Privacy Policy

Personal Data You Provide:

• Email Address: When you subscribe to our Daily Threat Bulletin or create an account
• Account Information: If you create an account via Auth0, we receive your email and basic profile information
• Preferences: Keywords and interests you set to personalize your threat feed
• Payment Information: When you subscribe to a paid plan, payment details are collected and processed by Stripe. We do not store your full card details.

Information Collected Automatically:

• Usage Data: Pages visited, time spent on pages, and general interaction patterns
• Device Information: Browser type, operating system, and device type
• IP Address: For security and fraud prevention purposes

We use the information we collect to:

• Send you the Daily Threat Bulletin if you subscribed
• Personalize your threat intelligence feed based on your preferences
• Provide and maintain our Service
• Process payments and manage your subscription
• Improve and optimize our platform
• Communicate with you about service updates
• Detect and prevent fraud or abuse
• Track affiliate referrals for our partner program

Under GDPR, we process your personal data based on the following legal grounds:

• Consent: When you subscribe to our email digest or create an account
• Contract: To provide the services you requested
• Legitimate Interest: To improve our services and ensure security

We use the following third-party services that may process your data:

Authentication & Account:

• Auth0: Authentication and account management. Processes your email and login credentials.

Payment Processing:

• Stripe: Payment processing for subscriptions. Processes your payment method, billing address, and transaction details. We do not store your full card number. See Stripe's Privacy Policy.

Analytics & Marketing:

• PostHog (Analytics — loaded only with your consent): Product analytics (EU-hosted). Records which features you use, page views within the platform, and a pseudonymous identifier so we can measure adoption, fix usability issues, and improve the product. We do not send your plaintext email to PostHog; we send only your account ID and the domain part of your email (e.g. example.com). See PostHog's Privacy Policy.
• Google Ads / Tag Manager (Advertising — loaded only with your consent): Advertising and conversion tracking to measure ad performance, loaded via Google Tag Manager. May track your browsing across sites.
• Apollo.io (Visitor identification — loaded only with your consent): Identifies the organisation (and, for U.S. visitors, the individual) visiting our site, so our team can follow up with relevant businesses. This shares visitor data with Apollo and its identity partner LiveIntent. See Apollo's Privacy Policy and LiveIntent's Privacy Policy.
• Umami Analytics (Essential — no consent required): Privacy-friendly, cookieless website analytics. Collects no personal data and sets no cookies; visitor IP addresses are anonymised. Because it is cookieless and non-identifying, it runs without requiring consent. See Umami's Privacy Policy.
• Rewardful: Affiliate tracking to attribute referrals. Uses cookies to track which affiliate referred you. See Rewardful's Privacy Policy.

Infrastructure & Communications:

• DigitalOcean: Cloud hosting, database services, and caching infrastructure.
• Postmark: Email delivery for our Daily Threat Bulletin and transactional emails.
• OpenAI: AI processing for generating threat summaries (no personal data is sent to OpenAI).

These providers have their own privacy policies and are GDPR-compliant. We only share the minimum data necessary for them to provide their services.

We retain your personal data only as long as necessary:

• Email Subscriptions: Until you unsubscribe
• Account Data: Until you delete your account
• Payment Records: As required by law for tax and accounting purposes (typically 7 years)
• Usage Logs: Up to 90 days for security purposes

When you unsubscribe or delete your account, we will delete your personal data within 30 days, unless we are required to retain it for legal purposes.

If you are in the European Economic Area (EEA), you have the following rights:

• Right to Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time for consent-based processing

To exercise any of these rights, please contact us using the information below. We will respond to your request within 30 days.

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (TLS/SSL)
• Encrypted database connections
• Regular security assessments
• Access controls and authentication

However, no method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Your data may be transferred to and processed in countries outside your country of residence, including the United States. When we transfer data outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

We use the following types of cookies and tracking technologies:

• Essential Cookies: Necessary for authentication, session management, and core functionality. These cannot be disabled. Includes a cookieless first-party analytics tool (Umami) that sets no cookies and collects no personal data.
• Analytics (requires consent): PostHog product analytics. A first-party cookie tc_aid (a random identifier, no personal data, 2-year lifetime) plus PostHog's own ph_-prefixed cookies measure how the platform is used and stitch your activity across page loads. Loaded only after you consent to the "Analytics" category.
• Advertising (requires consent): Google Ads conversion tracking, loaded via Google Tag Manager, to measure advertising effectiveness. May track your browsing across sites. Loaded only after you consent to the "Advertising" category.
• Visitor identification (requires consent): Apollo.io (and its partner LiveIntent) identify the organisation — and, for U.S. visitors, the individual — visiting our site, and share that data with those providers. Loaded only after you consent to the "Visitor identification" category.
• Affiliate Cookies: Rewardful uses cookies to track affiliate referrals. These store a referral ID when you arrive via an affiliate link, used to attribute your subscription to the referring affiliate. Typically expire after 30-90 days.

When you first visit, a consent banner lets you Accept all, Reject all, or Manage each category individually. Nothing in the Analytics, Advertising, or Visitor-identification categories loads until you consent to it. You can change or withdraw your choices at any time using the cookie settings link, or through your browser settings. For more about Google's privacy practices, visit Google's Privacy Policy.

Our Service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately and we will delete it.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new "Last updated" date. For significant changes, we may also notify you via email if you have an account.

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:

Contact Page

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.