Privacy Notice

Last updated: 14 October 2026

‍

Spectrum Security, Inc. ("Spectrum," "we," "us," "our") respects your privacy. This notice explains what personal data we collect, why, how we use and share it, how long we keep it, and the rights you have. It is written to meet our obligations under the EU General Data Protection Regulation (GDPR), the UK GDPR, and other applicable data protection laws.

‍

Two roles — please read this first. Spectrum plays two different roles with personal data, and your rights depend on which applies:

‍

• When we act as a controller — for our website, our sales and marketing, and our own business contacts — this notice describes how we handle your data, and you can exercise your rights directly with us.
• When we act as a processor — when we analyse and improve detection rules inside a customer's SIEM (security) platform on that customer's behalf — that customer is the controller of any personal data involved. This notice does not govern that processing. If your data was handled because your employer or another organisation uses Spectrum, please see that organisation's privacy notice or contact them to exercise your rights. We will support them in responding. See Section 3.

1. Who we are

Spectrum Security, Inc. is the controller of the personal data described in this notice (except for the processor activities noted above).

‍

Controller: Spectrum Security, Inc.

‍

Principal place of business: 251 Kearny St., 7th Floor, San Francisco, CA 94108, United States

‍

Registered office: 3500 South Dupont Highway, Dover, DE 19901, United States

‍

Contact: legal@spectrum.security

‍

We have not appointed a statutory Data Protection Officer; privacy matters are handled by our Privacy Team, reachable at the address above.

‍

Representatives in the EU and UK (GDPR Article 27). Because we process personal data about individuals in the European Economic Area and the United Kingdom through our website, we have appointed Euverify as our representative in each region. You may contact them on any data protection matter, including to exercise your rights:

‍

EU representative Euverify Limited (Ireland) Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland. Email: gdpr@euverify.com

‍

UK representative Euverify Ltd (United Kingdom) 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom. Email: gdpr@euverify.com

‍

You can also reach our representative, submit a request, or verify their appointment through Euverify's secure portal: gdpr.euverify.com

‍

You may contact our representative or us directly. Contacting the representative does not limit your rights or your ability to contact a supervisory authority.

‍

2. The personal data we collect, why, and our lawful basis

We only collect personal data we need, and we always have a lawful basis for using it. The table below summarises our processing as a controller. Website tracking is summarised in the first three rows and described in full in Section 4.

‍

Where we rely on legitimate interests, we have balanced those interests against your rights, and you can object at any time (see Section 8). Where we rely on consent, you can withdraw it at any time without affecting processing already carried out.

‍

We do not use your personal data to make decisions about you based solely on automated processing that produce legal or similarly significant effects.

‍

On "selling" and "sharing" personal data. Spectrum does not itself sell personal data. However, some of the third-party analytics and visitor- identification tools described in Section 4 operate in ways that may constitute a "sale" or "share" under certain US state privacy laws, including the California Consumer Privacy Act — for example, where a provider uses data collected through our site for its own commercial purposes or discloses it to advertising partners. Where those laws apply to you, you have the right to opt out; see Section 9.

‍

3. Data we process for our business customers (our processor role)

Spectrum provides a service that improves the quality and coverage of detection rules within our customers' security (SIEM) platforms. In delivering that service we may process data — including limited account identifiers and log content — on behalf of, and on the instructions of, our business customer. For that processing, the customer is the controller and Spectrum is a processor.

‍

If you are an employee or user of one of our customers and your data was processed in that context:

‍

• This notice does not govern that processing.
• Please refer to your organisation's privacy notice, or contact them, to understand the processing and to exercise your rights.
• We will provide reasonable assistance to that organisation in responding to your request.

We do not use data processed in this role for our own purposes. We do not train AI models on it. Where AI is used to analyse detection coverage, it is processed transiently, and either through our vetted enterprise AI providers under data-protection contracts or, where the customer prefers, through the customer's own AI keys or a proxy the customer controls.

‍

The sub-processors we engage in delivering the service are listed in our Sub-processor List.

‍

4. Cookies, tracking and visitor identification

This section describes what runs on our website, provider by provider.

‍

What we use

Our website uses:

‍

• Cookies — small files stored on your device by some of our providers.
• Tags and pixels — small scripts used for analytics and advertising measurement.
• Visitor identification services — services that use your IP address to identify the organisation you are visiting from (see below).

One of our providers, Ahrefs Web Analytics, stores nothing on your device at all. None of our providers uses browser fingerprinting.

‍

Company identification

One of our providers, Apollo, uses your IP address to identify the organisation you are visiting from, together with details such as its industry, size and location. We use this to decide whether and how our sales team follows up on a visit.

‍

This identifies the organisation, not you personally. We do not use services that resolve anonymous visits to named individuals. We do this only where you have given consent through our consent banner, and you can withdraw that consent at any time.

‍

Consent

With the exception of what is strictly necessary to operate and secure the site, none of the above runs until you consent. Our consent management platform (Usercentrics) blocks every provider listed below — including Google Tag Manager and everything it loads — until you make a choice. You can change or withdraw your choices at any time through the consent settings link on our site.

‍

Two limits are worth stating plainly. Withdrawing consent stops future processing; a script already running in the page you are on continues until you reload, and any storage it has already set remains until it expires or you clear it. And our consent controls currently group the providers loaded through Google Tag Manager together, so accepting or rejecting them is a single choice rather than one per provider.

‍

The providers

Google Tag Manager loads Google Analytics 4, LinkedIn Insight Tag, Meta Pixel, Apollo and Ahrefs Web Analytics. Google Tag Manager itself is loaded directly by our site.

‍

A fuller description of each provider, including each provider's own privacy policy, is in our Cookie and Tracking Policy.

‍

Joint controllers

For the Meta Pixel and the LinkedIn Insight Tag, we are joint controllers with Meta Platforms Ireland Ltd and LinkedIn Ireland Unlimited Company respectively, for collecting data on our website and sending it to them. We are responsible for asking for your consent and for giving you this information. Each provider is responsible for what it does with the data once it receives it, as described in its own privacy policy. You can exercise your rights with us or with the provider, and we will share the essence of each arrangement on request.

‍

5. Who we share personal data with

We share personal data only as needed, with:

‍

• The website providers listed in Section 4, each of which receives the data described there. Several of them use that data for their own purposes as well as ours; their own privacy policies are linked in our Cookie and Tracking Policy.
• Service providers (processors) who help us run our business — for example website hosting, email, analytics, and customer-relationship management — under contracts requiring them to protect the data.
• AI providers used to deliver our service, currently OpenAI and Anthropic, under data processing agreements. (Primarily relevant to our processor role in Section 3.)
• Professional advisers (legal, accounting) where necessary.
• Authorities or third parties where required by law, to protect our rights or safety, or in connection with a corporate transaction (e.g. merger or acquisition), in which case we will provide notice as required.

The sub-processors used in delivering our service are listed in our Sub-processor List.

‍

6. International data transfers

Spectrum is based in the United States, and personal data we process is stored and processed in the United States and potentially other countries. Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland to a country not recognised as providing adequate protection, we put appropriate safeguards in place — principally the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum / Swiss addendum as applicable) — including in our agreements with our AI providers and other sub-processors.

‍

The website providers in Section 4 process data in the United States, and each publishes a transfer safeguard — Data Privacy Framework certification and/or Standard Contractual Clauses.

‍

You can contact us for more information or a copy of the relevant safeguards.

‍

7. How long we keep personal data

We keep personal data only as long as necessary for the purposes above, then delete or anonymise it. In general:

‍

• Website analytics and tracking data: retention is determined by each provider under its own policies, and most do not publish a fixed period. Ahrefs deletes its IP-hashing salt every 24 hours and does not store raw IP addresses. You can remove anything stored on your device at any time through your browser's "clear site data" controls.
• Prospect/business-contact and marketing data: for as long as the business relationship or your interest in our services is live, and for a reasonable period afterwards so we can respond if you come back to us. We determine that period by reference to how recently you engaged with us, any legal or contractual reason to keep a record, and whether you have opted out — and we stop using your data for marketing as soon as you ask us to.
• Enquiries: for as long as needed to handle your request and to keep a record of how we dealt with it.
• Customer account data: for the term of the customer relationship and as required afterwards.
• Data processed for customers (processor role): log data used for analysis is handled transiently; limited data may be retained for up to 30 days for debugging, then deleted, except as the customer instructs.
• Data we must keep by law: for the period required by that law.

8. Your rights

Subject to conditions and exemptions under applicable law, you have the right to:

‍

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erase your data ("right to be forgotten");
• restrict our processing;
• object to processing based on legitimate interests, and to direct marketing at any time;
• data portability (receive certain data in a portable format); and
• withdraw consent at any time, where we rely on consent.

These rights apply to the personal data we hold about you as a controller, described in Section 2. If you would like to know what we hold about you, or to have it deleted, contact us and we will action it.

‍

How to make a request. If you are in the European Economic Area or the United Kingdom, the quickest route is the request portal operated by our representative, Euverify ↗. Requests submitted there are logged and tracked, and we are notified immediately. The same page lets you verify our appointed representative.

‍

You can also contact our representative by email at gdpr@euverify.com or by post at the address in Section 1. Or contact us directly at legal@spectrum.security. Contacting the representative instead of us does not limit your rights in any way, and you are free to use whichever route you prefer.

‍

‍

We will respond within the time limits required by law. If your data was processed in our processor role (Section 3), please direct your request to the relevant organisation (the controller), and we will assist them.

‍

You also have the right to lodge a complaint with a supervisory authority. In the EEA this is your local data protection authority; in the UK it is the Information Commissioner's Office (ICO, ico.org.uk); in Switzerland, the FDPIC. We would appreciate the chance to address your concerns first.

‍

9. US state privacy rights

If you are a resident of California or another US state with comprehensive privacy legislation, you may have the right to know what personal information we collect and how it is used, to request deletion or correction, to opt out of the "sale" or "sharing" of personal information and of targeted advertising, and not to be discriminated against for exercising those rights.

‍

As described in Section 2, some of the third-party tools on our website may constitute a "sale" or "share" under these laws. To opt out, adjust your choices through the consent settings link on our site, or contact legal@spectrum.security.

‍

10. How we protect personal data

We maintain appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls and multi-factor authentication, least-privilege access, logging and monitoring, and vendor risk management. No system can be guaranteed perfectly secure, but we work to protect your data and to respond appropriately to any incident.

‍

11. Children

Our website and services are intended for businesses and are not directed to children. We do not knowingly collect personal data from children under the age applicable in your jurisdiction (16 in much of the EEA, subject to member-state law; 13 in the UK). If you believe a child has provided us with personal data, please contact us and we will delete it.

‍

12. Changes to this notice

We may update this notice from time to time. We will post the updated version here and change the "Last updated" date, and where changes are significant we will provide a more prominent notice.

‍

13. Contact us

Questions or requests about this notice or your personal data:

‍

Spectrum Security, Inc. 251 Kearny St., 7th Floor, San Francisco, CA 94108, United States legal@spectrum.security

‍