Privacy Policy
Last updated: 2026-08-21
Light Rider Inc. ("we," "us," or "our") operates Light Rider PQC (the "Service"), available at pqc.lightriderinc.com. The Service includes qSearch, a tool that scans source code, configuration files, and certificate/key files you upload in order to identify quantum-vulnerable cryptography and post-quantum-ready ("PQC") algorithms in your codebase. This Privacy Policy explains how we collect, use, disclose, and protect your personal information, and describes the rights available to you under the EU/UK General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA").
By using the Service, you acknowledge the practices described in this Policy. If you do not agree, please do not use the Service.
1. Who We Are (Data Controller)
Light Rider Inc. is the data controller responsible for your personal information.
Contact details:
Light Rider Inc.
5825 University Research Ct Suite 2000, College Park
MD 20740
Columbia, Maryland
United States
E-mail: info@lightriderinc.com
2. Personal Information We Collect
The Service does not currently require you to create an account, and we do not collect account, profile, or payment/billing information.
| Category | Examples | Source |
|---|---|---|
| Uploaded scan content | The source code, configuration files, or certificate/key files (e.g. .pem, .crt, .cer) contained in the single file or ZIP archive (up to 50 MB) you upload to be scanned by qSearch | Provided directly by you |
| Scan results ("findings") | Output generated by scanning your upload — e.g. algorithm names, classification (quantum-vulnerable / PQC-ready), risk level, the file path within your upload, and a short evidence snippet | Automatically generated from your upload |
| Device & technical data | IP address, operating system, browser type, device identifiers, referring URLs, and standard server/access logs | Automatically collected |
| Location data | Approximate location inferred from your IP address | Automatically collected |
| Communications | Support requests, correspondence, and sales inquiries submitted through our contact form or by email | Provided directly by you |
A note on uploaded content: the files you choose to upload for scanning may contain sensitive material — such as private keys, certificates, credentials, or proprietary source code. We process this content solely to run the scan you requested and generate your findings. We do not review, use, or retain it for any other purpose, and it is deleted automatically as described in Section 7 (Data Retention) below.
Sensitive information: Beyond the cryptographic material that may incidentally appear in files you choose to upload, we do not intentionally collect special-category data (e.g. health or biometric data) unless you voluntarily provide it (for example, in a support request) or applicable law defines a category of data we process as sensitive. Where we do, we rely on your explicit consent.
3. How We Use Personal Information
- Provide and operate the Service, including running the qSearch scan you request and returning findings to you
- Monitor, analyze, and improve the performance, security, and usability of the Service, based on server/access logs (we do not use third-party analytics or tracking tools)
- Enforce upload limits and other technical safeguards on the Service
- Provide customer support and respond to inquiries
- Detect, investigate, and prevent fraud, abuse, and security incidents
- Comply with legal obligations and enforce our Terms of Service
Legal bases for processing (GDPR)
| Purpose | Legal basis |
|---|---|
| Running the scan you request | Performance of a contract / at your request |
| Service monitoring and improvement (via server/access logs) | Legitimate interests |
| Security monitoring and fraud prevention | Legitimate interests / legal obligation |
| Responding to inquiries | Legitimate interests |
| Responding to legal requests | Legal obligation |
4. Cookies and Similar Technologies
The Service does not use cookies, browser local storage, or any similar tracking technology. Because we do not use any cookies, we do not use a cookie consent banner. If this changes — for example, if we introduce account sign-in in the future — we will update this section accordingly.
5. How We Share Personal Information
We do not sell personal information for money, and we do not share personal information with third parties for cross-context behavioral advertising, as those terms are defined under the CCPA.
We disclose personal information only to:
- Hosting/infrastructure providers who host the Service and process requests on our behalf, solely to help us operate the Service
- Professional advisors (legal, accounting) as needed
- Authorities where required by law, regulation, or legal process
- Successors in connection with a merger, acquisition, or asset sale, subject to standard confidentiality obligations
Your uploaded files and scan results are processed on our infrastructure to run your scan and are not shared with any other third party. We require our service providers to protect personal information and to use it only for the purposes we specify, consistent with our contractual and legal obligations (including CCPA service-provider requirements and GDPR Article 28 data processing terms).
6. International Data Transfers
If we transfer personal information from the EEA, UK, or Switzerland to a country not deemed to provide an adequate level of protection, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum, together with supplementary measures as needed.
7. Data Retention
Uploaded files and scan results. The file or archive you upload is extracted and scanned in temporary storage on our servers and is automatically and permanently deleted immediately after the scan completes or fails — typically within minutes, and always as part of the same request. We do not keep a copy of your uploaded content or the resulting findings in any database. Your findings are returned to your browser for you to view and optionally download; once you close or refresh the page, we retain no copy of them.
Other data. Standard server/access logs (e.g. IP address, timestamp, request metadata) are retained for a shorter period, typically no more than 12 months, unless a longer period is needed for security investigations or legal compliance. Records of communications you send us (e.g. support requests) are retained for as long as necessary to address your inquiry and comply with legal obligations. When no longer needed, data is securely deleted or anonymized.
8. Your Privacy Rights
If you are in the EEA, UK, or Switzerland (GDPR)
You have the right to:
- Access the personal information we hold about you
- Rectify inaccurate or incomplete data
- Erase your data ("right to be forgotten"), subject to certain exceptions
- Restrict or object to certain processing
- Data portability — receive your data in a structured, machine-readable format
- Withdraw consent at any time, where processing is based on consent
- Lodge a complaint with your local supervisory authority
Because uploaded scan content and findings are deleted immediately after each scan (see Section 7), there is typically nothing on file for us to access, correct, or erase in connection with a past scan.
If you are a California resident (CCPA/CPRA)
You have the right to:
- Know what personal information we collect, use, disclose, and (if applicable) sell or share, and to request a copy of the specific pieces collected
- Delete personal information we've collected, subject to certain exceptions
- Correct inaccurate personal information
- Opt out of sale or sharing of personal information — not applicable, as we do not sell or share personal information
- Limit use of sensitive personal information — not applicable, as we do not use sensitive personal information beyond what is necessary to provide the Service
- Non-discrimination for exercising any of these rights
- Designate an authorized agent to submit requests on your behalf
Categories of personal information collected/disclosed in the past 12 months (CCPA categories): Identifiers (IP address); internet/network activity (device and log data); geolocation data (approximate); and any information you provide through correspondence with us (e.g. name, email, and message content submitted via our contact form or by email). We do not sell or share this information.
How to exercise your rights
Submit a request to info@lightriderinc.com or via Contact form. We will verify your identity before fulfilling requests and will respond within the timeframes required by applicable law (generally 30 days for GDPR, 45 days for CCPA).
9. Children's Privacy
The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us so we can delete it.
10. Security
We implement technical and organizational measures — including encryption in transit, prompt deletion of uploaded content and scan results after each scan, upload size limits, access controls, and regular security reviews — designed to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. Changes to This Policy
We may update this Policy from time to time — including as we add new features to the Service, such as accounts or additional scanning capabilities. We will post the revised version with an updated "Last updated" date and, where changes are material, provide additional notice (e.g. email or in-product notification).
12. Contact Us
Questions about this Policy or our data practices? Contact us at info@lightriderinc.com.