Privacy Policy

1. Who we are and what this policy covers

This Privacy Policy explains how ThreatLark (“ThreatLark”, “we”, “us”) handles personal information when you visit this website (the “Site”) or contact us about a demo, a purchase or a question. For the personal information described in this policy, ThreatLark acts as the controller (or, under California law, the “business”).

This policy applies to the Site and to correspondence with us. It does not cover the ThreatLark software that you run in your own environment; section 8 explains how that software relates to the Site and to us.

2. Information we collect

We keep the information we collect to the minimum needed to run the Site and to answer you.

Information you send to us

The demo request form collects the details you type into it: your name, work email address, company, role, environment, the areas you would like to see and any free-text message. The form does not send data to a web server. When you press Send demo request, it opens your own email client with these details pre-filled and addressed to sales@threatlark.com. Nothing is sent to us until you send that email yourself. You can also email us directly without using the form.

When you email us, we receive your email address, any name and signature details you include, the content of your message and the usual technical email headers. Please include business contact details only, and do not send scan results, credentials, or other sensitive data.

Technical information

Like any website, the server that delivers the Site may automatically record technical information about each request, such as your IP address, the pages requested, the date and time, and your browser type. This information is processed by our web hosting provider to deliver the Site and keep it secure. We do not receive visitor-level analytics from the Site.

What we do not collect

The Site has no user accounts, no payment forms, no advertising and no social media widgets. We do not knowingly collect special-category (sensitive) personal information through the Site.

3. How we use information

We use the information above to:

• respond to demo requests and other enquiries, and arrange demonstrations or calls;
• provide information about ThreatLark that you ask for, and manage the resulting business relationship;
• keep the Site and our systems secure, and prevent abuse or fraud;
• keep records, and meet our legal, accounting and regulatory obligations; and
• establish, exercise or defend legal claims.

We do not use the Site to make decisions about you by automated means, and we do not build advertising profiles.

Legal bases (GDPR and UK GDPR). Where those laws apply, we rely on: steps taken at your request before entering into a contract (answering demo and pricing requests); our legitimate interests in operating the Site, securing it and responding to business enquiries, which are not overridden by your rights; compliance with legal obligations; and, where we ask for it, your consent, which you can withdraw at any time.

4. Cookies and tracking

The Site does not set cookies, does not use local storage to track you, and does not run analytics, advertising or fingerprinting scripts. Fonts, styles, scripts and images are all served from the Site’s own host, so loading a page does not send your browser to any third-party service.

Because we do not track visitors, there is nothing to opt out of. We therefore do not need a cookie banner, and the Site respects “Do Not Track” and Global Privacy Control signals by default. Links to other websites, or an email link you click, are governed by the policies of those third parties.

5. Sharing and disclosure

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We disclose personal information only as follows:

• Service providers that help us run the Site and our business communications, such as web hosting, email and calendar providers. They may process information only on our behalf and under appropriate confidentiality and data protection terms.
• Professional advisers, such as lawyers, auditors and insurers, where needed.
• Authorities and other parties where disclosure is required by law, legal process or to protect rights, safety and security.
• Successors in the event of a merger, acquisition or sale of assets, subject to this policy continuing to apply to the information.

6. Retention

We keep demo-request and enquiry correspondence for as long as needed to respond to you and to manage any resulting relationship, plus a reasonable period afterwards for record-keeping and the establishment or defence of legal claims. After that, we delete the information or anonymise it. We keep information for longer only where the law requires it, or where it is needed for a pending dispute.

Technical request logs held by our hosting provider are kept for the period that provider applies for security and operational purposes. You may ask us to delete your correspondence at any time (see section 9).

7. Security

The Site is a static website served over HTTPS, and it has no database or user accounts to compromise. We apply reasonable technical and organisational measures to protect the information we hold, including access controls on our mailboxes and systems. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please avoid including sensitive data in emails to us.

8. The ThreatLark product and your scan data

ThreatLark is self-hosted software. Scan data stays inside your own environment. Scan targets, discovered assets, findings, reports, user accounts, audit logs and stored credentials are held in the database and data volume of the ThreatLark instance that you run, on infrastructure that you control. The database is encrypted at rest, secrets are encrypted, and licence keys are verified locally without contacting us. This website does not collect, receive or process the data held in your ThreatLark deployment, and we do not receive it unless you choose to send us something, for example when you ask for support.

Some optional ThreatLark features connect from your own instance to external services that you configure, for example public vulnerability feeds, threat-intelligence and IP-reputation providers you have supplied API keys for, and checks for updated software or scanner tools. Those connections are made directly by your instance to the relevant provider and are governed by that provider’s terms and by your own configuration. You decide which features and keys are enabled. For data held in your own instance, you (or your organisation) are the controller, and your own policies apply.

9. Your rights

Depending on where you live, you may have some or all of the following rights over your personal information.

European Economic Area and United Kingdom (GDPR and UK GDPR)

You have the right to access your personal information and receive a copy; to have inaccurate information corrected; to have information erased; to restrict or object to our processing, including processing based on legitimate interests; to receive information you provided in a portable format; and to withdraw consent at any time where processing is based on consent. You also have the right to lodge a complaint with your local data protection authority, such as the Information Commissioner’s Office in the United Kingdom, or the supervisory authority in the country where you live or work.

California and other US states (CCPA/CPRA and similar laws)

Residents of California and certain other US states may have the right to know what personal information we collect, use and disclose; to request access to or deletion of their personal information; to correct inaccurate information; to opt out of the sale or sharing of personal information; and to limit the use of sensitive personal information. We do not sell or share personal information as those terms are defined, and we do not use sensitive personal information for purposes that require a right to limit. We will not discriminate against you for exercising your rights. You may use an authorised agent to submit a request, and we may need to verify your identity and the agent’s authority.

How to exercise your rights

Email sales@threatlark.com with your request and the email address you used to contact us. We will respond within the period required by applicable law (generally one month under GDPR and UK GDPR, and 45 days under CCPA, extendable where the law allows). We may ask you to confirm your identity before acting on a request. There is normally no charge.

10. Children

The Site is intended for business and professional audiences and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has sent us personal information, contact us and we will delete it.

11. International transfers

Our service providers and the organisations you contact us from may be located in countries other than your own, including countries whose data protection laws differ from those where you live. Where we transfer personal information from the EEA, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, or another lawful transfer mechanism. You can contact us for more information about these safeguards.

12. Changes to this policy

We may update this policy from time to time, for example to reflect changes to the Site, our practices or the law. The “Last updated” date at the top shows when it last changed. If a change is material, we will make that clear on the Site. Please review this page periodically.

13. Contact us

For questions about this policy, to exercise your rights, or to make a privacy complaint, email sales@threatlark.com. We will do our best to resolve your concern promptly.