Bullseye Client Privacy Policy

1 Introduction & Principles

Welcome to the Privacy Policy for Bullseye (operated by Bullseye Corporation, "we", "us", or "our"). We build cryptographic verification and anti-counterfeiting technology designed to protect consumers, healthcare patients, and reputable brands from illicit, cloned, and dangerous counterfeit goods.

We believe consumer protection should never come at the expense of your privacy. That is why Bullseye is architected with Privacy by Design:

• Zero User Registration: You never need to create an account, log in, or give us your name, email, or telephone number to authenticate a product.
• Zero Personal Tracking: We do not track you across apps or websites, and we never sell or monetize your personal data to advertisers.
• Purpose-Bound Telemetry: Every sensor permission we request (Camera and Location) is strictly bound to verifying the physical authenticity of the specific item in front of you.

2 Highlights at a Glance

Here is a quick summary of what you need to know about how the Bullseye Client app operates:

3 Information We Collect

When you use Bullseye on iOS, Android, or Web, we collect only the minimum technical information required to fulfill product authentications:

A. Camera Data

The app requires access to your device camera to scan cryptographic 2D barcodes, QR codes, and digital watermarks on product packaging.

• In-Memory Processing: Camera video frames are processed locally in real-time memory using the on-device scanner framework (mobile_scanner).
• No Photo Storage: Bullseye does not take, record, save, store, or transmit any photos, videos, or background images. Once the code characters are decoded, the camera stream buffer is instantly cleared.

B. Geolocation Data

The app requests permission to access your device's approximate and precise geographic location (latitude, longitude, and accuracy radius).

• No 24/7 Tracking: We do not monitor or track your location when the app is closed or idle. Coordinates are queried strictly when you open the scanner viewfinder or initiate a verification.
• Accuracy: Coordinates are transmitted over encrypted TLS connections directly to our secure verification function.

C. Product Scan Metadata

When a scan occurs, the following non-personal product payload is sent to our verification server:

• The scanned QR data string and cryptographic digital signature.
• Product SKU prefix, batch/lot identifier, and serial code.
• Timestamp of verification.

D. Technical & Device Diagnostics

To ensure system reliability, prevent automated bot scans, and enforce API rate-limiting, we log basic device parameters:

• Operating system and version (e.g., iOS 18.2, Android 15).
• Client application type and version (e.g., bulleyes_client v1.0.0).
• IP address (collected automatically at network gateway level for firewall and DDoS defense; not linked to personal consumer profiles).

4 How We Use Your Information

We process data exclusively for the following legitimate purposes:

1. Product Authenticity Verification: Validating that the physical item's cryptographic signature matches the authorized manufacturer's public key registry.
2. Counterfeit Clone & Velocity Detection: Identifying duplicated security tags through spatiotemporal analysis (detecting duplicate serial usage across distant physical stores).
3. Consumer Safety Alerts: Displaying clear risk status banners ("Authentic", "Caution - Duplicate Detected", or "Invalid / Suspicious") directly on your device screen.
4. Abuse & Fraud Mitigation: Blocking automated scraping, denial-of-service attempts, or tampering with the public verification infrastructure.

5 Information Sharing & Third Parties

We do not sell, rent, or trade your personal information. Because we do not collect your identity or profile, we have no personal data to broker.

We share technical scan events only in the limited circumstances described below:

A. Cloud Infrastructure Partners

We rely on trusted cloud computing and database infrastructure providers that adhere to stringent enterprise security protocols:

• Supabase Inc.: Cloud database and secure serverless Edge Functions hosting our verify-product service. Data is encrypted in transit and at rest.
• Google Firebase: Hosting and content distribution network (CDN) for our client web application and landing domain.

B. Authorized Brand Manufacturers

Participating product manufacturers whose items you authenticate receive de-identified, aggregated verification metrics. For example, a pharmaceutical brand may see that "Batch #A109 was scanned 45 times in Ikeja with 0 clone flags." Brands never receive personal consumer identities, names, or device contact details.

C. Law Enforcement & Public Health Authorities

Where counterfeit pharmaceuticals, tainted food items, or lethal contraband are detected, we may provide de-identified counterfeit incident reports to relevant regulatory bodies (e.g., NAFDAC, SON, or law enforcement agencies) to assist in removing dangerous fake goods from circulation.

6 Data Storage & Retention

All verification events (product serial, coordinates, risk verdict, and timestamp) are securely stored in our centralized, encrypted database located in certified data centers.

• Camera Feeds: Discarded immediately after QR extraction (0 retention).
• Scan Event Records: Retained for the commercial shelf life of the associated product batch to maintain comprehensive anti-counterfeit audit trails.
• Server Diagnostic Logs: IP addresses and raw HTTP connection logs are rotated and automatically purged on a rolling 90-day cycle.

7 Managing Device Permissions

You maintain full control over the permissions granted to Bullseye. You can review, grant, or revoke Camera and Location permissions at any time through your operating system settings:

8 Children's Privacy

Bullseye is designed for general consumer use and commercial product safety. We do not knowingly solicit, collect, or market to children under the age of 13 (or under 16 in certain jurisdictions, in compliance with the Children's Online Privacy Protection Act - COPPA and the EU General Data Protection Regulation - GDPR-K).

Because our application does not facilitate user registration or account creation, no personal profiles of minors are ever compiled or retained. If you believe a child has provided us with identifiable information, please contact us immediately at privacy@bullseye.corp and we will promptly delete any corresponding data.

9 Security & Encryption Standards

We enforce rigorous organizational, physical, and technical safeguards to protect all verification data against unauthorized access, alteration, or interception:

• Transport Layer Security: All data transmitted between your device and Bullseye Edge Functions is encrypted using modern TLS 1.3 cryptography.
• Storage Encryption: All server database volumes utilize AES-256 storage-level encryption at rest.
• Public-Key Signature Verification: Product codes are verified against cryptographic elliptic-curve public keys; your private device identity is never exposed during this exchange.
• Least-Privilege Isolation: Server functions operate in sandboxed, isolated runtimes with strictly scoped database row-level security (RLS) policies.

10 Your Legal Rights

Depending on your country of residence (such as the European Union under GDPR, California under CCPA/CPRA, or Nigeria under the Nigeria Data Protection Act - NDPA 2023), you enjoy specific statutory rights regarding data processing:

• Right to Know / Access: You have the right to request information regarding the categories of data we collect and process.
• Right to Deletion: You have the right to request deletion of any telemetry data associated with your network IP or verification requests.
• Right to Restrict Processing: You may revoke Camera or Location permissions at any moment via your device operating system settings.
• Non-Discrimination: We will never discriminate against you, diminish your app performance, or charge fees for exercising any of your statutory privacy rights.

11 Contact Information & Policy Updates

We may periodically update this Privacy Policy to reflect improvements in our verification protocols, app features, or changes in international regulatory requirements. When revisions occur, the "Effective Date" at the top of this page will be updated accordingly.