Privacy Policy

Who we are

OffSet7 ThreatIntel is a threat-intelligence service operated by Set7, LLC, a company in the United States. We are responsible for the personal information described in this policy. Questions: [email protected].

Information we collect

Information you give us:

• Account details: name, email address, and optionally phone number and country; your password, which we store only as a one-way hash.
• If you sign in with Google: your Google account email and identifier. We never receive your Google password.
• What you set up: watchlists (technologies, countries, sectors), saved items, notification and alert preferences, organization and team membership.
• Exposure checks: the email address or verified domains you ask us to check against breach and leak data.
• Messages you send us, such as support requests or reports about content.

Information collected automatically:

• Security and activity records: sign-ins, password changes, sessions, and actions on sensitive features, with IP address, approximate location derived from the IP address, browser or app version, and device type.
• If you allow notifications in the mobile app: a push token from Apple or Google so we can deliver alerts to your device.
• Essential technical data needed to run the Service, such as error logs.

We do not use advertising identifiers, we do not use third-party advertising or analytics trackers, and we do not sell personal information.

People named in threat-intelligence data

To provide the Service, we collect and analyze information that is already published or circulating elsewhere: security news, vulnerability databases, ransomware leak-site claims, and breach or "infostealer" datasets. These sources can contain names of organizations and, in some cases, personal information such as email addresses or usernames.

We use this information only for security purposes: to warn organizations and individuals that their data or systems may be exposed, and to help them respond. In the mobile app we never display leaked passwords. On the website, access to sensitive records is limited to the account owner or to verified owners of a domain, and is logged.

If you believe information about you or your organization appears in the Service and is inaccurate, or you want to ask about it, contact [email protected]. We review every request and correct or remove information where appropriate and permitted by law.

Third-party data sources

Some intelligence in the Service comes from third parties: public vulnerability databases, news publishers, security researchers and commercial or community data providers that collect breach and leak data. We choose sources that state they collect lawfully, we use their data only to deliver security intelligence, and we do not buy data in order to profile individuals or for marketing.

Cookies and similar technologies

The website uses only what is needed to work: storage in your browser that keeps you signed in, remembers settings such as language and theme, and protects against abuse. We do not use advertising cookies or third-party tracking pixels. Our network provider, Cloudflare, may set a strictly necessary cookie to protect the site from attacks. You can clear cookies and site data in your browser, but you will be signed out.

Aggregated and de-identified information

We may create statistics that do not identify you or any person, such as the number of ransomware claims per country or sector, and use or publish them to explain trends. We do not try to re-identify de-identified information.

How we use information

• To create and secure your account, sign you in, and keep you signed in.
• To run your watchlists and send the alerts and summaries you ask for, by email, push notification or integrations you connect.
• To run exposure checks you request and show you the results.
• To protect the Service and our users: detect suspicious sign-ins, abuse and fraud, and keep an audit trail of sensitive actions.
• To provide support, send essential service messages (such as security codes and account notices), and improve the Service.
• To comply with law and enforce our Terms of Service.

How we share information

We share personal information only as described here:

• Service providers that host and operate the Service for us, under contracts that limit their use of the data: cloud hosting and storage, Cloudflare (network delivery and security), Google (sign-in and Firebase Cloud Messaging push notifications), Apple (push notifications on iOS), and our email delivery provider.
• Within your organization: if you belong to a team workspace, its administrators can see your membership and activity in that workspace.
• Integrations you turn on, such as Slack, Microsoft Teams or webhooks, receive the alerts you choose to send there.
• When required by law, to respond to valid legal process, or to protect the rights, safety and security of our users, the public or ourselves.
• In a merger, acquisition or sale of assets, subject to this policy.

We do not sell or rent personal information and do not share it for cross-context behavioral advertising.

How long we keep information

• Account information: while your account is open. When you delete your account, we delete or anonymize your account data within 30 days, except where we must keep it longer by law.
• Security and audit records: up to 400 days for sign-in, security and data-access events, and up to 90 days for routine access logs.
• Security codes sent by email expire within minutes and can be used once.
• Backups are overwritten on a regular cycle.

Your choices and rights

• Access and correct: you can view and update your profile in Settings.
• Delete: you can delete your account in the app (Account → Settings → Delete account) or on the website, or by emailing us. Steps and details: https://offset7.com/Deletion.html
• Notifications: you can change or turn off email and push alerts at any time in Settings or in your device settings.

Depending on where you live, you may have additional rights, such as to request a copy of your information, to request deletion or correction, or to opt out of certain processing. Residents of California and other US states with privacy laws may exercise these rights by contacting [email protected]; we will not discriminate against you for doing so. If you are in the European Economic Area or the United Kingdom, you may also object to processing and complain to your local data-protection authority. We may need to verify your identity before acting on a request.

Security

We protect information with encryption in transit, hashed passwords, access controls, audit logging and monitoring. No system is completely secure; if we learn of a breach affecting your personal information, we will notify you as required by law.

Protecting yourself from identity theft and phishing

• We will never ask for your password, or for a security code we sent you, by phone, chat or email. Codes are entered only in the OffSet7 app or at app.offset7.com.
• Our emails come from addresses ending in @offset7.com. Be careful with messages that claim to be from us but link elsewhere.
• If the Service shows that your credentials were exposed, change that password everywhere you used it and turn on two-factor sign-in.
• If you receive a suspicious message that uses our name, forward it to [email protected].

Users in the European Economic Area, United Kingdom and Switzerland

If data-protection law of the EEA, UK or Switzerland applies to you, these additional terms apply.

Legal bases. We process personal information:

• to perform our contract with you (providing your account, watchlists, alerts and checks you request);
• for our legitimate interests in keeping the Service and its users secure, preventing fraud and abuse, and providing security intelligence that helps organizations and individuals protect themselves, balanced against your rights;
• to comply with legal obligations; and
• with your consent, such as for push notifications, which you can withdraw at any time without affecting earlier processing.

Your rights. Subject to legal limits, you can ask to access, correct or delete your personal information, to restrict or object to processing (including processing based on legitimate interests), and to receive your information in a portable format. You can also complain to your local data-protection authority.

Transfers. When we transfer personal information outside the EEA, UK or Switzerland, we rely on safeguards recognized by law, such as the European Commission's Standard Contractual Clauses and the UK addendum, or on another valid transfer mechanism.

To exercise these rights, email [email protected]. We respond within the time the law requires, normally one month.

International processing

We and our providers may process information in the United States and other countries whose laws may differ from those where you live. Where required, we use appropriate safeguards for these transfers.

Children

The Service is intended for professionals and is not directed to children. You must be at least 18 to create an account. We do not knowingly collect personal information from children under 13, consistent with the US Children's Online Privacy Protection Act (COPPA), or from anyone under 18 through account registration. If you believe a child has given us personal information, contact us and we will delete it.

Governing law

This policy is governed by the laws of the State of Delaware, USA, without limiting any rights you have under the data-protection laws of the place where you live.

Changes to this policy

We may update this policy. If we make material changes, we will notify you in the Service or by email before they take effect. The date at the top shows when it was last updated.

Contact

Set7, LLC · [email protected]