Privacy Policy

This policy applies to personal information processed through the Site and the Service. It does not apply to third-party websites, services, or integrations that we do not control.

Depending on the context, Senthorion may act as a data controller (for example, for account registration, billing, marketing, and platform operations) or as a data processor on behalf of our customers (for example, for security data and other content submitted by an organization for analysis within the Service). Where we process data on a customer's behalf, that customer remains responsible for providing appropriate notices and obtaining required consents.

Questions about this policy: privacy@senthorion.com (fallback: info@senthorion.com).

The information we collect depends on how you interact with Senthorion. Categories may include:

• Identity and contact data: name, email address, phone number, organization name, job title, and billing contact details.
• Account and authentication data: usernames, hashed credentials, multi-factor authentication settings, session identifiers, and sign-in logs.
• Organization and usage data: organization membership, roles, plan tier, feature usage, configuration settings, and audit logs.
• Security and operational data: assets, targets, scan results, findings, alerts, compliance records, integrations, and other data you submit or generate while using the Service.
• Communications and support data: messages, tickets, demo requests, feedback, and survey responses.
• Marketing and lead data: newsletter preferences, campaign interactions, and information submitted through contact or trial forms.
• Technical and device data: IP address, browser type, operating system, device identifiers, referral URLs, and similar diagnostic information collected through the Site or Service.
• Cookie and analytics data: information collected through cookies, pixels, and similar technologies as described below.
• AI interaction data: prompts, inputs, outputs, and related metadata when you use AI-assisted features within the Service.

We use personal information to:

• Provide, operate, maintain, and improve the Site and Service.
• Create and manage accounts, organizations, and user access.
• Authenticate users, enforce authorization, and protect against fraud and abuse.
• Perform security workflows you request, including scanning, monitoring, alerting, and reporting.
• Provide customer support, respond to inquiries, and communicate about the Service.
• Process subscriptions, invoices, and payments where applicable.
• Send service-related notices, security alerts, and administrative messages.
• Send marketing communications where permitted by law and your preferences.
• Analyze usage trends, troubleshoot issues, and develop new features.
• Comply with legal obligations, enforce our terms, and protect our rights and the rights of others.

Where applicable law requires a legal basis, we rely on one or more of the following: performance of a contract with you or your organization; legitimate interests in operating, securing, and improving the Site and Service; compliance with legal obligations; and consent where required (for example, for certain marketing communications or optional cookies).

We use cookies and similar technologies on the Site and Service to enable core functionality, remember preferences, understand usage, and improve performance. Depending on your browser and jurisdiction, you may be able to control cookies through browser settings or consent tools we provide.

We may use first-party and third-party analytics tools to understand how visitors use the Site. Where required, we obtain consent before placing non-essential cookies.

We do not sell personal information. We may share information in the following circumstances:

• Service providers and subprocessors that help us operate the Site and Service (such as cloud hosting, email delivery, payment processing, analytics, and AI providers), subject to contractual confidentiality and security obligations.
• Integrations you or your organization enable, where data sharing is necessary to deliver the integration.
• Professional advisers, auditors, insurers, and legal counsel where reasonably necessary.
• Authorities, regulators, or law enforcement when required by law or to protect rights, safety, and security.
• In connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate safeguards.
• With your direction or consent.

A current list of subprocessors can be requested from privacy@senthorion.com.

Senthorion operates infrastructure in reputable cloud regions, primarily within the European Union. If personal information is transferred internationally, we implement appropriate safeguards consistent with applicable law, such as standard contractual clauses or equivalent mechanisms.

We retain personal information only for as long as necessary to provide the Service, fulfill the purposes described in this policy, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods vary by data category and may depend on your organization's plan, configuration, and contractual terms.

We implement technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, or alteration. No method of transmission or storage is completely secure. For more information, see our Security page.

When you use AI-assisted features, we process inputs and outputs to deliver the requested functionality. We apply safeguards designed to reduce exposure of sensitive information before requests are sent to AI providers. We do not use customer content to train third-party foundation models without authorization.

Depending on your location, you may have rights to:

• Access personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion, subject to legal and contractual limitations.
• Object to or restrict certain processing.
• Request portability of information you provided.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a supervisory authority.

To exercise these rights, contact privacy@senthorion.com. We may need to verify your identity and, where applicable, confirm that you are authorized to act on behalf of an organization. We will respond within the timeframe required by applicable law.

European Economic Area and United Kingdom: Where Senthorion is a controller, you may contact us at privacy@senthorion.com regarding your data protection rights.

California: Where applicable, California residents may have additional rights regarding access, deletion, and opt-out of certain sharing. Senthorion does not sell personal information as defined by applicable California law.

Other regions: Additional rights may apply based on local law. Contact us if you have questions about rights in your jurisdiction.

The Site and Service are not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact privacy@senthorion.com and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates when the policy was last revised. Material changes will be communicated through the Site, Service, or direct notice where appropriate.

For privacy questions or requests: privacy@senthorion.com.

General inquiries: info@senthorion.com.