Privacy Policy

This Privacy Policy describes how The Iceberg Co LLC ("Iceberg," "we," "us," or "our") collects, uses, and shares information when you visit our websites or use our Subzero Services. Our principal place of business is 30 N Gould Suite N, Sheridan, WY 82801.

If you have questions or concerns, please contact us at legal@theicebergcompany.com.

1. Information We Collect

Information you provide directly

• Account information — name, email address, and password when you create an account
• Billing information — payment card details and billing address, processed via our third-party payment processor
• Communications — messages you send us via email or support channels

Information collected automatically

• Usage data — API call volumes, feature usage, error logs, and performance metrics
• Log data — IP address, browser type, operating system, referring URLs, and timestamps
• Cookies and similar technologies — session cookies required for authentication and preference cookies to remember your settings

Customer Data

Subzero is designed so that your sensitive plaintext data never reaches our infrastructure. Encryption keys remain in your own cloud KMS. What we may receive are tokenized or ciphertext values — which, by design, cannot be reversed without a live call to your KMS. We do not read, sell, or analyze Customer Data for any purpose other than providing and maintaining the Services.

2. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Services
• Create and manage your account and process payments
• Respond to your requests, questions, and support tickets
• Send transactional emails such as account confirmations and usage alerts
• Monitor usage patterns to improve reliability and performance
• Detect, investigate, and prevent fraudulent or unauthorized activity
• Comply with legal obligations

We do not use your data to train machine learning models or sell it to third parties for advertising.

3. How We Share Information

We may share your information with:

• Service providers — third-party vendors who assist with hosting, payment processing, analytics, and customer support, under confidentiality obligations
• Business transfers — in connection with a merger, acquisition, or sale of assets, with appropriate notice to you
• Legal requirements — when required by law, court order, or government authority, or to protect the rights, property, or safety of Iceberg or others

We do not sell, rent, or trade your personal information to third parties.

4. Data Retention

We retain account information for as long as your account is active and for a reasonable period thereafter to comply with legal obligations and resolve disputes. Usage logs are retained for up to 90 days. You may request deletion of your account and associated data at any time by contacting legal@theicebergcompany.com.

5. Security

We implement industry-standard technical and organizational measures to protect your information, including encryption in transit (TLS) and at rest. However, no method of transmission over the internet is completely secure. You are responsible for keeping your account credentials confidential.

6. Cookies

We use strictly necessary cookies to maintain your authenticated session and remember your preferences. We do not use third-party advertising cookies. You can configure your browser to refuse cookies, but some features of the Services may not function correctly without them.

7. Your Rights

Depending on your location, you may have rights regarding your personal information, including the right to access, correct, or delete data we hold about you, and the right to object to or restrict certain processing. To exercise these rights, contact us at legal@theicebergcompany.com. We will respond within the timeframe required by applicable law.

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete it, and the right to opt out of the sale of personal information. We do not sell personal information.

8. Children's Privacy

The Services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

9. International Transfers

Our Services are operated in the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Services, you consent to this transfer.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by posting the updated policy on our website and updating the effective date. Your continued use of the Services after the effective date constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact: