Privacy Policy

This Privacy Policy describes how Coalesce Solutions, LLC (“Coalesce,” “we,” “us,” or “our”) collects, uses, discloses, and otherwise processes information in connection with Coalesce Report, the scripted and compiled cr collectors, the websites at coalescereport.com and coalesce.report, and related accounts, APIs, and support channels (together, the “Services”).

1. Who we are

Coalesce Report is a product of Coalesce Solutions, LLC, a Delaware limited liability company headquartered in Memphis, Tennessee, United States. Related company sites include coalescesolutions.com.

Privacy inquiries: legal@coalescesolutions.com
General / sales: sales@coalescesolutions.com

2. What this policy covers

This policy applies to:

• Visitors to coalescereport.com, coalesce.report, and Coalesce Report pages on coalescesolutions.com.
• People who create an account, request an API key, subscribe, or contact us about Coalesce Report.
• Customers who submit collector output to Coalesce for analysis, recommendations, drift monitoring, or alerting.

This policy does not apply to:

• Reports, JSON, HTML, or logs that stay on your machines when you use the open-source collector without submitting.
• Third-party sites we link to, including Adobe, AWS, or conference sites.
• Customer applications that we do not operate.

The script-based collector code is licensed separately. Using the local collector does not, by itself, create an account with us or send us data.

3. Controller and processor roles

For account, billing, website, and marketing data about identifiable people (name, work email, company, support tickets), Coalesce is the controller.

For snapshots and other diagnostic content you submit from your ColdFusion estate (“Customer Data”), you are the controller. Coalesce processes that Customer Data as a processor to provide analysis, recommendations, baselines, drift views, and alerts, and as described in a customer agreement or data processing addendum if we have one with you.

Do not submit snapshots that you are not authorized to share. You are responsible for notices and consents required inside your organization, and for keeping secrets, personal data, and regulated data out of submissions except as this policy and your agreement allow.

4. Information we collect

4.1 Information you give us

• Account and contact details: name, work email, company, role, phone if you provide it.
• Authentication material: API keys, session tokens, password hashes we store if the web app uses passwords.
• Billing details handled by our payment processor.
• Support content: tickets, emails, conference follow-ups, sample files you choose to send.
• Preferences: alert destinations, baseline labels, organization settings.

4.2 Information collected automatically on the websites and app

• Log data: IP address, user agent, timestamps, requested URLs, referrer, approximate location derived from IP.
• Account usage: sign-in events, key use, submit events, feature clicks needed to operate the service.
• Cookies or similar storage as described in Section 13.

4.3 Information we do not collect from the free local collector

The scripted collector is designed to inspect the ColdFusion installation root you point it at and emit local JSON plus text/HTML renderings. That output stays on the host unless you submit it. We do not receive local runs.

5. Submitted snapshots (Customer Data)

When you submit with a valid key, or upload a snapshot through the web app, we receive the canonical JSON (and any accompanying metadata you send) produced by the collectors you ran. Depending on which modules are enabled, that may include:

• Environment: ColdFusion version, Java version and vendor, operating system, install and instance paths, discovered instances.
• JVM and process: jvm.config-style settings, service name and status, process metrics, best-effort thread dumps.
• Connectors and server.xml-derived settings.
• Security findings: insecure defaults, debug flags, permission issues, default-credential checks. The collector is specified to redact passwords and connection strings before they leave the box.
• Data source inventory with secrets redacted.
• High-signal log samples (not a full log archive).
• Drift comparisons against a baseline you designate after submit.
• Collector status, finding identifiers, severities, titles, and details.

Snapshots are operational and configuration data about servers. They are not meant to include end-user application data. Log samples and path names can still contain personal data if your estate put it there (user names in URLs, emails in stack traces, file names, host names that identify a person).

6. How we use information

We use information to:

• Provide the Services: accept submits, analyze snapshots, generate guidance, store baselines, compute drift, send alerts you configure, and render dashboards.
• Operate accounts, keys, billing, and access control.
• Secure the service: detect abuse, replay, key leakage, and attacks.
• Improve collectors, finding quality, and the product. We may use de-identified or aggregated patterns (for example “this CF version often ships with this connector default”) to write better checks. We do not sell snapshots.
• Communicate about the product, incidents, and (with a lawful basis or consent where required) relevant Coalesce offerings. You can opt out of marketing emails.
• Comply with law, enforce terms, and protect Coalesce, customers, and the public.

7. Legal bases (EEA, UK, and similar laws)

Where those laws apply, we rely on:

• Contract - to create your account, accept submits, and deliver paid analysis.
• Legitimate interests - to secure the service, understand product use in a B2B context, and improve diagnostics, balanced against your rights.
• Consent - where we use non-essential cookies or optional marketing, and you can withdraw it.
• Legal obligation - when we must keep records or respond to lawful requests.

8. How we share information

We do not sell personal information and we do not sell Customer Data.

We may share information with:

• Service providers who host, store, email, process payments, or provide support tooling. Infrastructure is expected to include Amazon Web Services. Providers may only use the data to perform services for us.
• Your organization - other users on the same company or department can see snapshots and findings you submit to that account.
• Professional advisors under confidentiality (legal, accounting, insurers).
• ISV Support to assist with unknown issues or report bugs found. Any information shared will be de-identified.
• A buyer or successor if we negotiate or complete a merger, financing, or sale of assets, subject to this policy or equivalent protections.
• Authorities when required by law, or when we believe in good faith it is necessary to prevent serious harm or fraud.

We do not use submitted snapshots to train public generative models, and we do not publish your raw JSON.

9. Retention

• Account and billing records: for the life of the account and as long as tax, accounting, or legal rules require after close.
• Submitted snapshots and derived findings: for the subscription term plus a short wind-down period (planned default: 90 days after account closure or snapshot deletion), unless you ask us to delete sooner or law requires longer.
• Support tickets: typically up to 3 years after the ticket closes, unless a longer hold is required.
• Website logs: retained indefinitely.

You may request deletion of a snapshot or of an account. Deletion from backups can lag until those backups rotate.

10. Security

We use administrative, technical, and physical measures appropriate to a diagnostics product that may receive server configuration: access control on keys and accounts, encryption in transit, encryption at rest where the platform provides it, least-privilege access to Customer Data by Coalesce staff, and redaction in the collector before submit.

No method of transmission or storage is perfectly secure. You remain responsible for protecting API keys, for running the collector only on hosts you control, and for reviewing output before submit.

If we become aware of a breach affecting your personal information or Customer Data, we will notify you and regulators as applicable law requires.

11. Your rights

Depending on where you live (including the EEA, UK, Switzerland, and certain U.S. states such as California), you may have the right to:

• Access, correct, or delete personal information we hold as controller.
• Export a copy of that information.
• Object to or restrict certain processing, or withdraw consent.
• Opt out of “sale” or “sharing” of personal information as those terms are defined under state law. We do not sell personal information.
• Appeal a denied request, and lodge a complaint with a supervisory authority.

Send requests to legal@coalescesolutions.com. We will verify the request. If you are an employee of a customer, we may redirect snapshot-related requests to that customer, because they control Customer Data.

We will not discriminate against you for exercising privacy rights.

12. International transfers

We are based in the United States. If you access the Services from another country, your information will be processed in the United States and in any other country where our providers operate. Where required, we use appropriate transfer mechanisms (for example standard contractual clauses) for personal data leaving the EEA, UK, or Switzerland.

13. Cookies and telemetry

The websites and web app may use:

• Strictly necessary cookies or local storage for session, CSRF protection, and load balancing.
• Analytics cookies or first-party events, if enabled, to understand which pages are used. We will identify any third-party analytics vendor in this section when one is installed.

The local collector does not use browser cookies. Optional product telemetry from the CLI, if ever added, will be off unless you opt in; it is not part of the specified Alpha collector.

14. Children

The Services are for organizations running application servers. They are not directed at children under 16, and we do not knowingly collect personal information from children.

15. Changes

We may update this policy. The “Last updated” date will change, and we will post the new version at this URL. If a change is material, we will also notify account contacts by email or in-product notice where we have them. Continued use of the cloud Services after the effective date means you accept the updated policy. For Customer Data processed under a signed agreement, that agreement controls if it conflicts.

16. Contact

Coalesce Solutions, LLC
PO Box 772507
Memphis, TN 38177
legal@coalescesolutions.com
sales@coalescesolutions.com
Web: coalescereport.com · coalescesolutions.com

Back to contents