Privacy Policy
Privacy and data rights for ThreatWarden marketing interactions.
This policy explains what we collect from this public site, why we use it, how consent works, and how GDPR, UK GDPR, California privacy rights, children privacy rules, and Gravatar-related data handling fit into the experience.
Scope and controller context
This Privacy Policy applies to visits, forms, newsletter or early-access requests, consent choices, and other public marketing interactions on this site. If you later enter a signed pilot, customer, partner, or product agreement, that agreement and its data-protection terms govern product account, tenant, security, and operational data.
ThreatWarden is the product operator for this marketing experience unless a later legal notice or signed agreement identifies a different controller or processor role. Use the contact channel on this site for privacy questions or data-rights requests.
Data we collect from this site
- Contact and request details you submit, such as name, work email, company, role, country or region, product interest, and message content.
- Pre-launch, demo, pilot, partnership, newsletter, and marketing opt-in choices, including timestamps and the policy or consent version shown at the time.
- Security and delivery telemetry such as IP address, browser or device signals, request timestamps, referrer context, anti-abuse evidence, and error logs needed to protect and operate the site.
- Cookie and local preference records, including essential consent state and optional functional, analytics, or marketing category choices where those features are enabled.
- If WordPress comments, avatars, or Gravatar-backed profile features are enabled, an anonymized email hash or profile lookup may be sent to Automattic or Gravatar so an avatar can be checked or displayed.
Do not submit credentials, secrets, private keys, regulated personal data, confidential infrastructure details, or customer security findings through public forms.
Why we use this data
- Respond to your request, qualify a demo or early-access conversation, prepare requested follow-up, and manage pre-contract steps.
- Operate, secure, debug, measure, and improve the public site, including abuse prevention, spam controls, consent records, and service continuity.
- Send product, launch, or company updates only where you opted in or where another lawful basis permits the communication.
- Meet legal, accounting, security, audit, and accountability obligations, including records that show how and when consent or a request was received.
For GDPR and UK GDPR purposes, the usual lawful bases are consent, legitimate interests in operating and protecting a B2B marketing site, steps requested before a contract, and legal obligation where records must be retained.
Sharing, processors, and transfers
- We use service providers for hosting, security, email delivery, form handling, CRM or lead follow-up, analytics, consent management, and operational support.
- We may share only what is necessary with those providers, under contractual, confidentiality, security, and access-control restrictions appropriate to the service.
- If Automattic, Gravatar, anti-spam, embedded media, analytics, or email providers are active, their own privacy terms may also apply to the data they process for their services.
- Where data is transferred internationally, we use appropriate safeguards such as contractual protections, provider data-protection terms, and transfer controls required for the processing context.
We do not ask visitors to submit sensitive categories of personal data through this site, and public marketing forms are not designed for confidential security disclosures.
Your GDPR and UK GDPR rights
- You can ask for access to the personal data we hold about you and for a copy of relevant data in a portable format where the law gives that right.
- You can ask us to correct inaccurate data, erase data, restrict processing, or object to processing based on legitimate interests or direct marketing.
- Where processing is based on consent, you can withdraw consent at any time. Withdrawal does not affect processing that happened before the withdrawal.
- You may also have the right to complain to your local data-protection authority if you believe your request or privacy concern was not handled properly.
California CCPA privacy notice
If the California Consumer Privacy Act (CCPA) applies to you and to our processing, you may have rights to know, access, correct, delete, and receive information about categories of personal information, sources, purposes, disclosures, and retention.
ThreatWarden does not sell personal information submitted through this public marketing site. If any future advertising or analytics setup creates a legally defined sale or sharing of personal information, we will provide the required notice and opt-out control.
We do not discriminate against visitors for exercising privacy rights. We may need to verify a request before acting on it so we do not disclose or delete data for the wrong person.
Children privacy and COPPA
Consistent with FTC/COPPA child privacy expectations, this site is intended for business and professional audiences. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13.
If you believe a child submitted personal information through this site, contact us so we can review and delete it where required. We do not use this site for child-directed advertising or child profiling.
Legal and privacy profile
- Controller
- ThreatWarden
United States - Privacy contact
- DPO contact
- Supervisory authority
- United States privacy regulators may include the Federal Trade Commission and applicable state privacy regulators. For California privacy matters, the California Privacy Protection Agency and California Attorney General may be relevant. EU/UK visitors may also contact their local supervisory authority.
- Data rights channel
- Privacy and data-rights requests can be submitted by email to . Please use the subject line "Data Rights Request" and include enough context for us to identify the relevant interaction, such as the email address used in a form, newsletter signup, demo request, or pre-launch request. We may need to verify the requester before disclosing, correcting, deleting, or restricting personal data.
- Legal bases
- Contact and demo requests: We process contact, demo, pilot, partnership, and pre-launch requests to respond to the request, qualify the conversation, prepare follow-up, and manage requested pre-contract steps.
For GDPR/UK GDPR purposes, the primary bases are steps requested before entering a contract, legitimate interests in operating a B2B product marketing and sales process, and consent where the visitor explicitly opts into optional follow-up or marketing communications. - Security and anti-abuse: We process technical telemetry, request metadata, IP address, browser or device signals, form-submission evidence, rate-limit evidence, and security logs to operate the site safely, prevent abuse, investigate suspicious activity, preserve service availability, and protect the integrity of public forms and admin workflows.
For GDPR/UK GDPR purposes, the primary basis is legitimate interests in securing and operating the public site, with legal obligation applying where records must be retained or disclosed to comply with law. - Optional email marketing: Optional email marketing, product updates, launch updates, and newsletter communication are based on opt-in consent where required.
Where B2B follow-up is permitted under applicable law, we may use legitimate interests for limited, relevant product communication related to the original business request, always with an unsubscribe or withdrawal path.
- Contact and demo requests: We process contact, demo, pilot, partnership, and pre-launch requests to respond to the request, qualify the conversation, prepare follow-up, and manage requested pre-contract steps.
- Recipients and processors
- We use operational service providers only as needed to run this marketing site and respond to requests.
Processor and recipient categories may include:
- hosting, infrastructure, backup, and deployment providers;
- domain, DNS, security, CDN, or WAF providers where enabled;
- SMTP and email delivery providers;
- lead/contact handling inside the private WordPress admin workflow;
- newsletter or email-marketing providers where enabled;
- analytics or campaign measurement providers where enabled and consented;
- anti-spam, abuse-prevention, and security-monitoring providers;
- Automattic or Gravatar only if WordPress comments, avatars, or Gravatar-backed profile features are enabled.
We do not ask visitors to submit secrets, credentials, private keys, confidential infrastructure data, regulated records, or customer security findings through public forms. - Retention
- Lead/contact records: Contact, demo, pilot, partnership, and pre-launch request records are retained for up to 24 months after the last meaningful interaction, unless a longer period is required for legal, accounting, dispute, security, or audit reasons.
If a request becomes a signed pilot, customer, or partner relationship, the relevant agreement and operational retention rules may apply instead. - Consent evidence: The browser consent preference cookie is retained for the configured consent period, currently up to 180 days unless changed in the Privacy and consent settings or cleared by the visitor.
Consent evidence attached to lead, newsletter, or contact records is retained with the associated record so we can demonstrate when and how the visitor made a privacy, marketing, or category choice. - Security events: Security, anti-abuse, rate-limit, and operational log evidence is normally retained for up to 90 days.
Records may be retained longer where needed to investigate abuse, protect the site, enforce security controls, preserve evidence, comply with legal obligations, or resolve a dispute.
- Lead/contact records: Contact, demo, pilot, partnership, and pre-launch request records are retained for up to 24 months after the last meaningful interaction, unless a longer period is required for legal, accounting, dispute, security, or audit reasons.
- International transfers
- Some operational providers may process data outside the visitor's country, including in the United States, EU/EEA, UK, or other locations where the provider operates.
Where international transfers apply, we rely on appropriate safeguards such as provider data-processing terms, contractual protections, adequacy decisions where available, Standard Contractual Clauses where required, access controls, and data minimization. - Email marketing withdrawal
- Every marketing or newsletter email should include an unsubscribe or preference-management path where supported by the email provider.
A visitor can also withdraw marketing consent by contacting or by using the unsubscribe link in the email. Withdrawal of marketing consent does not affect necessary service, security, or legal communications. - Cookie and tracking inventory
- Essential:
- tw_consent_state: stores the visitor's privacy/category consent state and policy version. Current default retention is 180 days.
- Security, form-protection, anti-abuse, language, and operational records required for the site to function safely.
Functional:
- Optional preference storage may be used where enabled to remember non-essential usability choices.
Analytics:
- Analytics scripts run only if analytics handles are configured in ThreatWarden Ops -> Privacy and consent and the visitor allows analytics cookies.
Marketing:
- Marketing scripts run only if marketing handles are configured in ThreatWarden Ops -> Privacy and consent and the visitor allows marketing cookies.
WordPress/Automattic/Gravatar:
- If WordPress comments, avatars, or Gravatar-backed profile features are enabled, an anonymized email hash or related request data may be sent to Automattic/Gravatar to check or display avatar information.
Embedded content:
- Embedded media, maps, video, social widgets, or external content may set their own cookies when loaded or interacted with, if such embeds are added to the site. - Last reviewed
- 2026-05-14
Retention, security, and updates
We keep personal data only for as long as needed for the request, consent evidence, security, legal, accounting, or operational purpose that required it. When it is no longer needed, we delete, aggregate, or anonymize it according to retention controls.
We use administrative, technical, and organizational safeguards designed to protect public-site data, but no internet service can guarantee absolute security.
We may update this policy when site features, providers, legal requirements, or processing purposes change. Material updates may trigger a renewed consent or preference review.