Data Privacy Policy

1. Introduction

Larx, Inc. ("the Company," "we," "us," or "our") operates a geospatial monitoring and decision-intelligence platform for infrastructure operators, utility operations teams, and environmental monitoring teams. The platform fuses satellite imagery, live camera feeds, and SCADA sensor data into a coordinate-indexed spatial stream to help customers detect encroachment, change events, and sensor anomalies.

This Privacy Policy describes how the Company collects, uses, retains, and protects information in connection with golarx.com and the Company's platform and related services. Customers connect their own infrastructure data feeds, and the Company processes those feeds to generate spatial alerts, reports, and audit-log exports.

2. What We Collect

The Company collects and processes the following categories of information in connection with the platform:

• Spatial and infrastructure data: spatial coordinates and coordinates associated with monitored infrastructure assets.
• Satellite imagery: satellite imagery files, including GeoTIFF files and multitemporal SAR and optical rasters.
• Camera feed metadata: metadata associated with live RTSP and ONVIF camera feeds connected by customers.
• SCADA sensor readings: equipment readings received through Modbus and DNP3 protocols.
• Alert event records: records concerning detected encroachment, change events, sensor anomalies, alerts, and related spatial reports.
• User account data: a user's name, work email address, and organization information.
• Usage analytics: information about how users interact with the platform, including activity associated with platform features and account usage.

Customers are responsible for determining what infrastructure data feeds they connect to the platform. The Company processes customer-submitted satellite imagery, spatial coordinates, camera feed metadata, and SCADA sensor readings to provide the requested monitoring and reporting services.

The Company does not use customer-submitted infrastructure imagery or sensor data to train machine-learning models without explicit written consent.

3. How We Use Information

The Company uses the data described above for the following business purposes:

• Operating the platform and maintaining customer connections to satellite imagery, camera feeds, and SCADA data sources.
• Indexing spatial coordinates and infrastructure assets within a common spatial stream.
• Detecting encroachment, change events, and sensor anomalies in customer-submitted infrastructure data.
• Generating spatial alerts, change-detection reports, and other spatial reports for infrastructure operators, utility teams, and environmental monitoring programs.
• Producing exportable audit logs and change reports that customers may use to support their compliance workflows, including workflows related to NERC CIP or EPA reporting requirements.
• Managing user accounts, organizations, subscriptions, and platform access.
• Understanding usage of platform features and improving the operation of the service.
• Protecting the platform, investigating misuse, and complying with applicable legal obligations.

The Company itself is not a regulated entity under NERC CIP or FERC or EPA frameworks. Customer use of exportable audit logs and change reports does not constitute a representation that the Company or its platform has a certification under any such framework.

4. How We Share Information

The Company does not sell personal information and does not sell or otherwise transfer customer-submitted infrastructure imagery to third parties for their own purposes. The Company may share or make information available in the following limited circumstances:

• At a customer's direction: when a customer authorizes access, exports a report, connects an integration, or otherwise directs the Company to provide data or platform outputs.
• Service providers: with vendors that support hosting, infrastructure, security, communications, analytics, or other functions necessary to operate the platform. These providers receive information only as needed for their assigned services.
• Legal and safety purposes: when reasonably necessary to respond to legal process, enforce agreements, protect the platform, or protect the rights, safety, or property of the Company, customers, users, or others.
• Business transactions: in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to applicable confidentiality and legal requirements.

The Company does not use customer-submitted infrastructure imagery or sensor data for machine-learning model training without explicit written consent.

5. Cookies and Usage Analytics

The Company may use cookies and similar technologies that are necessary to operate golarx.com and the platform, maintain sessions, support account access, and protect the service. The Company may also use usage analytics to understand how infrastructure operators, utility teams, and environmental monitoring users interact with platform features and reports.

Depending on browser and device settings, users may be able to limit or delete cookies. Disabling necessary cookies may affect access to account and platform functions. The Company does not use cookies to sell customer-submitted satellite imagery, SCADA sensor readings, spatial coordinates, or camera feed metadata.

6. Data Retention

The Company retains information for as long as needed to provide the platform, support customer-selected workflows, meet legal obligations, resolve disputes, and enforce agreements. Retention for the principal platform data types is as follows:

• Satellite imagery files: retained according to the customer's data retention setting, with a default retention period of 24 months.
• SCADA stream data: aggregated after 90 days.
• Alert records: retained for the subscription term plus 12 months.
• User account data: deleted upon account closure.

Customer-specific retention settings may affect how long satellite imagery files remain available. Retention of spatial reports, audit logs, camera feed metadata, and other platform records may also depend on the customer's subscription, configuration, and operational requirements.

7. Security

The Company maintains administrative, technical, and physical safeguards intended to protect user account data, spatial coordinates, satellite imagery files, camera feed metadata, SCADA sensor readings, alert records, and usage analytics against unauthorized access, alteration, disclosure, or destruction.

Customers are responsible for configuring access to their connected infrastructure data feeds, selecting appropriate users and organizations, and protecting credentials used to access the platform. No method of transmission or storage can be guaranteed to be completely secure.

8. General Privacy Rights

Depending on where you live and your relationship with the Company, you may have rights to request access to, correction of, deletion of, or a portable copy of personal information associated with your user account. You may also have rights concerning certain uses of personal information. These rights may be limited by applicable law and by the Company's need to maintain customer infrastructure records, alert event records, audit logs, or other information necessary to provide the service and meet legal obligations.

To submit a privacy request, contact the Company at [email protected]. The Company may need to verify your identity and account relationship before completing a request. A request concerning customer-submitted satellite imagery, SCADA sensor readings, spatial coordinates, or camera feed metadata may need to be handled through the relevant customer organization because that organization controls the connected infrastructure data.

9. Virginia Residents (VCDPA)

Under the Virginia Consumer Data Protection Act ("VCDPA"), Virginia residents have rights with respect to personal data we control or process. This section supplements the rest of the Policy.

9.1 Your VCDPA Rights

• Right to Confirm and Access: confirm whether we are processing your personal data and access that data.
• Right to Correct: correct inaccuracies in your personal data, taking into account the nature of the data and our processing purposes.
• Right to Delete: request deletion of personal data provided by, or obtained about, you.
• Right to Data Portability: obtain a copy of your personal data in a portable, readily usable format, where technically feasible.
• Right to Opt Out: opt out of (a) targeted advertising, (b) the sale of personal data, and (c) profiling in furtherance of decisions that produce legal or similarly significant effects. We do not engage in (a), (b), or (c).

9.2 How to Exercise

Submit a request by emailing [email protected]. We respond within 45 days; an additional 45-day extension is available if reasonably necessary, with notice to you.

9.3 Appeal

If we deny your request, you may appeal by replying to our response email. We will respond to the appeal within 60 days. If the appeal is denied, you may contact the Virginia Attorney General at oag.state.va.us to submit a complaint.

9.4 Authorized Agents

You may use an authorized agent for opt-out requests, subject to our verifying the agent's authority.

10. California Visitors

If you are a California resident visiting from another state, you may also exercise the rights granted under the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"), including the right to know, the right to delete, the right to correct, and the right to opt out of sale or sharing. We do not sell personal information and do not "share" personal information for cross-context behavioral advertising.

To submit a CCPA / CPRA request, email [email protected] with the subject line "California Privacy Request."

11. Changes to This Policy

The Company may update this Privacy Policy to reflect changes to the platform, including changes to how the Company processes satellite imagery, camera feed metadata, SCADA sensor readings, spatial coordinates, alert records, user account data, or usage analytics. When the Company updates this Policy, it will revise the Last updated date above. The updated Policy will apply from the date posted unless a different effective date is stated.

12. Contact

Questions or privacy requests may be sent to: