims. We balance these against your rights, and you may object as described below.
• Legal obligation, article 6(1)(c) — tax and accounting duties, sanctions screening, and answering a lawful request from an authority.
• Consent, article 6(1)(a) — where we ask for it, for example to send you a message you asked to receive. You may withdraw consent at any time, without affecting processing already carried out.

As processor, Witnio processes Evidence data on the customer's instruction; the customer is responsible for having a legal basis for that processing.

7. Cookies and tracking

This site sets two cookies: a locale preference cookie that remembers the language you chose, and a prelaunch preview cookie that lets an invited visitor see the site before it is public. Both are strictly necessary or preference cookies.

Witnio does not use advertising cookies, analytics cookies, tracking pixels, session recording or fingerprinting on this site, and does not sell or share personal data for cross-context behavioural advertising. If you arrive through a link that carries campaign parameters (utm_*), those parameters, the landing page and the referring site are kept in your browser's session storage for that session only and are stored with a contact request or registration you submit, so that we can measure which campaigns work; this is not a cookie and is never shared with advertising platforms.

Because there is no non-essential cookie, this site shows no consent banner. If that ever changes, a banner will be added before the cookie is set, and this policy will be updated first.

8. Sharing and sub-processors

Witnio does not sell personal data and does not share it for advertising.

Witnio uses a small number of providers that may process personal data on its behalf:

• Stripe — payment processing and subscription billing, primary provider (billing and contact data).
• PayPal — payment processing, secondary provider (billing and contact data).
• Cloudflare — DNS, edge protection and delivery of the website and API (technical data such as IP address and request metadata).
• Witnio-operated hosting and device infrastructure in Costa Rica (all service data).
• Telegram — delivery of operational alerts to Witnio's own operations staff only. Customer alerts are not routed there by default; where a customer asks for Telegram alerts, that is the customer's own instruction.
• AI model providers reached through Witnio's AI router, on masked and minimised input only, for summarisation, classification and report generation. The model providers configured in Witnio's AI service layer at the time of processing; the current list and processing locations are available on request at [email protected]

The sub-processors named in this document (Stripe, PayPal, Cloudflare, Witnio's own infrastructure and Telegram for internal alerts only); any email delivery, error monitoring or analytics provider added later is announced to customers who subscribe at [email protected]

Witnio may also disclose data to a professional adviser under a duty of confidence, to an authority where legally compelled, where necessary to establish or defend a legal claim, or to a successor in a merger or sale of assets — in which case we will tell you, and your rights travel with the data.

9. International transfers

Witnio operates from Costa Rica and uses providers established in the United States and elsewhere, so personal data may be transferred outside your country.

For transfers of personal data out of the European Economic Area, the United Kingdom or Switzerland, Witnio relies on the European Commission's Standard Contractual Clauses, together with a transfer risk assessment and the technical measures described in the Security section — including masking before storage and encryption in transit. Those Clauses are incorporated into the Data Processing Addendum.

You may request a copy of the transfer mechanism relevant to your data at the privacy contact below.

Breneshold LLC signs the Standard Contractual Clauses as data importer under Module 2 (controller to processor).

10. Retention

Witnio keeps personal data only as long as it needs it.

• Screenshots: 90 days.
• Video of a device screen: 30 days.
• Operational logs: 30 to 90 days.
• Aggregated metrics that no longer identify anyone: long term.
• Sensitive raw data: the minimum time needed to produce the result, then masked or deleted.
• Paid Evidence: as stated in the customer's contract, where that is longer than the baseline.
• Account and billing records: for the life of the account, and then for the period required by tax and accounting law and no longer than needed to defend a legal claim.
• Waitlist and contact submissions: until you ask us to delete them, or the enquiry is closed and our record-keeping period expires.

After termination, Customer Data stays exportable for 30 days and is then deleted or irreversibly anonymised, except where a law requires it to be kept, or where it survives only in backups until those are overwritten on their normal cycle.

11. Your rights

Where the GDPR or an equivalent law applies, you may ask us to: give you access to your personal data and a copy of it; correct it; delete it; restrict or object to its processing, including processing based on legitimate interests; or give it to you in a portable, machine-readable format. Where processing rests on consent, you may withdraw that consent at any time.

Witnio does not make decisions about you that produce legal or similarly significant effects by automated means alone.

Write to the privacy contact below. We answer within one month, and may extend by two further months for a complex request, telling you why. We may ask for the information needed to confirm your identity, and we may decline a manifestly unfounded or excessive request, explaining our reasons.

You may complain to your local supervisory authority. In Costa Rica the competent authority is the Agencia de Protección de Datos de los Habitantes (PRODHAB), under Ley 8968.

If your data sits inside a customer's Evidence, we act as processor: we will refer your request to that customer, who is responsible for answering it.

12. California residents

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what personal information we collect, use, disclose and retain; to access and receive a copy of it; to correct it; to delete it; to limit the use of sensitive personal information; and not to be discriminated against for exercising a right.

In the preceding twelve months Witnio has collected the categories described above: identifiers, commercial information, internet activity, and — inside customer Evidence — information that may include communications metadata. It was collected for the business purposes described above and disclosed only to the providers listed above.

Witnio does not sell personal information and does not share it for cross-context behavioural advertising, and has not done so in the preceding twelve months. Witnio does not use or disclose sensitive personal information for a purpose beyond those permitted without a right to limit.

To exercise a right, write to the privacy contact below. An authorised agent may act for you with written proof of authority.

13. Costa Rica

Witnio's hardware and operations are in Costa Rica, and processing there is subject to Ley 8968 on the protection of the person in the processing of personal data, and its regulations.

Under that law you have rights of access, rectification, deletion, and, where required, to be informed about and to consent to the storage of your data in a registered database. Requests go to the privacy contact below and are answered within the period the law sets.

Breneshold LLC assesses its registration obligations under Costa Rican Law 8968 (PRODHAB) for the processing carried out on its devices in Costa Rica and registers where required.

14. Security

Witnio treats every public interface as hostile. Traffic passes an edge gateway, rate limiting, authentication and authorisation before reaching the control plane, internal services, workers and devices. The device farm is never exposed directly to the internet.

Access controls include multi-factor authentication, short-lived tokens with refresh rotation, revocable sessions, role-based access control, tenant scoping on every tenant-owned query, deny-by-default authorisation, and regression tests for cross-tenant access. API keys are scoped, rotatable, quota-limited and rate-limited.

Credentials, one-time passcodes, cookies and session tokens are never written to the repository, to logs, or to traces. Secrets are held in a secrets manager.

Every release runs dependency, secret, container and insecure-default scanning, plus authentication-abuse and cross-tenant regression tests.

Evidence integrity is protected cryptographically: each artifact carries a SHA-256 hash, and its manifest is canonicalised and signed with an Ed25519 key that never leaves the signing host. The public key is published, so a signature can be verified without trusting Witnio.

The Security page on this site states the measures currently in force and is updated as they change.

15. Personal data breach

If Witnio becomes aware of a personal data breach affecting a customer's data, it will notify the affected customer without undue delay and in any case within 72 hours of becoming aware, with the information available at the time and further updates as the investigation proceeds, so the customer can meet its own notification duties.

Where Witnio is the controller and a breach is likely to result in a high risk to affected individuals, Witnio will notify them and the competent supervisory authority as the applicable law requires.

Witnio's incident procedure is: detect, contain, revoke, preserve evidence, root-cause analysis, fix, add a regression test, retest, document.

16. Children

The service is not directed to children, and Witnio does not knowingly collect personal data from anyone under 18. If you believe a child's data has reached us, write to the privacy contact and we will delete it.

17. Changes to this policy

Witnio may update this policy. The version in force and its date appear at the top of this page.

Where a change materially affects how we handle personal data, we will notify account contacts at least 30 days before it takes effect.

18. Contact

Privacy questions, data subject requests, and this policy: [email protected].

Data protection officer or EU/UK representative, where one is appointed: [email protected] (privacy contact; no statutory data protection officer is required or appointed at this stage).

Postal address: the postal address stated in the customer's account and on every invoice.