Privacy Policy

1.Scope and Privacy Roles

For account registration, billing, website operations, direct communications, security, and our own business administration, SecurSky generally determines why and how personal information is processed and acts as the applicable controller or business.

When a customer submits authorized target information, customer data, or instructions to Nexus or to a Professional Services engagement, the customer generally determines the purpose of that processing. In that context, the customer may be the controller or business, and SecurSky may act as a processor, service provider, or contractor, depending on applicable law and the written agreement. We may independently process limited information where necessary to secure the Services, prevent abuse, comply with law, or protect rights and safety.

A data processing addendum may be made available when legally required and appropriate to the customer’s use.

2.Information We Collect

Depending on how you interact with us, we may collect:

• Account and contact information: name, business email, organization, role, phone number, account identifiers, preferences, and communications.
• Eligibility and verification information: intended use, organization details, authorization evidence, KYC or fraud-prevention information, and related records where vetting is required.
• Authentication and security information: password hashes or authentication tokens, multi-factor authentication status, IP address, browser and device information, login history, session data, and security events. We do not need or intend to store your plaintext password.
• Billing information: plan, invoices, transaction status, billing contact, tax information, and limited payment details received from our payment provider. Full card numbers are ordinarily handled by the payment provider rather than SecurSky.
• Usage and technical information: query counts, feature use, timestamps, request status, API or source usage, performance, errors, approximate location derived from IP, and similar operational telemetry.
• Support and communications: emails, support requests, attachments, meeting information, feedback, and records needed to resolve an issue or provide requested assistance.
• Professional Services information: contacts, authorized scope, system and asset information, evidence supplied by the customer, assessment notes, and deliverables created for an engagement.
• Nexus target and result data: domains, email addresses, telephone numbers, names, organizations, identifiers, and related information submitted for an authorized query, together with results obtained from public, customer-provided, licensed, or third-party sources.
• Website information: cookie identifiers, page visits, referring pages, interaction information, and consent choices where analytics or similar technologies are enabled.

Please do not submit passwords, private keys, payment-card data, medical records, government identification numbers, precise location, or other highly sensitive information unless the Service expressly supports it and you are legally authorized to provide it.

3.Nexus Query Privacy and Logging

Nexus processes query inputs and results to perform the security assessment requested by the authorized user. Our default objective is to minimize retention of query content and returned results.

We do not intentionally retain query content or returned results in ordinary application logs after the request completes. However, query content or results may be retained when:

• you choose to save, export, download, or preserve a report or history;
• the information forms part of a Professional Services engagement or customer deliverable;
• you submit it to support or ask us to investigate an error;
• retention is reasonably necessary to detect fraud, investigate abuse, protect users or systems, enforce our Terms, or respond to a security incident;
• we are required to preserve or disclose it by applicable law, legal process, or a valid government request; or
• temporary copies remain in provider systems, caches, queues, monitoring tools, or backups subject to their deletion cycles.

We may retain non-content operational metadata—including account ID, query type and count, timestamp, request status, provider or source used, processing time, cost, IP address, and error details—to meter subscriptions, prevent abuse, secure the platform, troubleshoot failures, and improve reliability.

Third-party data providers may receive query parameters needed to answer a request and may process them under their own terms and privacy practices. We select providers with privacy and security in mind, but we do not control their independent systems.

4.How and Why We Use Information

We use personal information to:

• create and administer accounts, authenticate users, and provide the requested Services;
• process subscriptions, invoices, taxes, renewals, and payment issues;
• perform customer vetting, verify authority, prevent fraud, and enforce acceptable-use requirements;
• operate, secure, monitor, troubleshoot, maintain, and improve the Services;
• provide support, respond to requests, and send operational or security communications;
• deliver authorized cybersecurity assessments, reports, and advisory services;
• comply with law, preserve evidence, resolve disputes, and protect SecurSky, our customers, users, third parties, and the public; and
• send marketing communications where permitted. You may unsubscribe from marketing at any time, but we may still send necessary account, billing, legal, and security notices.

Where a legal basis is required, processing may be based on performance of a contract, compliance with legal obligations, consent, or our legitimate interests in providing and securing the Services, preventing misuse, supporting customers, and operating our business, balanced against applicable privacy rights.

Nexus risk scores, correlations, and automated summaries are decision-support tools. We do not intend them to make decisions that produce legal or similarly significant effects about individuals. Users must independently verify results and must not use Nexus as the sole basis for high-impact decisions.

5.When We Share Information

We may disclose information only as reasonably necessary:

• Service providers and subprocessors: hosting, infrastructure, authentication, payments, communications, analytics, customer support, security, logging, data sources, and professional advisers that process information for us under appropriate obligations.
• Customer administrators: an organization that manages your account may access account, membership, usage, reports, and administrative information associated with that organization.
• At your direction: when you request an integration, export, report delivery, or other disclosure.
• Legal and safety purposes: to comply with law or valid legal process; investigate fraud, abuse, or security incidents; enforce agreements; or protect rights, property, and safety.
• Business transactions: in connection with financing, due diligence, reorganization, merger, acquisition, sale of assets, or insolvency, subject to appropriate confidentiality and legal safeguards.

We do not sell account information or Nexus query content for monetary consideration. We do not use Nexus query content or returned results for cross-context behavioral or targeted advertising.

6.Cookies, Analytics, and Similar Technologies

We may use essential cookies and local storage for login, security, preferences, session management, and platform functionality. Where enabled, analytics tools may help us understand page usage, performance, and feature adoption. Analytics providers may receive device, browser, IP, cookie, and interaction information under their own privacy terms.

Where required by law, non-essential cookies will be used only after the required choice or consent. Browser controls may block cookies, although doing so can affect login or platform functionality.

7.Data Retention and Deletion

We retain information only for as long as reasonably necessary for the purposes described in this Policy, including providing the Services, maintaining business and transaction records, resolving disputes, enforcing agreements, protecting security, and meeting legal, tax, accounting, insurance, and compliance obligations.

Retention varies by category. Account information may remain while an account is active and for a reasonable period afterward; billing, contract, KYC, and legal records may be retained longer where required; security and technical records are retained according to operational risk and investigation needs; saved reports remain until deleted, expired, or the applicable account or engagement ends. Deleted information may persist temporarily in backups or disaster-recovery systems until normal deletion cycles complete.

When information is no longer needed, we take reasonable steps to delete, aggregate, de-identify, or securely dispose of it. We may retain de-identified information that cannot reasonably be linked to an identifiable person.

8.Security

We use administrative, technical, and organizational safeguards designed to protect information against unauthorized access, loss, alteration, misuse, or disclosure. Measures may include access controls, encryption in transit, credential protection, logging, monitoring, backups, provider review, and incident-response procedures.

No service or transmission method is completely secure. You are responsible for protecting credentials and API keys, using strong authentication, limiting account access, keeping devices secure, and promptly notifying us of suspected compromise. Where required by law, we will provide notifications concerning qualifying personal-data incidents.

9.International Data Transfers

SecurSky is operated from the United States and uses providers that may process information in the United States and other countries. Those countries may have privacy laws different from the laws where you live.

Where required, we use appropriate transfer mechanisms and safeguards, which may include contractual protections, Standard Contractual Clauses, data-processing terms, and supplementary security measures.

10.Your Privacy Rights and Choices

Depending on your location and subject to legal exceptions, you may have rights to request access, correction, deletion, restriction, objection, portability, withdrawal of consent, or information about categories of data, purposes, sources, recipients, and retention. Some U.S. residents may also have rights to opt out of qualifying sale, targeted advertising, or profiling, and to appeal a denied request.

To submit a request, email contact@secursky.com with the subject “Privacy Request.” Describe the request, your jurisdiction, and the account or email involved. We may verify your identity, authority, and jurisdiction before acting. Authorized agents may submit requests where permitted, but must provide proof of authority.

Rights are not absolute. We may deny or limit a request where information cannot be verified, an exception applies, the request conflicts with another person’s rights, or retention is required for security, fraud prevention, legal claims, contracts, or compliance. Where applicable, our response will explain how to appeal or contact the relevant supervisory authority.

You may unsubscribe from marketing through the message link or by contacting us. Organization administrators may manage certain account information directly. Requests concerning inaccurate information at an original public or third-party source may need to be directed to that source; we will consider reasonable correction or suppression measures within our control.

11.Customer Responsibilities for Target Data

Customers and users are responsible for ensuring that every query, upload, investigation, disclosure, and use of results has a lawful and authorized purpose. This includes obtaining required permissions, providing notices where applicable, limiting data to what is necessary, honoring individual rights, setting appropriate retention periods, and protecting exported results.

Do not use the Services to stalk, harass, dox, discriminate, conduct unlawful surveillance, make unauthorized high-impact decisions, or investigate systems or people without proper authority. Our Terms of Use contain additional mandatory restrictions.

12.Children

The Services are intended for adults and authorized business users and are not directed to children under 18. We do not knowingly permit children to create accounts or intentionally collect personal information directly from children through account registration. If you believe a child has provided account information, contact us so we can investigate and take appropriate action.

13.Changes to This Policy

We may update this Policy to reflect changes in technology, providers, Services, law, or business practices. We will post the updated version and revise the effective date. Where required, we will provide additional notice or obtain consent before a material change takes effect.

14.Contact Us

Please use the subject “Privacy Request” for privacy-rights requests and include enough information for us to identify the relevant account or interaction. Do not email passwords, private keys, full payment-card numbers, or unnecessary sensitive information.