Detailed In Design LLC (“Company,” “we,” “us,” or “our”) operates Serenity Security, an AI-powered cyber defense platform for real-time threat detection, investigation, and response. This Privacy Policy applies to:
We comply with the Indiana Consumer Data Protection Act (ICDPA), effective January 1, 2026, and proactively extend its protections to all users regardless of jurisdiction as a demonstration of our commitment to data privacy and consumer protection.
| Category | Data Elements | Collection Method |
|---|---|---|
| Account Information | Full name, email, company name, phone number | Provided at signup |
| Payment Information | Billing name and address, payment method type (card details handled exclusively by Stripe) | Subscription setup via Stripe |
| Usage Data | API call counts, dashboard interactions, feature usage, timestamps, response codes | Automatic during platform use |
| Security Event Data | Threat alerts, case records, forensic artifacts, MITRE ATT&CK mappings, Decision Artifacts | Generated by Serenity detection engines or customer submission |
| Device Traffic Data | Network connection metadata (source/destination IPs, ports, protocols, timestamps), process activity, USB device events, file-integrity changes | Collected by Serenity-Nano agent on enrolled devices |
| Support Data | Support messages, attachments, correspondence | Customer-initiated support contact |
| Audit Logs | User actions (login, configuration changes, response actions), IP addresses, timestamps | Automatic |
| Log Data | IP address, user agent, browser type, timestamps, referring URL | Website and API visits |
Key Principle: All device traffic collected by Serenity-Nano is encrypted end-to-end and accessible only to the Designated Officer assigned to those devices. No other party - including Detailed In Design LLC staff - can view, decrypt, or access this data without explicit written authorization from the Designated Officer.
When deployed on an endpoint, the Serenity-Nano agent continuously monitors the following categories of device activity:
All Device Traffic Data collected by Serenity-Nano is protected with multiple layers of encryption:
| Layer | Method | Purpose |
|---|---|---|
| In Transit | TLS 1.3 with certificate pinning | Protects data while moving from the Nano agent to the Serenity platform |
| At Rest (Server) | AES-256-GCM encryption | Encrypts all stored Device Traffic Data on Serenity infrastructure |
| Officer-Scoped Envelope | Per-officer asymmetric key pair (RSA-4096 or ECDSA P-384) | Device Traffic Data is envelope-encrypted with the Designated Officer’s public key; only the Officer’s private key can decrypt |
Access to Device Traffic Data is governed by a strict Designated Officer model:
Customers deploying Serenity-Nano on employee devices are required, under our Terms of Service, to provide clear written notice to all monitored individuals describing:
We do not intentionally collect Sensitive Data (as defined under the ICDPA) for our own purposes.
However, customer Security Event Data or Device Traffic Data may incidentally contain information that qualifies as Sensitive Data. In such cases:
Enterprise customers handling Protected Health Information may execute a Business Associate Agreement (BAA).
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
| serenity_session | HttpOnly, Secure, SameSite=Lax | Session authentication | Session / 30 minutes |
| refresh_token | HttpOnly, Secure, SameSite=Lax | Token refresh | 7 days |
We do not use analytics cookies, advertising cookies, tracking pixels, or any third-party tracking technologies.
| Third Party | Category | Data Shared | Purpose |
|---|---|---|---|
| Stripe | Payment Processor | Billing name, email, payment details | Payment and subscription processing |
| Hetzner | Cloud Infrastructure | All encrypted server data | Dedicated single-tenant hosting |
| Cloudflare | Security / CDN | IP addresses, request metadata | DNS, DDoS protection, routing |
| Let’s Encrypt | Certificate Authority | Domain names only | SSL/TLS certificate issuance |
Third parties are contractually required to protect data in accordance with applicable law and our contractual requirements.
Device Traffic Data is never shared with any third party. It is stored on dedicated infrastructure and encrypted with the Designated Officer’s key. Third-party infrastructure providers host the encrypted data but cannot access its contents.
Customer Security Event Data and Device Traffic Data are processed exclusively for the contracted cyber defense service. They are not used for model training on other customers’ data, not shared with other customers, and not monetized in any way.
| Data Category | Retention Period |
|---|---|
| Account Information | Duration of active account + 30 days after deletion |
| Payment Information | Stripe’s retention policy; Company retains billing records 7 years for tax compliance |
| Usage Data | 90 days |
| Security Event Data | Per customer retention policy; default 90 days, configurable up to 7 years (Enterprise) |
| Device Traffic Data | Per customer retention policy; default 90 days. Designated Officer may purge at any time |
| Support Data | Duration of active account + 30 days after deletion |
| Audit Logs (Basic / Professional) | 90 days |
| Audit Logs (Enterprise) | 7 years |
| Log Data | 90 days |
Upon account deletion, a 30-day grace period allows restoration requests. After 30 days, all personal data associated with the account is permanently deleted. Device Traffic Data is cryptographically shredded (encryption keys destroyed) upon account termination or at the Designated Officer’s request.
We implement comprehensive technical and organizational security measures:
No method of electronic storage or transmission is 100% secure. We commit to protecting your data to the best of our ability using industry-leading practices and will notify affected customers within 72 hours of discovering any data breach.
Customer deployments are provisioned on dedicated infrastructure in the customer’s selected region. Default hosting is provided by Hetzner data centers within the European Union (Falkenstein, Germany and Helsinki, Finland).
We do not transfer personal data outside of the hosting region unless required by a third-party service provider (e.g., Stripe for payment processing). Users accessing the Service from outside the hosting region consent to data transfer to the applicable infrastructure region by using the Service.
We extend the following rights to all users regardless of state or country of residence:
Confirm whether your data is being processed and access the categories and specific pieces of data collected.
Correct inaccuracies in your personal data through the dashboard or by submitting a correction request.
Request deletion of your personal data, subject to exceptions for completing transactions, legal obligations, or exercising legal rights.
Obtain your personal data in a portable, readily usable format (JSON export provided upon request).
Opt out of: (a) data sales, (b) targeted advertising, (c) profiling with legal or similarly significant effects. As stated in Section 9, we do not engage in any of these practices.
We will not discriminate against you for exercising any of your rights under the ICDPA.
You may submit privacy rights requests through:
Verification: We will confirm your identity before fulfilling any request.
Authorized Agents: Permitted with written proof of authorization.
Response Time: Within 45 calendar days of receipt. Extensions will be communicated within 45 days, with total response time not exceeding 90 days.
Cost: No fees unless a request is manifestly unfounded or excessive, in which case a reasonable fee may apply or the request may be declined with explanation.
If a privacy rights request is declined, you may appeal by:
If your appeal is denied and you believe there has been an ICDPA violation, you may file a complaint with:
Office of the Indiana Attorney General
Consumer Protection Division
Indiana Government Center South, 5th Floor
302 West Washington Street
Indianapolis, IN 46204
Website: www.in.gov/attorneygeneral
We do not sell personal data. There is no sale to opt out of.
We do not engage in targeted advertising. We do not display advertisements on our platform.
We do not profile consumers in furtherance of decisions that produce legal or similarly significant effects.
Despite the above, we accept formal opt-out requests at support@clothingcorn.com with subject line “Opt-Out Request.” We recognize universal opt-out mechanisms including the Global Privacy Control (GPC) signal.
Serenity Security is built to HIPAA-compliant standards, including encryption at rest and in transit, access controls, audit logging, and secure data handling procedures.
Serenity Security is a business-to-business platform designed for use by organizations and their authorized personnel. It is not directed at individuals under the age of 16.
We do not knowingly collect personal data from children under 16 and will promptly delete such data if discovery occurs. Reports of inadvertent collection should be directed to support@clothingcorn.com.
Material Changes: We will provide at least 30 days’ notice before any material change becomes effective, via email to your account address and a prominent notice on the platform.
Non-Material Changes: Formatting corrections and clarifications will be reflected by updating the “Last Updated” date only.
Continued use of the Service after changes become effective constitutes acceptance. If you disagree with any changes, you should discontinue use and request account deletion.
Detailed In Design LLC
An Indiana Limited Liability Company
Email: support@clothingcorn.com
Website: clothingcorn.com
Parent Company: detailedindesign.com
For privacy-specific requests, use the subject line “Privacy Inquiry.”
© 2024–2026 Detailed In Design LLC. All rights reserved.
© 2024–2026 Serenity Security. All rights reserved.