ROCHESTON ZELSAFE PRIVATE DASHBOARD (ZPD) PRIVACY POLICY — FULL VERSION Effective date: August 2026 Policy version: 1.0 Applies to: ZelSafe Private Dashboard for macOS (Mac App Store) and self-hosted ZPD deployments (including the official Docker distribution) Publisher: Rocheston, New York — rocheston.com PLAIN-LANGUAGE SUMMARY Rocheston collects zero data from ZPD. Rocheston transmits zero data to Rocheston servers. Rocheston transmits zero data to third parties. Zero means zero. There is no fine print in this document that walks any of it back. Everything ZPD stores lives on your Mac or on the server your organization operates, under your exclusive control. Training evidence lives on your server. Not ours. Rocheston cannot lose, sell, leak, mine, profile, or be compelled to hand over data it never possesses. 1. SCOPE AND DEFINITIONS "ZPD" or "the app" means the ZelSafe Private Dashboard application, whether installed from the Mac App Store or deployed self-hosted by your organization. "Rocheston," "we," "us" means Rocheston, the publisher of ZPD. "You" and "your organization" mean the company, institution, or administrator that installs and operates a ZPD instance. "Learner" means a person who completes ZelSafe training on their own device. "Evidence file" means the cryptographically signed audit JSON a learner's device generates after training, containing completion evidence, certificate metadata, engagement metrics, timestamps, and verification data. "Your Data" means everything a ZPD instance stores: evidence files, the local database, settings, and generated reports. This policy describes what Rocheston does — and, more importantly, what Rocheston's software is built to be incapable of doing. It is provided for transparency and does not constitute legal advice to your organization. 2. WHAT ZPD DOES ZPD is Rocheston's employer-side compliance-evidence application for ZelSafe cybersecurity awareness training. The flow has five steps and one direction of travel: 1. A learner completes ZelSafe training privately on their own device. Training data remains on that device. 2. The learner's device generates a signed evidence file, sealed with a digital signature so tampering can be detected. 3. The learner deliberately submits that file directly to your organization's ZPD instance. The submission travels to your machine, on your network — never to Rocheston. 4. ZPD verifies the file locally — structure, required evidence, and ECDSA P-256 signature — and rejects invalid, incomplete, or tampered records before they appear anywhere. 5. Authorized administrators generate dashboards, reports, rosters, certificate records, and auditor evidence packages, all produced and stored locally. One design principle governs the product: training happens on the learner's device, evidence goes directly to the employer, and Rocheston never touches it. Every section below follows from that. 3. INFORMATION ROCHESTON COLLECTS: NONE ZPD contains no account system connected to Rocheston, no Rocheston sign-in, no registration, no license activation that reports to us, and no hidden identifiers. Measured against Apple's App Privacy ("nutrition label") categories, ZPD's disclosure is Data Not Collected — in every category: - Contact information: not collected - Health and fitness: not collected - Financial information: not collected - Location (precise or coarse): not collected - Sensitive information: not collected - Contacts: not collected - User content: not collected by Rocheston (Your Data stays on your machine; see Section 6) - Browsing history: not collected - Search history: not collected - Identifiers (user ID, device ID, advertising ID): not collected - Purchases: not collected (Apple processes App Store transactions; see Section 12) - Usage data (product interaction, analytics): not collected - Diagnostics (crash data, performance data): not collected by Rocheston - Other data: not collected There is no analytics framework, no telemetry, no event logging to any external party, no advertising SDK, no cookies, no beacons, no pixels, and no fingerprinting anywhere in the product. There is no Rocheston learner-data cloud. One does not exist for this product. 4. INFORMATION ROCHESTON TRANSMITS: NONE The app initiates no connection to Rocheston's servers and no connection to any third-party service. Specifically, ZPD makes: - No calls to Rocheston infrastructure — no sync, no backup, no license pings, no update beacons - No calls to analytics, crash-reporting, or advertising endpoints - No calls to content-delivery networks - No loading of remote fonts, scripts, styles, or assets — everything ZPD needs ships inside the app Prove it yourself: disconnect your Mac from the internet. Every ZPD feature — receiving evidence, verification, dashboards, reports, exports, the auditor package — continues to work, because none of it ever depended on us. 5. NETWORK ACTIVITY, PRECISELY DESCRIBED ZPD's only network behavior is receiving: a learner deliberately submits an evidence file to the ZPD endpoint your organization operates, over your own network. That transmission runs from the learner's device to your machine. Rocheston is not in the path, is not a recipient, and is not a processor of that transmission. ZPD initiates no outbound connections of its own. 6. WHERE YOUR DATA LIVES, AND WHO OWNS IT All of Your Data is stored locally — on your Mac in the app's private local storage, or, for self-hosted deployments, in the storage volume your organization provisions. ZPD uses embedded local storage (SQLite); no external database service is required or contacted. Original evidence files are preserved as submitted, alongside their verification results. You own Your Data completely. You can search it, export it, back it up, archive it, or delete it at any time using your own tools and the app's own functions. Removing ZPD's data removes everything, because no copy exists anywhere else. Rocheston holds no key, no mirror, no backup, and no access of any kind. Because Rocheston receives and processes no personal data through ZPD, Rocheston does not act as a data controller or a data processor for Your Data. Your organization is the sole owner and controller of the evidence it chooses to receive and retain, under its own policies and applicable law. 7. LEARNER EVIDENCE AND ITS PROTECTION Evidence enters ZPD one way only: deliberate, learner-initiated submission. ZPD then protects the integrity of what you hold: - Every evidence file is verified locally using ECDSA P-256 digital signatures; records that fail verification, are incomplete, or show tampering are rejected before they appear in any dashboard or report. - Administrator credentials and upload PINs are stored hashed, never in plain text. - Repeated failed submission attempts are rate-limited. - Evidence governance favors auditability: records are archived rather than silently destroyed, submission attempts are logged locally, and original signed files are retained with their verification results — all on your infrastructure, visible only to your administrators. What your organization does with verified evidence — retention periods, internal review, disclosure to auditors or assessors — is your organization's decision as the data's owner. 8. YOUR ORGANIZATION'S RESPONSIBILITIES Because Your Data exists only in your deployment, responsibilities that privacy laws attach to holding employee data rest with your organization: establishing a lawful basis for collecting training evidence from your workforce, setting retention rules, securing the host system, controlling administrator access, and answering your employees' questions about the evidence you hold. ZPD gives you the tools — verification, access control, archiving, exports — and stays out of the data itself. 9. LEGAL FRAMEWORKS (GDPR, UK GDPR, CCPA/CPRA, AND SIMILAR LAWS) Rocheston's position under data-protection law is simple because the architecture makes it simple: - GDPR / UK GDPR: Rocheston receives no personal data through ZPD, performs no processing of Your Data, and makes no international transfers of it. Data-subject requests concerning training evidence (access, correction, deletion) should be directed to the organization that holds the evidence — we cannot access, correct, or delete data we do not have. - CCPA / CPRA: Rocheston does not sell personal information and does not share it for cross-context behavioral advertising. Through ZPD, Rocheston never receives personal information in the first place. - Other regimes (PIPEDA, LGPD, PDPA, and similar): the same architectural fact applies — no data reaches Rocheston, so no Rocheston processing obligations arise. Obligations concerning evidence stored in your deployment rest with your organization as its owner. 10. DATA RETENTION By Rocheston: nothing is retained, because nothing is collected. There is no retention schedule to publish for data that never exists on our side. By you: retention of Your Data follows your organization's own policies. ZPD supports your schedule with archiving, exports, and complete local deletion. 11. DATA BREACH POSTURE A vendor-side breach of your training evidence is architecturally impossible at Rocheston, because the evidence does not exist at Rocheston. There is no central honeypot of learner data to steal. The security of your ZPD host — like any system your organization runs — remains your organization's responsibility, and ZPD is built to make that job smaller: local storage, signed evidence, hashed credentials, and no vendor connectivity creating an external attack surface. 12. THE MAC APP STORE If you obtain ZPD through the Mac App Store, your purchase, download, and any device diagnostics you have enabled are handled by Apple under Apple's own terms and privacy policy, according to your settings with Apple. Rocheston receives no personal data from that process. 13. macOS PERMISSIONS ZPD requests no access to your camera, microphone, location, contacts, calendars, or photos. File access occurs only through the standard macOS open and save panels when you choose to import or export something. The app operates within Apple's security model for Mac App Store software. 14. SELF-HOSTED AND DOCKER DEPLOYMENTS The self-hosted ZPD distribution follows this same policy: it runs entirely on infrastructure you control, stores everything in the private storage volume you provision, and initiates no connections to Rocheston. A transparent Software Bill of Materials for the distribution is published at rocheston.com/zelsafe/sbom so your security and procurement teams can verify exactly what ships in the product. 15. CHILDREN ZPD is a professional workplace tool. It collects no data from anyone — adult or child. 16. CHANGES TO THIS POLICY This policy describes how ZPD is built, not merely what we promise. Data collection is not switched off in ZPD — it was never built in, and adding it would mean rebuilding the product. If this policy is ever revised, the updated version will be published with a new effective date and version number. The zero-collection, zero-transmission architecture is the product's foundation and its competitive position; it is not subject to quiet erosion. 17. CONTACT Questions about this policy or ZPD's privacy architecture: contact Rocheston through rocheston.com. Your evidence. Your Mac. Your control. Rocheston collects nothing, transmits nothing, and retains nothing — by design. © 2026 Rocheston. All rights reserved. ZelSafe™, ZelCards™, Zelka™, RCCS™, and ZelSafe Private Dashboard are trademarks of Rocheston.