✓ OUR COMMITMENT TO YOU
We do not sell your personal data. We do not use your Customer Data to train AI models. We do not show you ads. The Platform is a security tool — your security telemetry stays yours. This policy was written by our legal team, not generated automatically, and is reviewed every 6 months.
// 01
Overview & Data Controller
This Privacy Policy describes how Sentinel Systems Inc. ("we", "us", "our") collects, uses, stores, and protects personal data when you use the SentinelPRO IA platform, website, APIs, and related services (collectively, "Platform").
Data Controller: Sentinel Systems Inc., 1209 Orange Street, Wilmington, Delaware 19801, United States.
EU/EEA Representative: Sentinel Systems Europe GmbH, Friedrichstraße 123, 10117 Berlin, Germany. Email:
UK Representative: Sentinel Systems UK Ltd., 30 St Mary Axe, London EC3A 8BF. Email:
ℹ SCOPE OF THIS POLICY
This policy applies to data we collect about you as an individual user. For data you process through the Platform (Customer Data), we act as a data processor — your organization is the data controller and your own privacy policies apply to your end users.
// 02
Data We Collect
We collect the following categories of data, each for a specific purpose:
ACCOUNT DATA
- Name, email address
- Company name, job title
- Country / region
- License key (UUID)
- Account creation date
PAYMENT DATA
- Billing address, VAT number
- Last 4 digits of card (Stripe)
- Transaction IDs and history
- Payment method type
- Invoice records
USAGE DATA
- Features accessed, screens viewed
- Session duration, frequency
- API calls (count, endpoints)
- License validation events
- Error logs (anonymized)
TECHNICAL DATA
- IP address (hashed after 30d)
- Browser type, OS version
- Device fingerprint (partial)
- Timezone, language preference
- Referral source (UTM params)
SECURITY TELEMETRY
- Anonymized threat indicators (IOCs)
- Aggregated attack pattern data
- Module-level event counts
- No raw endpoint data leaves your network
- Opt-out available in settings
COMMUNICATIONS
- Support ticket content
- Demo request form data
- Email open/click analytics
- Survey responses
- Chat transcripts (with consent)
⚠ WHAT WE DO NOT COLLECT
We do not collect raw network packet contents, endpoint file contents, passwords, or any data from your monitored systems beyond anonymized threat indicators. The Platform processes security telemetry locally on your infrastructure — it does not exfiltrate your raw security data to our servers.
// 03
How We Use Your Data
- License management: Validating keys, enforcing seat limits, processing renewals and cancellations
- Service delivery: Providing access to Platform features, API rate limiting, uptime monitoring
- Billing & payments: Processing transactions, issuing invoices, fraud prevention
- Security: Detecting unauthorized access, key sharing violations, ban enforcement
- Product improvement: Aggregated, anonymized usage analytics to improve features and performance
- Communications: Transactional emails (receipt, key delivery, expiry warnings), with opt-out for marketing
- Legal compliance: Responding to lawful requests, maintaining required records
- Threat intelligence: Contributing anonymized IOCs to the global threat intelligence network (opt-out available)
🚫 WE NEVER
Sell your personal data to third parties · Use your data to train AI/ML models without explicit consent · Share your data with advertisers · Profile you for behavioral advertising · Use your Customer Data for any purpose other than service delivery
// 04GDPR ART. 6
Legal Basis for Processing
Under GDPR, we rely on the following legal bases for each processing activity:
| PROCESSING ACTIVITY | LEGAL BASIS | GDPR ARTICLE |
|---|---|---|
| License activation & management | Contract performance | Art. 6(1)(b) |
| Payment processing | Contract performance | Art. 6(1)(b) |
| Fraud & abuse detection | Legitimate interests | Art. 6(1)(f) |
| Product analytics (aggregated) | Legitimate interests | Art. 6(1)(f) |
| Marketing communications | Consent | Art. 6(1)(a) |
| Threat intel contribution | Consent | Art. 6(1)(a) |
| Tax & financial records | Legal obligation | Art. 6(1)(c) |
| Security incident response | Vital interests / Legal obligation | Art. 6(1)(d)(c) |
// 05
Data Sharing & Third Parties
We share your data only with the following categories of trusted service providers, under strict data processing agreements:
- Stripe Inc. — Payment processing. Stripe is PCI DSS Level 1 certified. We do not store full card details. Stripe Privacy Policy ↗
- Amazon Web Services (AWS) — Cloud infrastructure (US-East, EU-West, APAC). Covered by AWS Data Processing Addendum.
- Cloudflare Inc. — CDN, DDoS protection, and DNS. Data subject to Cloudflare's privacy commitments.
- SendGrid (Twilio) — Transactional email delivery (receipts, key delivery, expiry alerts). Email content is encrypted in transit.
- Sentry.io — Anonymized error reporting (stack traces, no PII). Data retained 90 days.
- Legal & compliance: We may disclose data to law enforcement or regulatory bodies when required by valid legal process. We will notify you unless prohibited by law.
ℹ SUBPROCESSOR LIST
The complete, current list of our subprocessors is available at sentinelpro.ai/subprocessors. Enterprise customers with DPAs are notified 30 days before any new subprocessor is added.
// 06GDPR CH. V
International Data Transfers
As a US-based company serving global customers, we transfer personal data internationally. All transfers are protected by appropriate safeguards:
🇺🇸
UNITED STATES
Primary processing
SCCs + Addendum
🇩🇪
GERMANY / EU
EU data residency option
Adequacy Decision
🇬🇧
UNITED KINGDOM
UK GDPR compliant
UK Addendum
🇸🇬
SINGAPORE / APAC
APAC data residency option
PDPA Compliant
🇨🇦
CANADA
PIPEDA compliant
PIPEDA
🇦🇪
UAE / MENA
SCCs in place
SCCs
For EU/EEA users, transfers to the US are covered by Standard Contractual Clauses (SCCs) as approved by the European Commission in June 2021. A copy of our SCCs is available on request from .
// 07
Data Retention
We retain your data only as long as necessary for the purposes described in this policy:
| DATA TYPE | RETENTION PERIOD | LEGAL BASIS |
|---|---|---|
| Account & profile data | Duration of subscription + 90 days | Contract |
| License key records | 7 years from last use | Legal obligation (tax) |
| Payment & invoice records | 7 years | Legal obligation (tax/audit) |
| Support communications | 3 years from ticket close | Legitimate interests |
| Usage analytics (raw) | 12 months | Legitimate interests |
| Usage analytics (aggregated) | Indefinite (no PII) | Legitimate interests |
| IP addresses | 30 days (then hashed) | Security / fraud prevention |
| Security/audit logs | 12 months | Legal obligation / security |
| Marketing consent records | 3 years from last consent | Legal obligation (GDPR) |
ℹ DELETION REQUESTS
You may request deletion of your account data at any time. We will process deletion within 30 days. Note: we are required by law to retain financial records (invoices, tax data) for 7 years regardless of deletion requests. These records are isolated from your operational account data.
// 08ePrivacy
Cookies & Tracking
We use cookies and similar technologies on our website. The Platform application itself uses only functional localStorage for license state — no third-party tracking cookies.
// 09ISO 27001
Security Measures
We implement industry-leading security controls to protect your data:
ENCRYPTION
- AES-256 encryption at rest
- TLS 1.3 in transit (enforced)
- Key management via AWS KMS
- License keys hashed (SHA-256)
ACCESS CONTROLS
- Zero-trust internal architecture
- Role-based access (RBAC)
- MFA enforced for all staff
- Privileged access reviews quarterly
MONITORING
- 24/7 SOC monitoring (we eat our own food)
- SIEM with real-time alerts
- Anomaly detection on all data access
- Annual third-party penetration testing
COMPLIANCE
- ISO 27001 certified (cert #IS123456)
- SOC 2 Type II (available on NDA)
- PCI DSS Level 1 (via Stripe)
- GDPR DPA available on request
⚠ RESPONSIBLE DISCLOSURE
If you discover a security vulnerability in our Platform or believe your data has been compromised, please contact immediately. We operate a responsible disclosure program and will respond within 24 hours.
// 10GDPR ART. 15-22CCPA
Your Rights
Depending on your jurisdiction, you have the following rights over your personal data:
| RIGHT | DESCRIPTION | GDPR | CCPA | RESPONSE TIME |
|---|---|---|---|---|
| ACCESS | Receive a copy of all personal data we hold about you | ✓ | ✓ | 30 days |
| DELETION | Request erasure of your data (subject to legal retention obligations) | ✓ | ✓ | 30 days |
| PORTABILITY | Export your data in machine-readable format (JSON/CSV) | ✓ | Partial | 30 days |
| RECTIFICATION | Correct inaccurate or incomplete personal data | ✓ | ✓ | 14 days |
| OBJECTION | Object to processing based on legitimate interests or for direct marketing | ✓ | Limited | 30 days |
| RESTRICTION | Restrict processing while a dispute is under review | ✓ | No | 72 hours |
| OPT-OUT (SALE) | We do not sell data — this right is satisfied by default | N/A | ✓ Auto | Instant |
| WITHDRAW CONSENT | Withdraw consent for marketing or threat intel contribution at any time | ✓ | ✓ | Instant |
// SUBMIT A DATA RIGHTS REQUEST
We will verify your identity before processing. Response within 30 days as required by GDPR Art. 12. For urgent requests, email directly.
🏛 SUPERVISORY AUTHORITY
If you are in the EU/EEA and believe we have not handled your data rights properly, you have the right to lodge a complaint with your local supervisory authority. Our lead supervisory authority under GDPR is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI) in Germany. You may also contact your local DPA.
// 11
Children's Privacy
The Platform is a professional cybersecurity tool intended for business use by adults. We do not knowingly collect personal data from individuals under the age of 18 (or the applicable age of majority in their jurisdiction).
If you believe a minor has provided us with personal data, please contact immediately and we will delete such data within 72 hours.
// 12GDPR ART. 33-34
Data Breach Response
In the event of a personal data breach, we follow a documented incident response procedure:
STEP 1
0–1 HOUR
Incident detected and contained. Affected systems isolated. Incident response team activated. Initial severity assessment completed.
STEP 2
1–24 HRS
Forensic analysis of scope and impact. Determination of whether personal data was affected. Preliminary assessment of affected individuals.
STEP 3
24–72 HRS
Notification to supervisory authority (GDPR Art. 33) if breach poses risk to individuals. Notification within 72 hours of discovery as required.
STEP 4
72 HRS+
Direct notification to affected individuals (GDPR Art. 34) if breach poses high risk. Notification includes: nature of breach, data affected, recommended actions, DPO contact.
STEP 5
POST-INC.
Full incident report published (redacted). Remediation measures implemented. Process improvements applied. Post-mortem shared with enterprise customers.
// 13
Changes to This Policy
We review this Privacy Policy every 6 months and update it whenever our data practices change materially. When we make significant changes, we will:
- Post the updated policy on this page with a new effective date
- Send an email notification to all account holders at least 14 days before material changes take effect
- Display an in-platform notification on your next login
- Maintain an archived version of all previous policies at sentinelpro.ai/privacy/archive
For changes that affect how we process data you have already provided, we will seek fresh consent where required by law.
// 14
Contact & Data Protection Officer
// GENERAL PRIVACY
Privacy Team
General questions, opt-outs, preferences
// DATA PROTECTION OFFICER
DPO (GDPR Art. 37)
GDPR requests, DPA queries, rights requests. Response: 72h
// LEGAL TEAM
Legal Counsel
Law enforcement requests, subpoenas, SCCs
✓ VERSION HISTORY
v3.1 (Mar 2026) — Added APAC/MENA transfer safeguards, updated retention table, added breach response timeline · v3.0 (Sep 2025) — Major GDPR refresh, DPO contact added · v2.0 (Mar 2025) — CCPA compliance section added · v1.0 (Sep 2024) — Initial release