Your Privacy
Matters to Us

1.1 Who this policy covers

This Privacy Policy applies to:

• Visitors to https://www.spartanx.ai and our related sites, including our help center, trust center, and academy.
• Individuals who contact us, request a demo, attend an event, or subscribe to our communications.
• Authorized users of the SpartanX platform at app.spartanx.ai and our mobile application.
• Organizations that connect their systems and environments to the Services.

It does not apply to third-party websites or services that we link to but do not operate.

1.2 Our role: controller and processor

Data protection law distinguishes between the party that decides why and how personal data is processed (the controller) and the party that processes it on that party's instructions (the processor). SpartanX occupies both roles, and which one applies depends on the data.

SpartanX acts as a controller for information we collect for our own business purposes: account registration details, billing information, sales and marketing contacts, website analytics, and support correspondence. For this information, we determine the purposes of processing, and this Privacy Policy is the primary description of that processing.

SpartanX acts as a processor for all information our platform collects from, discovers within, or generates about a customer's technical environment. This includes Customer Security Data, Connected Systems Data, and Engagement Data as defined in Section 2. We process this information solely on the documented instructions of the customer, which acts as the controller. For this information:

• The customer's own privacy notice governs the relationship between that customer and its personnel or end users.
• Our processing obligations are set out in the Data Processing Agreement between SpartanX and that customer.
• Individuals who wish to exercise data protection rights over this information should contact the relevant customer. We will assist that customer in responding, as required by our agreement with them.

Customers and prospective customers may request our standard Data Processing Agreement, which incorporates the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, by contacting us or through the SpartanX Trust Center.

1.3 A note on regulated customers

SpartanX serves organizations subject to frameworks including PCI DSS, the NYDFS Cybersecurity Regulation (23 NYCRR Part 500), the GLBA Safeguards Rule, and the EU Digital Operational Resilience Act. Where a customer is subject to such a framework, our contractual commitments to that customer, including any requirements applicable to us as a third-party or ICT service provider, are set out in that customer's agreement. This Privacy Policy does not limit those commitments.

We organize information into five categories. The commitments in Section 4 apply with full force to Categories C, D, and E.

Category A: Account and Contact Data

Role: SpartanX is a controller.

Information identifying you as an individual who interacts with SpartanX:

• Registration information: name, business email address, company name, job title, business phone number, and authentication credentials. If you register through a third-party identity provider such as Google, Microsoft, or Okta, we receive the basic profile information that provider makes available to us, typically name, email address, and a profile image.
• Communications: the content of demo requests, support tickets, sales correspondence, survey responses, event registrations, and any attachments you choose to send us.
• Billing information: billing contact, billing address, and transaction records. Payment card details are collected and processed directly by our payment processor. We do not store complete payment card numbers on our systems.
• Organizational context: information you provide about your organization's size, sector, security program, and objectives, which we use to scope and configure the Services.

Category B: Site and Product Usage Data

Role: SpartanX is a controller.

Information generated automatically when you use our website or platform:

• Technical data: IP address, browser type and version, operating system, device identifiers, language and time zone settings.
• Usage data: pages viewed, features used, actions taken, session timing and duration, and error events.
• Approximate location derived from IP address. We do not collect precise geolocation unless you enable it for our mobile application.
• Server logs recording requests to our systems.

Category C: Customer Security Data

Role: SpartanX is a processor acting for the customer.

Information about a customer's technical environment that our platform collects, discovers, or generates in the course of delivering the Services:

• Attack surface inventory, including domains, hosts, IP ranges, exposed services, certificates, and cloud resources.
• System, network, identity, and application configurations.
• Validated exploit paths, findings, severity assessments, and remediation guidance.
• Evidence artifacts supporting findings, including request and response captures, screenshots, and logs.
• Remediation status, ticket references, and verification results.

Customer Security Data may incidentally contain personal data, for example an administrator's name in a configuration file or a user identifier in a log. It is handled under Categories C and E commitments regardless.

Category D: Connected Systems Data

Role: SpartanX is a processor acting for the customer.

Information SpartanX receives from third-party systems that a customer chooses to connect to the Services, accessed only with the authorization the customer grants and limited to what that authorization permits. This includes, depending on which integrations a customer enables:

• Cloud platform configuration and asset inventory from providers such as Amazon Web Services, Microsoft Azure, and Google Cloud Platform.
• Source code, repository metadata, and pipeline configuration from providers such as GitHub, GitLab, and Bitbucket.
• Identity and access data from identity providers such as Microsoft Entra ID and Okta.
• Issue, ticket, and workflow data from systems such as Jira and ServiceNow.
• Messages and channel metadata from communication platforms such as Slack and Microsoft Teams, where a customer enables notifications or workflows.
• Files, folders, and document contents from cloud storage and productivity platforms, including Google Drive and Google Workspace, Microsoft OneDrive and SharePoint, and Box, where a customer uses SpartanX to analyze existing security and compliance documentation.
• Findings and telemetry from existing security tooling, including scanners, SIEM, and endpoint platforms.

Section 5 sets out how integrations work, what each category of integration accesses, and the commitments that apply.

Category E: Engagement Data from Authorized Testing

Role: SpartanX is a processor acting for the customer.

Information our platform encounters inside a customer environment during authorized adversary simulation, including internal attack execution and targeted attack validation. This may include personal data belonging to the customer's employees or its own customers, credentials, session tokens, API keys, and other secrets. Section 7 governs this category specifically and imposes the strictest handling requirements in this Policy.

3.1 Category A and B: account, contact, and usage data

We use this information to:

• Create, authenticate, and administer accounts, and to provide customer support.
• Deliver, configure, bill for, and administer the Services.
• Send service and security notices, including notices of changes to the Services or this Policy. These are operational and you cannot opt out of them while you hold an account.
• Understand how our website and platform are used, diagnose faults, and improve usability, reliability, and performance.
• Detect, investigate, and prevent fraud, abuse, unauthorized access, and other security threats to SpartanX and our users.
• Send marketing communications about our products, research, and events, where you have consented or where permitted by applicable law. You can opt out at any time. See Section 13.
• Comply with legal, tax, accounting, and regulatory obligations.

3.2 Category C, D, and E: customer environment data

We use this information for one purpose only: to deliver the Services the customer has asked us to deliver, under that customer's instructions. In practice that means:

• Discovering and inventorying the customer's attack surface across its external and internal environments.
• Validating whether an exposure is genuinely exploitable, rather than theoretically vulnerable.
• Prioritizing findings by demonstrated business impact within that customer's environment.
• Generating remediation guidance, evidence, and compliance artifacts for that customer.
• Analyzing documents the customer selects, for example existing security policies and control narratives, against the frameworks the customer specifies, and returning gap analyses and recommendations to that customer.
• Integrating outputs into the customer's own workflows, for example creating tickets or opening pull requests where the customer has configured us to do so.
• Maintaining the security, availability, and integrity of the Services, and investigating suspected abuse.
• Complying with legal obligations that apply to us.

We do not use this information for any other purpose. Section 4 states this as a set of binding commitments rather than leaving it to inference.

3.3 What we use to improve the Services, and what we do not

We improve SpartanX using aggregated operational telemetry and metadata from Categories B and, in de-identified aggregate form, C: for example, feature usage counts, processing latency, error rates, model output acceptance and rejection signals, and false-positive reports submitted to us by customers.

We do not improve SpartanX using the substantive content of Categories C, D, or E. Specifically, we do not use a customer's configurations, source code, documents, files, findings content, captured evidence, credentials, or any material encountered during testing to train, fine-tune, evaluate, or otherwise develop generalized or foundational AI or machine learning models. Where a customer wishes to contribute specific material to product improvement, that requires a separate, written, revocable opt-in and is never a default.

The following commitments apply to all Customer Security Data (Category C), Connected Systems Data (Category D), and Engagement Data (Category E), collectively “Customer Environment Data,” regardless of which system it came from, which integration produced it, or which provider's API delivered it. They apply notwithstanding anything else in this Privacy Policy. Where any other section of this Policy could be read more broadly, these commitments control.

1. Purpose limitation. We use Customer Environment Data only to provide and secure the user-facing features the customer has requested, and to comply with law. We do not repurpose it.

2. No training of generalized AI models. We do not use Customer Environment Data to develop, improve, or train generalized, non-personalized, foundational, or frontier artificial intelligence or machine learning models. Customer Environment Data is never used as training, fine-tuning, or evaluation data for any such model, and is never stored in conjunction with any such model.

3. Per-customer AI processing only. Where artificial intelligence or machine learning is applied to Customer Environment Data, it is applied only to execute the feature the customer requested, at the time it is requested. Processing is scoped to that customer. Customer Environment Data is not co-mingled with the data of other customers or organizations, and outputs derived from one customer's data are never surfaced to another. See Section 6.

4. No sale and no data brokerage. We do not sell, rent, or license Customer Environment Data. We do not provide it to data brokers, information resellers, or list vendors.

5. No advertising or marketing use. We do not use Customer Environment Data for advertising of any kind, including targeted, personalized, retargeted, or interest-based advertising. We do not use it for marketing, market research, lead scoring, credit-worthiness assessment, or lending purposes. Customer Environment Data is never shared with advertising networks, marketing platforms, or analytics providers used for marketing.

6. Excluded from research and threat intelligence. Customer Environment Data is excluded from the research, publications, presentations, benchmark datasets, open-source contributions, and threat intelligence sharing described in Section 9. This exclusion applies in all forms, including aggregated, anonymized, and derived forms.

7. Limited human access. SpartanX personnel do not read Customer Environment Data except in these circumstances, each of which is logged and auditable:

• Where the customer has explicitly asked us to, for example in the course of a support request or a customer-requested review.
• Where necessary to investigate a security incident, suspected abuse, or a threat to the integrity of the Services.
• Where necessary to diagnose a specific reported fault that cannot be reproduced without access, and only to the extent required.
• Where required by law, subject to Section 9.4.

Access is granted on a least-privilege, time-bound basis to named personnel who are subject to background screening and written confidentiality obligations.

8. Tenant isolation. Customer Environment Data is logically segregated per customer. Access controls are enforced at the tenant boundary, and our platform's outbound processing paths are constrained so that data from one customer environment cannot flow into another.

9. Customer control and deletion. Customers can revoke any integration, terminate any processing, and request deletion of their Customer Environment Data at any time. See Section 12.

10. Sub-processor limitation. Customer Environment Data is disclosed only to the sub-processors listed in our Trust Center, each of which is bound by written contract to process it solely to provide services to SpartanX, and is specifically prohibited from using it to train or improve its own models. See Section 9.1.

5.1 How integrations work

SpartanX integrates with systems a customer already operates. Every integration follows the same principles:

• Opt-in. No integration is enabled by default. An authorized administrator at the customer must connect it.
• Minimum necessary authorization. We request the narrowest permissions that allow the feature to function. Where a provider offers a granular or read-only permission that is sufficient for our use case, we request that permission rather than a broader one.
• Transparency at the point of connection. Before you authorize an integration, SpartanX tells you what will be accessed and what it will be used for.
• Revocable at any time. You can disconnect an integration from your integration settings within SpartanX at any time, or revoke our access directly from the provider. Revocation immediately invalidates our access and refresh tokens and stops all further access.
• Governed by Section 4. All data received through an integration is Connected Systems Data and is subject in full to the Core Data Commitments.

Credentials and tokens for connected systems are stored encrypted in a dedicated secrets management service, with encryption keys managed separately from the data they protect and every retrieval logged. They are never exposed to other customers, and are never written to logs.

5.2 What each type of integration accesses

The precise permissions requested for each integration are shown at the point of connection and documented in our Help Center.

5.3 Google API Services

Where a customer connects a Google account, SpartanX accesses:

• Basic profile information for the connected Google Account, specifically name, email address, and profile image, to identify the connected account within the customer's SpartanX workspace.
• Google Drive file and folder metadata for the items the user selects, including file name, type, size, folder path, owner, and last-modified date.
• The contents of the Google Drive files the user selects through the SpartanX interface, for example security policies, standards documentation, and compliance evidence.

We use this data solely to display the user's Drive files and folders inside SpartanX for selection, to analyze the selected documents against the security and compliance frameworks the customer specifies, and to write the resulting reports and evidence artifacts back to the Google Drive location the customer designates. We do not use it for any other purpose.

SpartanX's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

For the avoidance of doubt, and consistent with Section 4: SpartanX does not use data received from Google APIs to develop, improve, or train generalized, non-personalized, foundational, or frontier AI or machine learning models; does not sell it or transfer it to data brokers or information resellers; does not use or transfer it for advertising, marketing, credit-worthiness, or lending purposes; excludes it from all research and threat intelligence activity described in this Policy, including in aggregated and anonymized form; and permits human review of it only in the enumerated circumstances set out in Commitment 7 of Section 4.

Users may revoke SpartanX's access to their Google account at any time from their integration settings within SpartanX or from the Google Account permissions page. Retention and deletion of data received from Google APIs is governed by Section 12.

5.4 Other providers' terms

Where an integration provider imposes its own data handling requirements on us, we comply with them in addition to this Policy. Our commitments under Section 4 meet or exceed those requirements in every case we are aware of. Where a provider's requirements are stricter than this Policy on any point, the stricter requirement applies to data received from that provider.

SpartanX is an AI platform. Being specific about how that AI handles your data is not optional for a company in our position.

6.1 How our AI processes data

Our platform coordinates specialized AI components that reason about a customer's environment: enumerating attack surface, forming and testing hypotheses about exploitability, chaining findings into validated attack paths, and drafting remediation guidance. These components operate within an orchestration architecture that constrains what they can access and where their outputs can go.

6.2 Constraints we place on that processing

• Scoped execution. Components operate only against the scope a customer has authorized, and only within that customer's tenant.
• Layered guardrails. Model inputs and outputs pass through policy enforcement layers that constrain permitted actions, block out-of-scope targets, and gate destructive or high-impact operations.
• Controlled egress. Outbound network paths from our processing environment are mediated and restricted, so that customer environment data cannot be sent to unapproved destinations.
• Customer-controlled autonomy. Customers configure how much our platform is permitted to do without human approval, and can require human authorization before defined classes of action.
• Auditability. Actions taken by our platform against a customer environment are logged and available to that customer.

6.3 Model providers

Where SpartanX uses third-party model providers to process Customer Environment Data, those providers are listed as sub-processors in our Trust Center and are bound by contract to zero-retention or limited-retention terms and to a prohibition on using our customers' data to train or improve their models.

6.4 Automated decision-making

SpartanX does not make decisions producing legal effects or similarly significant effects concerning individuals through solely automated means. Our platform produces findings, prioritization, and recommendations. Decisions about remediation, personnel, access, and enforcement remain with the customer. Where a customer configures SpartanX to take automated remediation action, that configuration and its consequences are determined by the customer as controller.

6.5 What we do not claim

We do not claim that AI processing eliminates the possibility of error. Findings should be reviewed by qualified personnel. Our commitments in this Policy concern how your data is handled, not the infallibility of our analysis.

Our platform simulates a real adversary against systems a customer has authorized us to test. In the course of that work, it may encounter material that is sensitive by nature. This section states how that material is handled. These commitments are in addition to, and do not limit, Section 4.

7.1 Authorization comes first

We test only in-scope assets a customer has expressly authorized in writing, within the parameters that customer sets. Scope, timing, intensity, and permitted techniques are defined by the customer before testing begins and are enforced by the platform.

7.2 What our platform may encounter

During authorized testing our platform may encounter:

• Personal data belonging to the customer's employees, contractors, or its own customers, held in systems within scope.
• Authentication credentials, session tokens, API keys, private keys, and other secrets.
• Business-confidential material stored in systems within scope.

7.3 How that material is handled

• Minimum necessary capture. We capture only what is required to demonstrate that an exposure is genuinely exploitable. We do not enumerate, export, or bulk-collect data sets beyond what proves the finding.
• Masking by default. Credentials, secrets, and personal data appearing in evidence artifacts are masked or truncated in reports and in the platform interface. Unmasked values are retained only where necessary to demonstrate exploitability and are access-restricted.
• No use of captured credentials beyond the engagement. Credentials and secrets obtained during testing are used only to demonstrate the attack path within the authorized scope. They are never used outside that scope and never disclosed to anyone other than the customer.
• Encrypted, segregated storage. Captured material is encrypted at rest, stored within the customer's tenant boundary, and subject to the access restrictions in Commitment 7 of Section 4.
• Retention tied to your account. Credentials and secrets, whether you provide them or our platform captures them, are held in an encrypted secret store for as long as you maintain an account with SpartanX, so that access paths can be re-validated across engagements. They are destroyed within 30 days of your account closing, or sooner on request. Evidence artifacts are retained per Section 12.
• Notification of exposed secrets. Where our platform discovers exposed credentials or secrets, we notify the customer promptly so they can be rotated.
• Never used for research. Material encountered during testing is excluded from all research, publication, and threat intelligence activity, in every form, without exception.

7.4 Third-party and personal data within scope

Customers are responsible for ensuring they have the authority to authorize testing of systems within scope, including where those systems are operated by a third party or contain personal data belonging to individuals other than the customer's own personnel. We act on the customer's authorization as processor and rely on the customer's representation of its authority.

If you are in the European Economic Area, Switzerland, or the United Kingdom, we process personal data only where we have a lawful basis.

Where SpartanX is a controller (Categories A and B):

Where SpartanX is a processor (Categories C, D, and E): the customer determines the legal basis. We process on that customer's documented instructions.

Where we rely on legitimate interests, you may request further information about the balancing assessment we conducted by contacting us.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

9.1 Sub-processors

We use a limited set of vendors to operate the Services. Each is bound by a written agreement that restricts them to processing data solely to provide services to SpartanX, imposes confidentiality and security obligations, and prohibits use of customer data to train or improve their own models.

Our current sub-processor list, including each vendor's role and processing location, is published at the SpartanX Trust Center. It includes our cloud infrastructure, database, model, communications, and payment providers.

Customers may subscribe to notification of sub-processor changes and, where their agreement provides for it, may object to a new sub-processor. We provide at least 30 days' notice before a new sub-processor begins processing Customer Environment Data.

Customer Environment Data is disclosed only to sub-processors identified as processing it. Vendors we use for marketing, advertising, sales, or website analytics never receive Customer Environment Data.

9.2 At your direction

We share information where you instruct us to, for example by configuring SpartanX to create issues in your ticketing system, post to your Slack workspace, or open pull requests in your repositories. You control these configurations.

9.3 Research and threat intelligence

SpartanX Labs publishes security research. That research is derived from SpartanX Labs' own investigation, from systems and environments we operate or are authorized to study for that purpose, and from publicly available sources. It does not draw on Customer Environment Data.

Where we share threat indicators with the security community, industry sharing organizations, or government cybersecurity bodies, we share only indicators derived from those sources. Customer Environment Data is excluded, in every form, including aggregated, anonymized, and derived forms.

If we ever wish to publish material derived from a specific customer's environment, for example a case study, we will obtain that customer's written permission first, and that permission is specific, revocable, and never a condition of service.

9.4 Legal requirements

We may disclose information where we believe in good faith it is necessary to comply with applicable law or valid legal process, to protect the rights, property, or safety of SpartanX, our customers, or the public, or to investigate suspected fraud or violations of our Terms of Service.

Where we receive a legal demand for Customer Environment Data, we will, unless legally prohibited, notify the affected customer before disclosing, so that customer can seek protective relief. We will object to demands that are overbroad or legally defective, and will disclose only what is legally required.

9.5 Corporate transactions

In a merger, acquisition, financing, reorganization, sale of assets, or insolvency, information may be transferred to the counterparty or successor. Any such transfer is subject to the acquirer's continued adherence to commitments materially equivalent to those in this Policy with respect to Customer Environment Data. We will notify affected customers and provide any choices required by applicable law.

9.6 Professional advisors

We may share Category A and B information with our legal, accounting, insurance, and audit advisors under professional confidentiality obligations.

A cybersecurity company that cannot secure its own platform has no business securing anyone else's. We hold ourselves to the standard we assess our customers against.

10.1 Technical measures

• Encryption. TLS 1.3 or higher in transit. AES-256 or equivalent at rest.
• Key and secret management. Encryption keys and integration credentials are managed in a dedicated secrets management service with rotation and access logging. Secrets are never written to application logs.
• Access control. Multi-factor authentication, role-based access control, and least-privilege provisioning for all internal access. Privileged access is time-bound and reviewed.
• Tenant isolation. Customer environments are logically segregated. Isolation is enforced at the data, processing, and network layers, and outbound processing paths are constrained so data cannot cross tenant boundaries.
• Network security. Segmentation, egress filtering, intrusion detection, and continuous monitoring.
• Secure development. Threat modeling, code review, dependency scanning, and security testing in the development lifecycle.
• Continuous self-assessment. We run SpartanX against SpartanX. Our own attack surface is continuously validated by our own platform, and findings are remediated under the same standards we recommend to customers.
• Independent assessment. We operate a formal security program and are pursuing SOC 2 attestation, beginning with a Type 1 examination followed by Type 2, supported by continuous control monitoring. The report will be available under NDA on completion. Our security program is described in full on our site, and current documentation is published at the Trust Center.

10.2 Organizational measures

Background screening for personnel with access to production systems or customer data, written confidentiality obligations for all personnel and contractors, role-appropriate security training, a documented incident response program that is exercised, and vendor security review before onboarding.

10.3 Incident notification

No system can be guaranteed secure. If a security incident affects data we hold:

• Where SpartanX is a processor, we will notify the affected customer without undue delay and in any event within 48 hours of determining that a reportable incident or breach has occurred, so that the customer can meet its own regulatory obligations. We will provide the information reasonably available to us about what occurred, what data was involved, and what we are doing, and will supplement as the investigation progresses. A shorter period applies where law or contract requires one.
• Where SpartanX is a controller, we will notify affected individuals and supervisory authorities as required by applicable law, within the timeframes that law prescribes.
• In both cases we will take immediate steps to contain and remediate, preserve evidence, and cooperate with regulators and law enforcement as appropriate.

SpartanX is headquartered in the United States, and our primary processing operations are located in the United States, in a private cloud environment. If you are outside the United States, your information may be transferred to, stored in, and processed in the United States and in other countries where our sub-processors operate. Processing locations for each sub-processor are listed in our Trust Center.

Where we transfer personal data from the EEA, Switzerland, or the United Kingdom to a country without an adequacy decision, we rely on:

• The European Commission's Standard Contractual Clauses, and the UK International Data Transfer Addendum for UK transfers, incorporated into our Data Processing Agreement and into our agreements with sub-processors.
• Transfer impact assessments for onward transfers, and supplementary technical and organizational measures including encryption in transit and at rest, key management that restricts sub-processor access, and the government-request handling commitments in Section 9.4.

Customers requiring specific data location commitments should raise this before contracting so it can be addressed in their agreement.

We keep information only as long as we need it for the purpose it was collected, or as long as law requires.

12.1 Category A and B: account, contact, and usage data

12.2 Category C, D, and E: customer environment data

Retention is set by the customer's agreement. By default, customer environment data is held for as long as the customer maintains an account with SpartanX, and is deleted on the schedule below once that account closes.

12.3 Deletion, revocation, and export

• Disconnect an integration at any time from your integration settings within SpartanX, or directly through the provider. Revocation is immediate.
• Request deletion of Customer Environment Data at any time by contacting us or through your account team. We complete verified deletion requests within 30 days.
• On termination, customers may export their data during the retention window above. After it expires, Customer Environment Data is deleted.
• Backups. Deleted data persists in encrypted backups until those backups rotate out, within 90 days. Backups are not restored to circumvent a deletion request.
• Legal hold. We may retain data beyond these periods where required by law or where necessary to establish, exercise, or defend legal claims. We will limit any such retention to what is necessary and notify the affected customer where permitted.

13.1 Rights available to individuals

Depending on where you are, you may have the right to:

• Access the personal information we hold about you and obtain information about how it is processed.
• Correct inaccurate or incomplete information.
• Delete your personal information in defined circumstances.
• Restrict or object to processing, including objecting to processing based on legitimate interests and to direct marketing.
• Portability, receiving your information in a structured, commonly used, machine-readable format.
• Withdraw consent at any time where processing is based on consent, without affecting processing carried out before withdrawal.
• Not be discriminated against for exercising these rights.
• Appeal a refusal of a request, where applicable law provides for an appeal. Our decision and the reasons for it will be provided in writing.

13.2 How to exercise them

Contact us through our contact form. We respond within the timeframes applicable law requires, generally within 30 days, and will tell you if we need an extension. We may need to verify your identity, and will limit that verification to what is necessary.

You may use an authorized agent where applicable law allows. We will require proof of authorization.

13.3 If your request concerns customer environment data

If your request concerns information processed by SpartanX on behalf of a customer, that customer is the controller. Direct your request to that organization. If you contact us and we can identify the relevant customer, we will refer your request to them and assist them in responding.

13.4 United States state privacy rights

Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have the rights described in 13.1, subject to the terms of the applicable statute.

Notice regarding sale and sharing. We do not sell personal information and we do not share personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act as amended. We have not done so in the preceding 12 months.

Sensitive personal information. In the course of providing the Services, SpartanX may process account credentials and similar material, which may constitute sensitive personal information under California law. We use and disclose it only to perform the Services, and only for the purposes permitted under Cal. Civ. Code § 1798.121(a). We do not use it to infer characteristics about individuals.

Categories. The categories of personal information we collect, the sources, business purposes, and categories of recipients are described in Section 2, Section 3, and Section 9. Retention is described in Section 12.

Global Privacy Control. We honor opt-out preference signals, including Global Privacy Control, transmitted by your browser as a request to opt out of sale and sharing where applicable.

13.5 Marketing preferences

Unsubscribe using the link in any marketing email, adjust your preferences in your account settings, or contact us. Service and security notices are operational and continue while you hold an account.

13.6 Complaints

If you are in the EEA, Switzerland, or the UK, you may lodge a complaint with your local supervisory authority. We would appreciate the chance to address your concern first.

We use cookies and similar technologies on our website. Our platform at app.spartanx.ai uses only cookies strictly necessary for authentication, security, and session management.

Manage your choices through our cookie banner and preference center, or through your browser settings. Disabling some cookies may affect functionality. We also use web beacons in marketing emails and local storage for performance, both subject to the same consent framework.

Cookies never carry Customer Environment Data. Analytics and marketing technologies operate on our public website and on aggregate product usage only.

Managed security service providers and other partners use SpartanX to deliver services to their own customers.

In these arrangements:

• The MSSP or partner is the controller with respect to its own customers' data, and determines the purposes of processing. SpartanX acts as a processor, and as a sub-processor with respect to the partner's end customers.
• The partner is responsible for having a lawful basis and appropriate authorization to process its customers' data through SpartanX, including authorization to conduct testing against its customers' systems.
• Each end customer's environment is maintained as a logically separate tenant. Data does not flow between tenants. A partner sees only the tenants it is authorized to administer.
• All commitments in Section 4 apply to every tenant, at every level of the arrangement.
• Where an end customer needs information about how its data is handled, the partner is its point of contact, and we will support the partner in responding.

The Services are enterprise security tools intended for use by businesses and their authorized personnel. They are not directed to children, and we do not knowingly collect personal information from anyone under 16. If we learn we have, we will delete it promptly. Parents and guardians who believe a child has provided us information should contact us.

We may update this Policy to reflect changes in our practices, the Services, or applicable law. When we do, we will update the “Last Updated” date above.

For material changes, and in particular for any change to the Core Data Commitments in Section 4, to our sub-processors, or to how we handle Customer Environment Data, we will provide notice by email or through the Services at least 30 days before the change takes effect, and will obtain consent where applicable law requires it.

We maintain a record of material changes to this Policy. Prior versions are available on request by contacting us.

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

We will respond to your inquiries promptly and work to address any concerns you may have about our privacy practices.