Privacy Notice
What we collect, why, who touches it, and how to make us delete it. Plain language throughout.
Effective: 13 July 2026. Processing descriptions clarified 9 October 2026. · Material changes will be notified 30 days in advance by email and posted here with a revised effective date.
1. Who we are
SecurityAlert.ai is operated by CIA Development ("we," "us"). We are the data controller for the personal data described in this notice. Contact for privacy matters: legal@securityalert.ai.
2. What we collect
- Account data. Name and email address, provided when you sign up. Authentication is handled by Auth0; we never see or store your password.
- Billing data. Stripe customer ID, plan, and invoice history. Stripe tokenizes payment methods; we only ever see the last 4 digits of a card.
- Configuration data. The brand domains, monitors, certificates, and findings you set up in the product. This is your data; you can export and delete it.
- Investigation evidence. Screenshots, extracted public-page text, forms and redirects, registration and exposure records, observed phone numbers, imported referrals, review decisions and work history. Public evidence may include personal information.
- Website beacon observations. The optional snippet sends an installation key and the page origin and permitted path. It omits query strings, fragments, cookies, referrers and form contents; network requests can still appear in server logs.
- Usage analytics. Aggregate page-view and fixed product-action analytics from a self-hosted, cookieless analytics instance (Umami). No advertising trackers, no third-party analytics services.
- Server logs. Standard web-server logs (IP address, user agent, request path) retained for security and abuse prevention.
3. What we do NOT collect
- Passwords (Auth0 handles authentication end to end).
- Full payment card details (Stripe tokenizes them).
- Advertising identifiers or cross-site tracking data. We run no ad pixels.
4. Why we process it
- To provide the Service (GDPR Art. 6(1)(b), performance of a contract): running your monitors, storing findings, sending the alerts you configure.
- Billing and accounting (Art. 6(1)(b) and (c)): processing payments and keeping records the law requires.
- Security and abuse prevention (Art. 6(1)(f), legitimate interest): server logs, rate limiting, audit trails.
- Product improvement (Art. 6(1)(f)): aggregate, cookieless usage analytics.
- Transactional email (Art. 6(1)(b)): alert notifications, billing receipts, and account messages via Postmark. We do not run third-party marketing campaigns against your data.
5. Cookies and local storage
- We set no first-party advertising or tracking cookies.
- Auth0 sets cookies during sign-in to keep your session alive; see Auth0's own privacy documentation for details.
- We use browser localStorage for a signed-in session cache and UI preferences (for example, table column choices). If you carry a domain from the public lookalike checker into signup, the normalized domain is also kept in your browser for up to 24 hours to prefill onboarding; it is not sent to analytics and is removed after successful setup or expiry.
- Our analytics (self-hosted Umami) is cookieless by design.
6. Who we share it with
We do not sell personal data. The following providers and feature-specific recipients support the Service:
| Provider | Purpose | Data involved |
|---|---|---|
| Microsoft Azure | Primary application, database and backup hosting in Central US. | Account, workspace and investigation records. |
| Auth0 / Okta | Sign-in and identity management. | Account identity and authentication information. |
| Stripe | Subscriptions and payments. | Billing identity, payment details and invoices. |
| Postmark | Transactional email and configured alerts. | Recipient addresses and message contents. |
| Twilio | SMS delivery when configured. | Recipient phone numbers and message contents. |
| Cloudflare | DNS and edge services. | DNS queries and network/request information for traffic it handles. |
| Anthropic and OpenAI | Automated finding review, investigation assistance and report drafting. | Relevant finding context, public-page content and images where the feature uses them, and investigation prompts. |
| Shodan, AbuseIPDB and Hudson Rock | Exposure, reputation and credential-exposure lookups when used. | Lookup targets such as IP addresses, domains or email addresses, depending on the feature. |
| Public intelligence and registration services | Certificate, DNS, registration, advisory, repository and app-store evidence collection. | The public lookup targets required by the source. |
| Destinations you configure | Delivery to Slack, Teams, webhooks or connected API/MCP tools. | The findings, asset context and messages delivered through that integration. |
Primary application hosting is in Azure Central US. Providers and connected destinations may process data in other locations under their own terms. Feature-specific recipients receive data when that feature runs; this includes scheduled collection and automated review.
Automated review: Anthropic and OpenAI APIs process relevant finding context and public-page evidence for review and report drafting. Scheduled features can do this without a separate click for each finding. Their API data policies describe training defaults and retention; we do not promise zero retention by these providers.
We may also disclose data where the law requires it, and we will tell you when we legally can.
AI agent access you configure: if you connect an AI assistant or automation platform to your account (through an API key or the MCP endpoint), the findings and asset data it queries are delivered to that tool under your instruction, and its provider processes them under your agreement with them, not ours. Every such call is recorded in your audit log with the credential used, and revoking the credential severs access immediately.
7. How long we keep it
Retention periods and deletion behavior are described in the Data Retention Policy. Account deletion is available from Settings.
Account deletion removes personal account records and access. It does not erase a shared workspace that other members still use, or independently collected public intelligence. Shared investigation records and work history can remain with that workspace. Closing a workspace is a separate operation and can require transferring ownership or resolving its subscription first.
Revoking an API key or pausing a website beacon stops future authorized use; it does not erase evidence already collected. Billing records and records subject to legal retention obligations may remain. Deleted data can remain in backups until the next successful rotation removes the relevant copy.
8. Your rights
Under GDPR, CCPA, and similar laws you can:
- Access the personal data we hold about you.
- Correct inaccurate data (account details are editable in Settings).
- Delete your data (self-serve from Settings, or by request).
- Export your data in a portable format.
- Object to processing based on legitimate interest.
- Complain to your local supervisory authority.
To exercise any of these, use the self-serve controls in Settings or email legal@securityalert.ai. We respond within 30 days.
9. International transfers
A finalized customer Data Processing Addendum (DPA) is not currently available. If you require one, resolve that requirement with us before sending the relevant data.
Primary application and database hosting is in Azure Central US. Providers listed above and your configured integrations may process data in other locations. Contact us to review data-processing and international-transfer requirements before sending data that requires specific contractual safeguards.
10. Security
Our security practices, compliance status, and vulnerability disclosure process are documented on the Trust page.
11. Children
The Service is a business tool and is not directed at children under 16. We do not knowingly collect their data.
12. Contact
Privacy questions and requests: legal@securityalert.ai. Security reports: see security.txt.