Privacy Policy

1. Scope and Custodial Relationship

This Policy applies to personal, corporate, and technical data collected directly by Bunoyo or processed on behalf of our clients in the performance of contracted IT management and support. With respect to client business records, accounting databases, proprietary files, and internal communications residing on client networks, Bunoyo acts strictly as an infrastructure steward and data custodian. Bunoyo claims no ownership interest in client files or proprietary business materials.

2. Information We Collect

In order to diagnose outages, deploy operating system patches, monitor network perimeters, and perform preventative IT administration, Bunoyo collects information classified into the following categories:

2.1 Contact and Business Account Records

When you request a consultation, execute a service agreement, or contact our support desk, we collect business contact details, including your full name, title, corporate email address, business telephone number, physical office address, and billing contact information.

2.2 Hardware and Technical Telemetry

Our remote monitoring and management (RMM) endpoint agents collect technical telemetry required to preserve system uptime and prevent security vulnerabilities. This includes:

• Hardware model, serial numbers, processor specifications, storage capacity, and memory utilization;
• Operating system build numbers, software license identifiers, installed applications, and patch levels;
• Local network connection states, private and public IP addresses, MAC addresses, and DNS configuration;
• Antivirus definition updates, endpoint detection and response (EDR) event logs, and firewall activity flags.

2.3 Administrative Credentials

Where authorized in writing by client executive management, Bunoyo maintains encrypted administrative credentials (such as domain administrator accounts, cloud tenant access keys, and network router credentials) necessary to execute maintenance, provision user accounts, and resolve technical incidents.

2.4 Operational and Communications Data

We retain records of support tickets, technician work notes, communications transmitted via [email protected] or web forms, and cryptographically timestamped remote session logs documenting technician access.

3. Permitted Uses of Information

Bunoyo uses collected information exclusively for legitimate commercial, technical, and operational objectives, specifically:

• Delivering prompt remote and on-premise IT maintenance with an average response time under 5 minutes;
• Automating security patch deployments and remediating active cyber threats or malware alerts;
• Configuring and verifying encrypted local and off-site cloud backups;
• Provisioning business email systems, cloud storage tenants, and business VoIP telephony lines;
• Generating transparent invoices and managing flexible monthly, weekly, or project-based billing accounts;
• Validating compliance baselines against NIST SP 800-171, CMMC Level 1, and FTC Safeguards Rule requirements;
• Complying with applicable statutory, regulatory, and legal recordkeeping mandates.

4. Prohibition on the Sale or Monetization of Data

Bunoyo maintains a strict policy regarding data commercialization:

5. Disclosures to Authorized Service Providers

Bunoyo discloses information only to verified third-party entities strictly necessary to fulfill contracted IT deliverables:

• Cloud and Platform Partners: Enterprise infrastructure providers (including Microsoft 365, Amazon Web Services, Anthropic Claude integration tooling, and Lenovo enterprise channels) configured specifically for client environments under applicable enterprise licensing agreements;
• Payment Facilitators: Payment gateways certified under PCI-DSS standards utilized solely to process authorized electronic invoice payments;
• Judicial and Law Enforcement Requests: Bunoyo will disclose records only when compelled by valid subpoena, court order, or binding government statutory authority, providing prompt notice to the affected client where legally permitted.

6. Information Security and Cryptographic Controls

Bunoyo implements defense-in-depth security measures designed to safeguard technical and corporate data against unauthorized access, loss, alteration, or destruction:

• Transport Layer Security: All data transmitted between client endpoints, management servers, and cloud repositories utilizes TLS 1.3 or equivalent industry cryptographic standards;
• Encryption at Rest: Stored backups, configuration files, and credential repositories are encrypted using AES-256 bit encryption algorithms;
• Mandatory Multi-Factor Authentication: MFA is strictly enforced across all internal technician accounts, management portals, and client administrative consoles;
• Role-Based Access Partitioning: Technicians are restricted to least-privilege permissions required to resolve specific assigned service tickets;
• Remote Session Auditing: Remote desktop connections require explicit user consent or prior written authorization for unattended service windows, generating immutable session records.

7. Defense Contractor and Government Supplier Standards

Bunoyo is actively registered in SAM.gov and adheres to cybersecurity standards applicable to the defense industrial base and government subcontractors, including CMMC Level 1 and NIST SP 800-171 controls. When handling systems containing Federal Contract Information (FCI):

• Access to FCI systems is logically and physically partitioned from unauthorized commercial networks;
• Technicians assigned to defense environments undergo security vetting and verification;
• Incident response workflows align with Department of Defense reporting guidelines.

8. Data Retention, Transition, and Cryptographic Sanitization

Bunoyo retains operational records only for the duration necessary to satisfy ongoing service commitments, maintain legitimate tax and accounting archives, and comply with statutory retention laws.

Upon termination of services, Bunoyo will securely transfer all administrative credentials, domain records, and network configuration documentation to the client's designated successor. Decommissioned storage media processed by Bunoyo undergo cryptographic sanitization or physical destruction in strict conformance with NIST SP 800-88 standards, with written certificates of destruction issued upon request.

9. Client Rights and Data Inquiries

Clients and designated account administrators hold the right to inspect, verify, update, or request the deletion of account records maintained by Bunoyo. Inquiries regarding data processing, access requests, or regulatory validation may be submitted in writing to [email protected].

10. Modifications to This Policy

Bunoyo reserves the right to amend this Privacy Policy to reflect modifications in operational practices, evolving cybersecurity frameworks, or applicable state and federal statutes. All updates shall become effective immediately upon posting to this URL, marked with a revised effective date.