Privacy Policy

1. Overview

1. MopokeHQ is a vulnerability exposure and SBOM management platform operated by BOO Studio Pty Ltd (ACN 624 302 469 / ABN 13 624 302 469), trading as BOO Soft (“BOO Soft”, “we”, “us”, “our”). BOO Soft is part of the BOO Group of companies, and MopokeHQ sits under BOO Group legal governance.

2. This Privacy Policy explains how we collect, use, store and disclose personal information in connection with MopokeHQ, including the website at mopokehq.com, the application at app.mopokehq.com, the mopoke CLI, the registry proxy, integrations and Lilly (together, the “Services”).

3. This policy is a product-specific supplement to the BOO Group Privacy Policy (https://boogroup.com.au/legal-center/privacy-policy), which applies to all BOO Group entities and sets out our group-wide approach, definitions, jurisdiction-specific rights (Australia, EEA, UK, California, New Zealand, Canada) and complaints process. Where this policy is more specific, it prevails for MopokeHQ. Where this policy is silent, the BOO Group Privacy Policy applies.

4. This policy is not a contract. It is a notice required by the Privacy Act 1988 (Cth) and, where applicable, the GDPR, UK GDPR and CCPA/CPRA. The MopokeHQ Terms of Service require you to have read it.

2. Our two roles: controller and processor

5. MopokeHQ is a business-to-business tool. We handle personal information in two different capacities, and your rights differ depending on which applies:

Role	What it covers	Examples
BOO Soft as controller	Information we collect for our own purposes to run MopokeHQ	Your name and email address, your Organisation memberships and roles, sign-in sessions, invitations, early-access enquiries and support conversations
BOO Soft as processor (service provider)	Personal information contained in Customer Data that a Customer uploads to or generates in its Organisation. The Customer decides what to upload and why; we process it on the Customer’s instructions under the Terms of Service and, where applicable, a Data Processing Agreement	The commit author recorded with a secret finding, the person recorded against a decision, IP addresses in the registry proxy’s download log, a client name on an evidence pack

6. If your details appear in a Customer’s data (for example, as a commit author in their repository, or as a client named on their evidence pack), that Customer, not BOO Soft, is the controller of your personal information in the Services. Please direct requests to that Customer first. We will assist the Customer in responding, and will pass on any request we receive directly.

3. What personal information we collect

3.1 Information about you as a user (controller)

Type of data	Purpose	When
Your BooAuth user identifier, name and email address	Identifying you, showing who did what, sending you alerts	First sign-in, updated at each sign-in
Organisation memberships and your role in each	Deciding what you can see and do	When you join or are invited to an Organisation
Sign-in time and a session record (a hashed session token and its expiry)	Keeping you signed in securely	Each sign-in
Invitation details: the invitee’s email address and role	Inviting someone to an Organisation	When an owner or admin sends an invitation
Early-access requests, support and other correspondence	Responding to you and improving the Services	When you contact us

7. Your password and any multi-factor authentication settings are held by BooAuth, BOO Soft’s identity service, not by MopokeHQ. MopokeHQ receives only your BooAuth identifier, name, email address and Organisation memberships when you sign in.

8. MopokeHQ does not currently take payments. When paid plans are introduced, billing details will be collected and this policy updated first.

3.2 Information collected automatically (controller)

Type of data	Purpose
A record of actions in each Organisation (who made a triage decision, verified a scan target, created a webhook or generated an evidence pack, and when)	Security, the Evidence Log, and accountability within the Organisation
CLI and API activity (CLI version, upload times, Organisation, Project and token identifiers, success or error codes)	Operating and supporting the Services
Network request data (IP address, browser, request path and time) processed by Cloudflare as traffic reaches us	Delivering the Sites and protecting them from attack
A sign-in session cookie and preferences kept in your browser	See the MopokeHQ Cookies Policy

9. MopokeHQ does not use analytics, advertising or tracking tools on mopokehq.com or app.mopokehq.com, and the application does not record your IP address.

3.3 Customer Data (processor)

10. Customers upload or generate the following in the Services. Most of it is technical rather than personal, but some of it can contain personal information:

Type of data	Personal information it may contain
SBOMs (software bills of materials)	Normally none. May include package author or maintainer names and emails as published in package metadata
Deployment records and runtime check-ins	Normally none. We record the environment, commit identifier, a host label the Customer chooses, and runtime versions
Findings and triage decisions	The name of the user who made each decision. For a secret found in a repository, the name and email address of the commit author who introduced it, taken from the repository’s history
Registry proxy keys and download log	The person a personal proxy key belongs to, and the IP address of the machine that downloaded each package
External scan targets and results	Host names the Customer registers, and who verified them
Merge request reviews (only where the Customer enables code review)	Whatever personal information is in the diff being reviewed, after detected secrets are redacted
Evidence Log and evidence packs	The above, in an append-only hash-chained record, and the name of a client a pack was prepared for
Webhooks, plugins and MCP access	Customer Data the Customer chooses to send to its own endpoints, plugins or AI clients

3.4 Sensitive information

11. We do not seek to collect sensitive information (as defined in the Privacy Act 1988 (Cth)) or special category data (GDPR Article 9) through the Services. Customers must not upload such information. If we become aware that sensitive information has been uploaded without a lawful basis, we may ask the Customer to remove it or remove it ourselves.

3.5 Children

12. The Services are not directed to anyone under 18 and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

4. How we use personal information

13. As controller, we use personal information to:

(a) create and manage accounts and Organisation memberships, and authenticate users through BooAuth (contract);

(b) provide, operate, maintain and secure the Services, including tenancy isolation and abuse detection (contract and legitimate interests);

(c) send service email: alerts and digests about your Organisation’s findings, invitations, security and incident notices, and changes to these terms. These are not marketing (contract and legitimate interests);

(d) provide support and respond to enquiries, including early-access requests (contract and legitimate interests);

(e) send product updates where you have opted in, with an unsubscribe in every message (consent);

(f) comply with legal obligations and enforce our agreements (legal obligation and legitimate interests); and

(g) generate de-identified, aggregated statistics (for example, how widespread a CVE is across all Organisations) that do not identify any person, Customer or Project (legitimate interests).

14. As processor, we use Customer Data only to provide the Services to the Customer as described in the Terms of Service and the Customer’s configuration, and as required by law. We do not use Customer Data for marketing, do not sell it, and do not allow AI providers to train models on it.

15. Legal bases (GDPR/UK GDPR). Where the GDPR or UK GDPR applies, our legal bases are shown in brackets above. Where we rely on legitimate interests, we have balanced those interests against your rights and consider that they are not overridden. You may object at any time (see section 10).

5. Lilly and automated processing

16. Lilly writes a short note on what an advisory means for a Customer’s software and gives a probability that a match applies, answers questions about an Organisation’s open work, and, where code review is enabled, proposes review comments. Where Lilly judges a P2 or P3 finding likely not to apply, at or above a threshold the Customer sets (90% by default), it holds the finding back from digests as “suggests not affected” for a person to confirm. Lilly does not change priorities, close exposures, hold back P1 findings or block merges. No decision with legal or similarly significant effects on an individual is made solely by automated means.

17. What is sent to our AI providers.

(a) For a note: the advisory, whether it is known to be exploited, its exploitation probability score, and the affected package names and versions with the environment or branch they were found in.

(b) For a note on a found secret: the scanner rule, the file path and line, the variable name and the files that read it, whether it is on the default branch, how long it has been in the history and the repository’s visibility. Never the secret’s value, and never who committed it.

(c) For a question: finding titles, advisory identifiers, priorities and due dates, with the question asked.

(d) For code review: the merge request diff with detected secrets redacted.

None of these includes the names of the Customer’s Projects, repositories, components or people.

18. AI providers. Lilly’s requests go through OpenRouter, Inc. (United States), an AI model routing service, to Anthropic’s Claude models and to Jev, a decision model. We require every request to be served only by providers operating under zero data retention terms, meaning the provider does not store prompts or outputs after returning a response and does not use them to train models. The current providers are listed in the BOO Group Sub-processor list.

19. Customers can turn Lilly off for their whole Organisation at any time. When it is off, nothing is sent to an AI provider, and alerts continue without the note.

6. Who we disclose personal information to

20. We disclose personal information to:

(a) BOO Group entities - BOO Group Holdings Pty Ltd and related bodies corporate, for group governance, security, finance and legal functions (see the BOO Group Privacy Policy for the entity list);

(b) BooAuth (booauth.com) - BOO Soft’s own identity service, for sign-in and invitations;

(c) Sub-processors - DigitalOcean, LLC (application hosting and the managed database, Sydney region), Cloudflare, Inc. (DNS, network protection and email delivery), OpenRouter, Inc. and the zero-data-retention model providers it routes to (Lilly), and Doppler (storage of our production secrets, which holds no Customer Data). The current list, each provider’s location and the transfer safeguards in place are published in the BOO Group Sub-processors of Customer Data document (https://boogroup.com.au/legal-center/sub-processors). We give Customers at least 30 days’ notice of new sub-processors that process Customer Data;

(d) Advisory Data sources - we download public advisory feeds (OSV, the GitHub Advisory Database, php.net, CISA KEV, FIRST EPSS). We do not send personal information or Customer identifiers to these sources;

(e) Your Git platform - where you connect GitLab or GitHub, merge requests and review comments are posted by jobs on your own runners or through the integration you installed, using credentials and scopes you control;

(f) Destinations you configure - outgoing webhook endpoints, plugins and AI clients connected through MCP receive the Customer Data you direct to them;

(g) Professional advisers, insurers and auditors under confidentiality obligations;

(h) Law enforcement, regulators and courts where required by law or to protect rights, safety or property; and

(i) A purchaser or successor in connection with a merger, acquisition, restructure or asset sale, with notice to you before your personal information becomes subject to a different privacy policy.

21. We do not sell personal information and we do not “share” it for cross-context behavioural advertising within the meaning of the CCPA/CPRA.

7. Where personal information is stored and cross-border transfers

22. All data MopokeHQ stores, including accounts and Customer Data, is held in a managed PostgreSQL database in DigitalOcean’s Sydney, Australia region, encrypted at rest. Secrets a Customer stores (webhook signing secrets, plugin bundles and registry deploy tokens) are additionally sealed with a data key unique to that Organisation. We will not move a Customer’s storage region without agreement.

23. Some sub-processors are located in, or may access data from, the United States or other countries: OpenRouter and its model providers (for Lilly requests only), Cloudflare (network traffic and email delivery), and DigitalOcean (a US company whose support access to our Sydney-hosted data is governed by its data processing agreement).

24. Where personal information is disclosed to an overseas recipient we take the reasonable steps required by APP 8, and where the GDPR or UK GDPR applies we rely on adequacy decisions, Standard Contractual Clauses or the UK International Data Transfer Addendum as appropriate. Details are in the Sub-processor list.

25. If you access the Services from outside Australia, your information will be transferred to and processed in Australia.

8. Security

26. We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. Measures include:

(a) tenancy isolation: every tenant table carries its Organisation and PostgreSQL row-level security enforces it on every query, with cross-tenant leak tests run in CI;

(b) encryption in transit (TLS) and at rest, with a per-Organisation data key for stored secrets;

(c) only hashes of session tokens, CI upload tokens, API keys, registry proxy keys and invitation codes are stored, never the tokens themselves;

(d) an outbound-only model: the CLI pushes to us using tokens you control, MopokeHQ does not connect into your network and, in the default runner mode, stores no Git credentials;

(e) sign-in through BooAuth;

(f) access controls and least-privilege access for BOO Soft staff; and

(g) an append-only, hash-chained Evidence Log that reveals tampering.

27. No method of transmission or storage is completely secure. MopokeHQ does not currently hold ISO/IEC 27001 or SOC 2 certification. Current security information is at mopokehq.com/security.

28. Data breaches. If a data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and will notify affected Customers without undue delay so they can meet their own obligations (including GDPR Articles 33 and 34 where applicable).

9. Retention and deletion

29. Sessions and sign-in. A sign-in session lasts 7 days, or until you sign out. Records of a sign-in in progress expire after 10 minutes.

30. Accounts. We keep your user record while you belong to any Organisation, and afterwards for up to 7 years where needed for tax, accounting, legal or dispute purposes, consistent with the BOO Group Privacy Policy.

31. Customer Data. We keep Customer Data for as long as the Customer’s Organisation is active. Customers can delete individual Projects at any time. Runtime check-ins from a host that has not reported for 30 days are removed when a newer check-in replaces them.

32. Evidence Log. The Evidence Log is append-only and hash-chained so that it can serve as compliance evidence. Individual entries cannot be edited or selectively deleted. Erasure requests relating to personal information in the Evidence Log are handled by deleting the Customer’s Organisation data as a whole, rather than by editing entries.

33. On closing an Organisation. On request, we provide an export of the Customer Data for 30 days after an Organisation closes. We then delete the Customer Data and destroy the Organisation’s data key, so secrets sealed with it cannot be read, including in backups. Database backups expire in the ordinary course. Deletion is irreversible.

10. Your rights and choices

34. Everyone. You may ask us to access or correct the personal information we hold about you as controller, and may complain to us using the details in section 12. We may need to verify your identity. If your request relates to Customer Data, we will refer you to the relevant Customer and assist them.

35. Australia (APPs). You have rights to access and correct your personal information and to complain to us and then to the OAIC (https://www.oaic.gov.au/privacy/privacy-complaints/).

36. EEA and UK (GDPR / UK GDPR). You have rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time. You may complain to your local supervisory authority or, in the UK, the Information Commissioner’s Office (https://ico.org.uk). If we appoint an EU or UK representative under Article 27, their details will be listed in the BOO Group Sub-processor list.

37. California (CCPA/CPRA). You have the right to know, delete, correct, and opt out of sale or sharing (we do not sell or share), and not to be discriminated against for exercising your rights. We honour Global Privacy Control signals as an opt-out.

38. New Zealand and Canada. See the BOO Group Privacy Policy for rights under the NZ Privacy Act 2020 and PIPEDA.

39. Product updates. You may unsubscribe at any time through the link in any message or by contacting us. We will action unsubscribe requests within 5 business days.

40. Lilly. Owners and admins can turn Lilly off for their Organisation at any time in settings.

11. Cookies

41. The application uses one sign-in cookie, and both sites keep display preferences in your browser. Details are in the MopokeHQ Cookies Policy (https://mopokehq.com/cookies).

12. Complaints and contact

42. To exercise a right, ask a question or make a complaint, contact:

Field	Details
Company	BOO Studio Pty Ltd (trading as BOO Soft) - MopokeHQ
Attention	Privacy and Data Protection Officer, BOO Group
Email	[email protected]

43. Our Privacy Officer will acknowledge your complaint and respond as soon as practicable, normally within 30 days. If you are not satisfied, you may complain to the OAIC or your local data protection authority.

13. Changes to this policy

44. We may update this policy from time to time. For material changes we will give reasonable advance notice by email to your Organisation’s owners or a prominent notice in the Services, and update the date above. Continued use of the Services after the effective date constitutes acceptance.

14. Related documents

Document	URL
MopokeHQ Terms of Service	https://mopokehq.com/terms
MopokeHQ Cookies Policy	https://mopokehq.com/cookies
MopokeHQ Security and Data	https://mopokehq.com/security
BOO Group Privacy Policy	https://boogroup.com.au/legal-center/privacy-policy
BOO Group Sub-processors of Customer Data	https://boogroup.com.au/legal-center/sub-processors
BOO Group Cookies Policy	https://boogroup.com.au/legal-center/cookies-policy