Privacy Policy

1. Scope and Our Role

KeyPriv acts as the "controller" (or "business") for the personal information we collect for our own purposes, such as operating our websites, managing customer accounts, billing, security, marketing, and producing our threat intelligence.

When our customers submit personal information to the Services for us to process on their behalf (for example, the names and email addresses of their employees or executives that they ask us to monitor), KeyPriv acts as a "processor" (or "service provider") to that customer. The customer's own privacy notice governs that processing, and the customer is responsible for having a lawful basis for it. If you are an individual whose information was submitted by one of our customers, please direct your requests to that customer; we will assist them as required by our agreement and applicable law.

This Policy does not apply to third-party websites, products or services, even if they are linked from or integrated with our Services.

2. Information We Collect

Information you provide to us:

• Contact and account information, such as your name, job title, employer, business email address, telephone number, username, password and multi-factor authentication settings.
• Commercial and billing information, such as the products you purchase, order forms, invoices, billing address and payment details. Card payments are handled by our payment processors; we do not store full card numbers.
• Customer Data, such as the domains, IP ranges, brands, keywords, executive and employee identifiers, credentials, files and configurations that you provide for monitoring and investigation.
• Communications, such as requests for demos or quotes, support tickets, survey responses, feedback, chat and AI assistant prompts, and the content of emails or calls with us (which may be recorded where permitted by law, with notice).
• Exposure-check and trial inputs, such as an email address or domain you submit to check for exposure.
• Event, partner and recruiting information, such as event registrations, and the résumé and background information you submit when applying for a job.

Information we collect automatically:

• Device and connection information, such as IP address, browser type and version, operating system, device identifiers, language, time zone and approximate location derived from your IP address.
• Usage information, such as pages viewed, links clicked, referring URLs, features used, searches performed, queries made through our APIs, timestamps, and error and diagnostic logs.
• Security information, such as authentication events, failed login attempts and signals used to detect fraud, abuse and attacks against our Services.
• Information from cookies and similar technologies, as described in Section 7.

Information we obtain from other sources:

• Business contact information from your employer, our resellers, distributors and partners, event organizers, and commercially available business directories.
• Information from integrations and third-party services that you connect to the Services.
• Threat intelligence from open, technical, commercial, closed and underground sources, as described in Section 4.

3. How We Use Information

We use personal information for the following purposes:

• To provide, operate, maintain and support the Services, including creating and administering accounts, authenticating users, and delivering alerts, reports, takedowns and analyst services.
• To process transactions, send invoices, collect payments and manage our customer relationships.
• To communicate with you about the Services, including service announcements, security notices, updates, and responses to your requests.
• To produce, enrich, validate and improve our threat intelligence, and to protect our customers and the wider public from cyber threats, fraud and crime.
• To develop, test, train and improve our products, features, analytics and machine-learning models, including using de-identified or aggregated information.
• To secure our systems and the Services, monitor for and investigate suspicious activity, prevent fraud and abuse, and enforce our Terms of Service and other agreements.
• To send marketing communications, run events and webinars, and measure the effectiveness of our marketing, subject to your choices (Section 14).
• To comply with legal and regulatory obligations, respond to lawful requests from public authorities, and establish, exercise or defend legal claims.
• For any other purpose we describe at the time of collection or with your consent.

We may create de-identified or aggregated information that cannot reasonably be used to identify you, and use and disclose it for any lawful purpose. We will not attempt to re-identify de-identified information except as permitted by law.

4. Personal Information in Threat Intelligence

To detect and prevent cyberattacks, fraud and data breaches, our Services collect information from the open web, the deep and dark web, criminal forums and marketplaces, paste sites, messaging channels, malware infrastructure, technical sensors and similar sources. This material may contain personal information about individuals, for example:

• credentials, email addresses, usernames, telephone numbers and other records that were stolen, leaked or exposed in data breaches or by malware;
• information about employees, executives and customers of organizations that are being targeted, impersonated or defrauded;
• online identifiers, aliases, communications and infrastructure associated with threat actors.

We process this information for the purposes of cybersecurity, fraud prevention and the detection and prevention of crime: to warn affected organizations and individuals, to help them secure accounts and systems, to disrupt malicious activity, and to support law enforcement. We rely on our legitimate interests, and those of our customers and the public, in network and information security and in preventing crime. Where applicable law requires a different basis, we rely on that basis.

We apply safeguards to this processing, including limiting access to authorized personnel and customers with a security purpose, contractually prohibiting customers from misusing exposed credentials or personal information, hashing or masking sensitive values where practical, and retaining information only as long as it serves a security purpose.

Because this information is collected from sources that we do not control and is used to protect people from harm, it is often impossible or would seriously impair the purpose of the processing to notify each individual concerned. Some privacy rights may also be limited where exercising them would prejudice the prevention or detection of crime or the security of networks and information, as permitted by law. You may still contact us about this processing under Section 12, and we will consider your request in accordance with applicable law.

5. Legal Bases for Processing (EEA, UK and Switzerland)

If the European Union, United Kingdom or Swiss data protection laws apply, we rely on the following legal bases:

• Performance of a contract, to provide the Services and manage your account.
• Legitimate interests, including operating and improving our business, securing our systems, producing threat intelligence, preventing fraud and crime, direct marketing to business contacts, and establishing or defending legal claims. We balance these interests against your rights, and you may object as described in Section 15.
• Compliance with legal obligations, such as tax, accounting and lawful requests from authorities.
• Consent, where required, for example for certain cookies or marketing. You may withdraw consent at any time without affecting processing that took place before withdrawal.

6. How We Disclose Information

We disclose personal information to the following categories of recipients:

• Service providers and subprocessors who perform services for us, such as cloud hosting, data storage, payment processing, customer support, communications, security, analytics, and AI model providers, under contracts that require them to protect the information and use it only to provide services to us.
• Our customers, who receive threat intelligence (which may contain personal information as described in Section 4) to protect themselves and the individuals concerned, subject to our Terms of Service.
• Our affiliates, for the purposes described in this Policy.
• Resellers, distributors and partners, where necessary to provide the Services you purchased through them or to respond to your enquiries.
• Law enforcement, regulators, courts, Computer Emergency Response Teams, registrars, hosting providers, platforms and other parties, when we believe in good faith that disclosure is required by law or legal process, or is appropriate to prevent or investigate fraud, cyberattacks or other illegal activity, to support takedowns, or to protect the rights, property or safety of KeyPriv, our customers or others.
• Professional advisers, such as lawyers, auditors, insurers and bankers.
• A buyer, successor or other party in connection with an actual or proposed merger, acquisition, financing, reorganization, bankruptcy or sale of all or part of our business or assets.
• Other parties at your direction or with your consent.

KeyPriv does not sell personal information for money, and does not "share" personal information for cross-context behavioural advertising, as those terms are defined under California law.

7. Cookies and Similar Technologies

We use cookies, local storage and similar technologies that are necessary to operate the Services, such as keeping you signed in, remembering your preferences (for example, language and theme), load balancing, and protecting against fraud and attacks. We may also use analytics technologies to understand how our websites and Services are used and to improve them.

Our marketing website does not currently use third-party advertising cookies or trackers. If we introduce non-essential cookies, we will update this Policy and request your consent where the law requires it.

You can control cookies through your browser settings, but disabling necessary cookies may prevent parts of the Services from working. Where required by law, we honour recognized opt-out preference signals, such as Global Privacy Control, for the browser or device that sends them.

8. AI Features

Some features of the Services use machine learning and generative AI, which may be provided by KeyPriv or by third-party model providers acting as our service providers. Prompts, files and other inputs you submit to AI features, and the outputs generated, are processed to provide the feature, to keep it secure, and to improve it in de-identified form. We do not permit our third-party model providers to use your inputs to train their own general-purpose models. We do not use AI features to make decisions that produce legal or similarly significant effects about you.

9. Data Retention

We keep personal information for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, to maintain business and security records, to comply with legal, tax and accounting obligations, to resolve disputes, and to enforce our agreements. Account information is generally kept for the life of the account and a reasonable period afterwards. Customer Data is handled as described in our Terms of Service. Threat intelligence is kept for as long as it remains useful for security, investigative and historical-analysis purposes. When information is no longer needed, we delete it or de-identify it, or, if that is not possible (for example, because it is held in backups), we isolate it from further use until deletion is possible.

10. Security

We use administrative, technical and physical safeguards designed to protect personal information, including encryption in transit, access controls, logging and monitoring, and security testing. However, no method of transmission or storage is completely secure, and we cannot guarantee the security of any information. You are responsible for keeping your account credentials confidential and for notifying us promptly of any suspected unauthorized use of your account. If we become aware of a security incident affecting your personal information, we will notify you and the relevant authorities as and when required by applicable law.

11. International Transfers

KeyPriv is based in the United States, and we and our service providers may process personal information in the United States and other countries whose data protection laws may differ from those of your country. Where required, we protect international transfers with appropriate safeguards, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or other lawful transfer mechanisms. You may request more information about these safeguards by contacting us.

12. Your Privacy Rights and How to Exercise Them

Depending on where you live, you may have some or all of the following rights regarding your personal information, subject to exceptions under applicable law:

• to know or access the personal information we hold about you and how we use it, and to receive a copy;
• to correct inaccurate personal information;
• to delete personal information;
• to receive personal information in a portable format;
• to object to or restrict certain processing, including processing based on legitimate interests and direct marketing;
• to opt out of the sale or sharing of personal information, targeted advertising, or profiling that produces legal or similarly significant effects (we do not engage in these activities);
• to withdraw consent, where processing is based on consent;
• to not be discriminated against for exercising your rights.

To exercise a right, email [email protected] with the subject line "Privacy Request", or write to us at the address in Section 19. We will need to verify your identity before responding, which may require you to provide information that matches our records. You may use an authorized agent where permitted by law; we may require proof of the agent's authority and verification of your identity. We will respond within the time required by applicable law.

We may decline or limit a request where permitted by law, for example where we cannot verify your identity, where the request is manifestly unfounded or excessive, where fulfilling it would affect the rights of others, or where the information is processed for security, fraud-prevention, crime-prevention, or legal purposes (including threat intelligence described in Section 4). If we decline a request, we will explain why, and where the law provides it, you may appeal by replying to our decision with the subject line "Privacy Appeal".

13. Additional Information for U.S. Residents

This Section supplements the rest of this Policy for residents of California and other U.S. states with comprehensive privacy laws. In the preceding twelve months, we have collected the following categories of personal information, from the sources and for the purposes described in Sections 2 to 4, and disclosed them for business purposes to the categories of recipients described in Section 6:

• Identifiers (such as name, email address, IP address, account username).
• Customer records and commercial information (such as billing details and purchase history).
• Professional or employment-related information (such as job title and employer, and job-application information).
• Internet or other electronic network activity information (such as usage, log and device data).
• Approximate geolocation derived from IP address.
• Audio or electronic information, such as recorded calls where permitted and notified.
• Inferences drawn from the above to understand customer interests and needs.
• Sensitive personal information, limited to account log-in credentials, and exposed credentials contained in threat intelligence, which we use only for security, fraud-prevention and other purposes permitted by law, and not to infer characteristics about individuals.

We do not sell personal information, share it for cross-context behavioural advertising, or use sensitive personal information for purposes that would give rise to a right to limit its use. We do not knowingly collect or sell the personal information of consumers under 16.

California residents may request information about disclosures of personal information to third parties for their direct marketing purposes; we do not make such disclosures.

14. Marketing Choices

We may send business contacts information about our products, services, research and events. You can opt out of marketing emails at any time by using the unsubscribe link in the email or by contacting us. Even if you opt out, we may continue to send you transactional and service-related communications, such as security notices, billing messages and responses to your requests.

15. Additional Information for the EEA, UK and Switzerland

In addition to the rights in Section 12, you have the right to object at any time to processing based on our legitimate interests, on grounds relating to your particular situation, and the absolute right to object to direct marketing. You also have the right to lodge a complaint with your local data protection supervisory authority. We would, however, appreciate the chance to address your concerns first, so please contact us.

Where required by law, we will appoint a representative in the European Union or the United Kingdom, whose details will be provided on request.

16. Children

The Services are intended for businesses and are not directed to children. We do not knowingly collect personal information from children under 16 for our own purposes. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to delete it. This does not apply to information about minors that may appear in threat intelligence, which we process only as described in Section 4.

17. Third-Party Sites and Integrations

Our Services may contain links to, or integrate with, websites and services operated by third parties. Their collection and use of your information is governed by their own privacy policies, and we are not responsible for their practices.

18. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the "Effective" date at the top of this page and, where the changes are material, provide additional notice, such as by email or through the Services. Your continued use of the Services after an update takes effect means that you acknowledge the updated Policy.

19. Contact Us

If you have questions or concerns about this Policy or our privacy practices, or wish to exercise your rights, please contact us: