Privacy Policy | Device Prophet

1. Introduction

Device Prophet (“we,” “our,” or “us”) is committed to protecting your privacy and the security of your technical data. This Privacy Policy explains how we collect, use, and safeguard your information when you use our website, engineering inquiry channel and IoT security assessment tools.

We collect data to provide assessments, respond to engineering inquiries and operate the service.

2. Information We Collect

Assessment Data

When you use the Device Prophet Preliminary Design Audit tool, we collect technical specifications regarding your product. This includes:

Device Architecture: Processor type (SoC), memory constraints, connectivity modules, and operating systems.
Security Posture: Implementation details regarding Secure Boot, key storage, update mechanisms, and authentication protocols.
Market Context: Intended industry (e.g., Medical, Industrial) and target regions (e.g., EU, USA) to determine regulatory applicability.
Business Metrics: Organization size category (SME, Large Enterprise, or Other), used solely to determine regulatory applicability thresholds (e.g., SME exemptions under CRA/AI Act, NIS2 scope). We do not collect specific employee counts or turnover figures.
Optional Context: If you request an Expert Triage, we collect the additional context, email address, and documentation files you voluntarily upload.
Smart Import (Beta): When you use Smart Import, your description is sent to Cloudflare Workers AI to suggest questionnaire answers. Device Prophet stores the submitted text, model output and extracted answers for caching and troubleshooting, including failed attempts. This happens before you submit an assessment. Do not include personal information, credentials or confidential material in the description.

Contact & Inquiry Data

When you contact us via email or our contact forms, we collect:

Name and email address
Company name (optional)
Subject (optional), the content of your message and inquiry type

Technical Usage Data

To maintain the security and performance of our platform, we automatically collect:

Request Information: Our hosting provider processes request information such as your IP address and browser headers to deliver the site and protect it from abuse.
Application Records: Stored records can include timestamps, a referring-page URL and a pseudonymous identifier derived from your IP address and browser header. Smart Import also records processing time, the model used and error information. A pseudonymous identifier is not the same as anonymous data.

3. How We Use Your Information

We process your data for specific, limited purposes:

Service Provision: To generate the automated Preliminary Design Audit reports and risk timelines based on your assessment inputs.
Expert Triage: To allow Device Prophet to review your Triage request and provide a manual “Red Flag” analysis.
Communication: To send report links and respond to engineering, commercial or public-tool inquiries, including discussion of scope and availability. Inquiry storage and notification delivery are separate processing steps.
Service Maintenance: Processing records help us reuse Smart Import results, investigate errors and maintain the assessment service.
Security & Compliance: To prevent abuse of our tool and comply with legal obligations (such as GDPR).

4. Data Storage and Security

Browser Workspace: Drafts and saved assessment entries are kept in your browser’s local storage.
Submitted Data: Assessment answers, Smart Import records and contact inquiries are stored in Cloudflare D1. Uploaded documents and generated PDFs use Cloudflare R2; the site’s R2 binding is configured for EU jurisdiction. The public site uses HTTPS.
Report Links: Submitted reports can be opened by anyone who has the report link, without an account. Share links only with intended recipients, and do not include secrets in assessment answers.
Operator Access: Device Prophet can access stored submissions to operate the service, respond to requests and investigate problems. Storage is distinct from public report access; a report link does not grant general database access.

5. Data Retention

Our retention targets are 90 days for assessments and their generated reports, 14 days from upload for triage files, 2 years for contact inquiries, and 13 months for Smart Import records and feedback. Smart Import records include the submitted text and are not anonymous analytics.

Access expiry does not mean deletion. Assessment links expire, but stored records and files may remain after these targets. Automatic deletion across all storage has not been established, so these periods are not guaranteed deletion deadlines.

You can request deletion at info@deviceprophet.com. Include the report link or enough context to locate your submission. Clearing your browser workspace removes local copies only; it does not delete submitted records or uploaded files.

Under the General Data Protection Regulation (GDPR) and Finnish Data Protection Act, you have the following rights:

Right to Access: You may request a copy of the personal data we hold about you.
Right to Rectification: You may correct inaccurate or incomplete data.
Right to Erasure (“Right to be Forgotten”): You may ask us to delete your personal data.
Right to Restriction: You may ask us to limit how we process your data.
Right to Object: You may object to the processing of your data.
Data Portability: You may request your data in a structured, machine-readable format.

Data Controller Information: For the purposes of the GDPR, the Data Controller is Mingulov Denis, trading as Device Prophet. Privacy-related requests are directed to Denis Mingulov at the contact address below.

To exercise any of these rights, please contact us at info@deviceprophet.com.

We do not sell your data. We share data only in the following strict circumstances:

Service Providers: We use trusted infrastructure providers (specifically Cloudflare) to host our database and storage. They process data only according to our instructions. Contact inquiries are stored for Device Prophet to respond, with hosting and notification providers supporting that processing.
Engineering Engagements: Separately agreed engineering work is invoiced under its service agreement. Any necessary billing data is handled for that engagement; the website does not take payments for audit reports.
Legal Obligations: If compelled by a valid court order or government regulation.
Business Transfers: If Device Prophet is acquired or merged, data may be transferred as a business asset (you would be notified of such a change).

8. Cookies and Local Storage

No Tracking Cookies: We do not use third-party tracking cookies (like those used for ad retargeting).
Local Storage: We use your browser’s Local Storage to save your assessment progress. Submitting an assessment sends its answers to Device Prophet. Smart Import separately sends your description when you use that feature, even if you never submit the assessment. Backup and clear controls apply to the browser workspace only.

9. International Data Transfers

Our infrastructure utilizes Cloudflare’s global network. We rely on Data Residency configurations to keep uploaded files within the EU. However, metadata or database content may be processed globally. We rely on Cloudflare’s Data Processing Addendum (DPA) and Standard Contractual Clauses (SCCs) to ensure your data receives a level of protection equivalent to EU standards when transit occurs.

10. Children’s Privacy

Our service is a B2B professional tool and is not intended for children under 13. We do not knowingly collect data from children.

11. Changes to This Policy

We may update this policy to reflect changes in our service or regulations. The “Last Updated” date at the top of this page indicates the latest revision.

12. Contact Information

We operate as a digital-first entity. For the fastest response regarding privacy concerns or general inquiries, please contact us via email.

Email: info@deviceprophet.com