Privacy Policy

Effective [EFFECTIVE DATE]

This policy says what personal data [COMPANY LEGAL NAME] ([COMPANY ADDRESS], [PRIVACY EMAIL]) processes, why, and what you can do about it. It covers two different roles.

• As controller, for people who visit this website, create an account or use the dashboard (section 1).
• As processor, for the visitors of our customers' sites and apps, whose data we process only on our customers' instructions (section 2). For those, the customer is the controller and their privacy notice applies; ask them first.

1. Our website and our customers' accounts

Account data: name, work email address, a password stored only as a salted hash, second factors and passkeys, the organizations you belong to and your role. Used to provide the account, keep it secure and contact you about it. Legal basis: the contract, and our legitimate interest in security.

Sign-in and security records: the address and browser of each session, and an audit log of security-relevant actions. Used to secure accounts and to show you who did what. Legal basis: legitimate interest in security; kept for as long as the organization exists, and an account's sessions end with it.

Protecting sign-up and sign-in: the pages where accounts are made and signed in to run our own agent, as our customers' pages do, and each sign-up and sign-in is assessed by our own service before it goes ahead, so that accounts are not made or broken into by scripts. What is recorded is processed as in section 2, in our own organization. Legal basis: legitimate interest in security, and the steps you asked for in signing up or in.

Billing data: handled by Stripe, our payment processor; we keep the customer and subscription identifiers Stripe gives us, never card numbers.

The live demonstration: the marketing pages can identify your browser as our customers' pages do and show you the result — only when you press Identify this browser (see the cookie notice). What it records is processed as in section 2, in our own organization, and kept for seven days.

Email: sent through Resend for verifications, password resets, invitations and alerts you set up.

2. Data we process for our customers

When a customer places our agent or SDKs in their site or app, we process, for them:

• The request: IP address (or, if the customer turns it on, only a keyed digest of it — the address itself is never written down), User-Agent and other request headers, and the TLS handshake as their edge reports it.
• The device: characteristics of the browser or app and the device it runs on — rendering, fonts, screen, hardware and platform details — from which a visitor identifier is derived.
• Behaviour on the page: how the pointer moves, timing between key presses and releases (never which keys), clicks and scrolling, used to tell a hand from a script.
• What the customer chooses to send for an assessment: an account identifier, email address, card fingerprint, phone number or a message. These are turned into keyed digests in memory and never stored as sent; a message is kept for two hours as a short sketch from which its text cannot be recovered.

It is used only to identify devices, detect automation and abuse, and give the customer its results. It is stored in the region the customer chose (United States, European Union or Asia-Pacific) and deleted after the retention the customer sets (between one day and ten years). Counts that name no one (how many identifications an hour, from which browsers and countries) are kept 30 days for the customer's dashboard. Where a customer takes part in network reputation, digests of addresses that misbehaved on its sites help protect other customers; the address itself is not shared.

3. Who else processes it

Our sub-processors, each under an agreement that holds them to this policy: the hosting and database provider ([HOSTING PROVIDER, e.g. Amazon Web Services, Inc.]), Stripe (payments), Resend (email) and, where a deployment looks addresses up with one rather than in databases on its own servers, an IP geolocation provider ([IP GEOLOCATION PROVIDER: ipinfo.io, or ipapi.co; none]), which receives the address alone. Where a customer has us read its Android app's Play Integrity verdicts with its own Google account, the verdict is read through Google under the customer's agreement with it. The current list is kept at [SUBPROCESSORS URL]. We do not sell personal data.

4. Transfers

Customer data stays in the region the customer chose. Account data for our own operations may be processed in the United States; where it leaves the European Economic Area or the United Kingdom, it is protected by the European Commission's standard contractual clauses or an adequacy decision.

5. Your rights

You can ask for access to, correction or deletion of your personal data, its restriction, its portability, or object to its processing; you can download your account's data and delete your account from the dashboard's Security page yourself. When an account is deleted we keep one thing: a keyed digest of its inbox, saying only that the inbox has had its free trial, so that deleting and signing up again does not start another (our legitimate interest in a fair trial); it cannot be turned back into the address. If you are a visitor of one of our customers' sites, contact that customer; we will help them answer you. You can complain to your data protection authority.

6. Security

See the security page.

7. Changes and contact

We announce material changes on this page and, to account holders, by email. Questions: [PRIVACY EMAIL]. [DPO, IF APPOINTED: name and contact]. [EU/UK REPRESENTATIVE, IF REQUIRED].