Privacy Policy

1. Introduction

zymtrace, Inc. ("the Company," "we," "us," or "our") operates gozymtrace.com and the zymtrace continuous GPU profiling service (collectively, the "Service"). This Privacy Policy explains what information we collect from platform engineers, SRE teams, and other visitors who use the Service, how we use it, and the choices available to you.

zymtrace is a developer tool that identifies the specific GPU kernels and Python call paths responsible for cloud infrastructure costs. The nature of our work means we handle profiling metadata -- stack samples, kernel event timing, process identifiers -- from the infrastructure our customers connect to the Service. This policy describes both that operational data and the personal information we collect through our website.

We are based at 535 Mission Street, 14th Floor, San Francisco, CA 94105 and can be reached at [email protected].

2. Information We Collect

2.1 Information You Provide

We collect information you submit directly, including:

• Contact details (name, work email, phone) when you fill out our contact form, register for an account, or request information about the Service;
• Company information you choose to share (employer, role, infrastructure scale, project context);
• The content of any messages you send us.

2.2 Profiling and Operational Data from Connected Infrastructure

When you connect a GPU workload to the Service, our eBPF-based collection agent gathers the following from your running processes:

• Call stack samples (Python frame names and CUDA kernel names) captured at 99 Hz;
• GPU kernel execution timing and duration metadata;
• Process names and process identifiers for the attached workload;
• Memory allocation timing events (not memory contents);
• CUDA API call sequences (launch, memcpy, sync events).

Our agent operates at the kernel syscall boundary via read-only eBPF probes. It does not read source code files, environment variables, secrets, network packet contents, or any data stored on disk. Profiling data is attributed to the account that deployed the agent and is used solely to generate flamegraph visualizations and cost-attribution reports within that account.

2.3 Information Collected Automatically from the Website

When you visit gozymtrace.com, we automatically collect limited technical information:

• IP address and approximate location (city and region level);
• Browser type, operating system, and device class;
• Pages visited, referring URLs, and time on page;
• Cookie and similar identifiers (see Section 5).

2.4 We Do Not Knowingly Collect Children's Data

gozymtrace.com is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact [email protected] and we will delete it.

3. How We Use Information

We use the information we collect to:

• Provision and operate the zymtrace GPU profiling Service for authenticated accounts;
• Generate flamegraph visualizations, differential profiles, and cost-attribution reports from submitted profiling data;
• Respond to inquiries and provide requested information about the Service;
• Send service updates, security notices, and (with your consent where required) product communications;
• Detect, investigate, and prevent fraud, abuse, or unauthorized access;
• Improve the performance and reliability of the Service;
• Comply with legal obligations.

We do not use profiling data submitted by customers (kernel traces, stack samples, flamegraph data) to train machine learning models without explicit written agreement. We do not sell personal information for monetary value. Where applicable state law treats certain advertising arrangements as a "sale" or "share," see Section 9 below.

4. Sharing of Information

We share personal information only with:

• Service providers acting on our behalf (for example, cloud hosting, email delivery, and anonymized usage analytics) under contractual confidentiality terms that restrict their use of the data;
• Legal authorities, when required by law or to protect rights, safety, or property;
• A successor entity in the event of a merger, acquisition, or asset sale, subject to this Policy.

We do not sell personal information to third parties. Profiling data from customer workloads is never shared with other customers or used for any purpose outside the originating account.

5. Cookies and Tracking

We use cookies and similar technologies to operate the site, remember preferences, and measure usage. For details and choices, see our Cookie Policy.

6. Data Retention

We retain personal information only as long as needed for the purposes described, to comply with legal or accounting obligations, and to resolve disputes. Inactive marketing-list contacts are purged after 24 months. Server access logs are retained 90 days, then aggregated and anonymized.

Profiling data (flamegraphs, kernel traces, stack samples) is retained according to your plan tier: 7 days for the Trace tier, 30 days for Growth, and 90 days for Scale. Data beyond your retention window is deleted automatically. Closing your account triggers deletion of all associated profiling data within 30 days.

7. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including TLS 1.3 encryption in transit, restricted-access databases, and least-privilege access controls. The zymtrace eBPF agent runs as a restricted user with read-only kernel probes and cannot modify network traffic or application behavior. No system is perfectly secure; we cannot guarantee absolute security.

8. Your General Rights

Depending on your jurisdiction, you may have rights including access, correction, deletion, and the ability to limit certain processing. To make a request, email [email protected]. We will respond within the timeframe required by applicable law.

9. California Residents (CCPA / CPRA)

Under the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"), California residents have specific rights regarding personal information collected about them. This section supplements the rest of the Policy.

9.1 Categories We Collect

In the past 12 months, we have collected the following categories of personal information defined under Cal. Civ. Code section 1798.140: identifiers (name, email, IP address); commercial information (service inquiries and subscription information); internet or other electronic network activity information (browsing activity on gozymtrace.com); and inferences drawn from the above for service-improvement purposes. For authenticated accounts, we also process profiling data that may include process and system identifiers associated with your infrastructure. We do not collect sensitive personal information as defined under Cal. Civ. Code section 1798.140(ae) in a manner that would require us to offer a right to limit beyond what is already described in this Policy.

9.2 Sources, Purposes, Disclosure

We obtain this information from you directly and through automatic site instrumentation. We use it to operate and improve the Service, communicate with you, and meet legal obligations. We disclose it only to service providers under written contract and to legal authorities where required.

9.3 Your CCPA / CPRA Rights

• Right to Know: request the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: request deletion of personal information we collected from you, subject to legal exceptions.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: we do not sell personal information; we do not "share" it for cross-context behavioral advertising as defined under CPRA.
• Right to Limit Use of Sensitive PI: we do not use sensitive personal information for purposes beyond those permitted without authorization.
• Right to Non-Discrimination: we will not deny services, charge different prices, or provide a different level of service because you exercised a right.

9.4 How to Exercise

Submit a verifiable request by emailing [email protected] with the subject line "California Privacy Request." Include enough detail for us to verify you are the person whose information is the subject of the request. We respond within 45 days, with a possible 45-day extension for which we will notify you.

9.5 Authorized Agents

You may designate an authorized agent to make a request on your behalf. The agent must provide proof of authorization; we may also require you to verify your identity directly.

9.6 "Shine the Light"

California Civil Code section 1798.83 entitles California residents to request information regarding our disclosure of personal information to third parties for direct marketing. We do not disclose personal information for third-party direct marketing.

9.7 Do Not Track and Global Privacy Control

Under the California Online Privacy Protection Act (Cal. Bus. & Prof. Code section 22575), we disclose how we respond to "Do Not Track" (DNT) browser signals. Because there is no common industry standard for interpreting DNT signals, we do not currently respond differently to them. We do not authorize third parties to collect personally identifiable information about your activity across different websites when you use the Service. We honor an opt-out preference signal sent by a platform or browser that complies with the CPRA, such as the Global Privacy Control (GPC); when we detect a GPC signal, we treat it as a valid request to opt out of the sale or sharing of personal information for that browser or device.

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by a new "Last updated" date and, where appropriate, a notice on the Service.

11. Contact

Questions, requests, or complaints can be sent to: