Privacy Policy

This Privacy Policy explains how Exposure Signal LLC, a New York limited liability company ("ExposureSignal," "we," "us," or "our"), collects, uses, shares, and protects personal information when you visit exposuresignal.com, use the ExposureSignal web application, scanning services, and endpoint or network agents, or otherwise interact with us (together, the "Service").

Information you provide to us:

• Contact and demo requests: your name, work email, phone number, company, job title, and the contents of your message.
• Account registration: your name, work email address, organization name, and organization domain, and the password you choose (stored only in hashed form).
• Billing: billing contact and plan details. Payments are processed by our payment provider, Stripe; we do not receive or store full payment card numbers.
• Support and communications: information you include when you email us, request support, or respond to surveys.

Information collected through the Service:

• Assets and scan results: domains, IP addresses, network ranges, hosts, and applications you add, along with the findings, vulnerabilities, and reports generated about them.
• Agent data: if you install an ExposureSignal agent, device information such as hostname, operating system, installed software and versions, configuration settings, and network details needed to assess exposure.
• Usage and AI interactions: actions you take in the application, settings you choose, and the questions you ask and responses you receive from AI-assisted features.

Information collected automatically:

• Device and log data: IP address, browser type, operating system, referring URL, pages viewed, and the dates and times of your visits.
• Cookies and similar technologies: see the "Cookies and analytics" section below.

Please do not send us passwords, secret keys, or other sensitive credentials through our forms or support channels.

We use the information we collect to:

• provide, operate, and maintain the Service, including running the scans and assessments you authorize;
• create and manage accounts, verify domain ownership, and authenticate users;
• process payments and manage subscriptions, trials, and usage allowances;
• respond to inquiries, schedule demos, and provide customer support;
• send service-related messages, such as security alerts, scan results, and account and billing notices;
• send product updates and marketing communications, where permitted, which you can opt out of at any time;
• monitor, secure, and improve the Service, including detecting abuse, fraud, and unauthorized testing;
• analyze trends and website performance; and
• comply with legal obligations and enforce our Terms of Service.

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Service, and understand how our website is used. Our website uses Google Analytics, loaded directly and through Google Tag Manager, to understand how the site is used. Google Analytics sets cookies and collects information about your visit, such as pages viewed, how you arrived at our site, your browser and device type, and an approximate location derived from your IP address. Google processes this information under its own privacy policy (policies.google.com/privacy), and you can opt out with the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout).

You can control cookies through your browser settings, including blocking or deleting them. Blocking certain cookies may affect how the Service works. Where required by law, we honor opt-out preference signals such as Global Privacy Control.

We do not sell personal information, and we do not rent or trade it. We share information only as described below:

• Service providers that help us operate the Service, such as cloud hosting, payment processing (Stripe), email delivery, analytics, customer support, and AI model providers. They may use the information only to provide services to us and must protect it.
• Within your organization: information in your account, including findings and reports, is visible to the users your organization authorizes.
• Legal and safety: when we believe disclosure is required by law, subpoena, or court order, or is necessary to protect the rights, property, or safety of ExposureSignal, our customers, or others, including to investigate unauthorized security testing.
• Business transfers: in connection with a merger, acquisition, financing, or sale of all or part of our business, subject to this policy.
• With your consent or at your direction.

We may share aggregated or de-identified information that cannot reasonably identify you, your organization, or your assets.

Information about your assets, scan results, and agent data is processed on behalf of the customer organization that controls the account. We treat it as confidential, use it only to provide and improve the Service and as described in our Terms of Service, and do not disclose your vulnerability findings to third parties except as described in this policy. If your organization has a separate agreement with us, such as a data processing agreement, that agreement also applies.

When you use AI-assisted features, relevant information such as your questions and related findings may be sent to third-party AI model providers to generate a response. We use providers that do not use this information to train their general-purpose models, and we do not use your data to train third-party general-purpose AI models.

We keep personal information for as long as needed to provide the Service, maintain your account, comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. When your account is closed, we delete or de-identify customer data within a reasonable period, as described in our Terms of Service, unless we are required to keep it longer. Information from contact and demo requests is kept as long as needed to respond and follow up.

As a security company, we take protecting your information seriously. We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls based on least privilege, and monitoring of our systems. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we learn of a security incident affecting your personal information, we will notify you as required by law.

Depending on where you live, you may have the right to request access to, correction of, or deletion of your personal information; to receive a copy of it in a portable format; to opt out of targeted advertising or certain processing; and to not be discriminated against for exercising these rights. Residents of California and other U.S. states with consumer privacy laws, and individuals in the European Economic Area, United Kingdom, and Switzerland, may have additional rights under applicable law.

You can unsubscribe from marketing emails at any time using the link in the email. We will still send service-related messages while you have an account.

ExposureSignal is based in the United States, and we process and store information in the United States. If you access the Service from outside the United States, your information will be transferred to, and processed in, the United States, where data protection laws may differ from those in your country. Where required, we use appropriate safeguards for these transfers.

The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

Our website and Service may link to third-party websites and services that we do not control. This policy does not apply to them, and we encourage you to review their privacy policies.

We may update this Privacy Policy from time to time. When we do, we will update the effective date above, and if the changes are material, we will notify you by email or through the Service before they take effect.