Privacy Policy

This policy describes how SpectGrid handles information. It should be reviewed by your counsel and finalized before launch; it is written to be accurate to the product, not to serve as legal advice.

1. Who we are

SpectGrid.AI (“SpectGrid,” “we,” “us”) provides browser-based data-security software — DataGate (data loss prevention for AI and web apps) and TrustGate (credential and brand protection). This policy covers this marketing website and the SpectGrid service (the browser extension and administrator console).

2. Our core privacy principle: the sensitive value never leaves the device

SpectGrid is built so that the content it inspects stays on the employee’s machine. Detection runs locally in the browser extension. When a policy warns or blocks, we transmit and store only redacted telemetry — a masked snippet plus the policy outcome (for example, the data-element type, the site, and whether it was warned or blocked). We do not receive or store the raw secrets, credentials, passwords, or full document contents that the product inspects.

3. Information we handle

a. Information you give us (website). Contact details you submit through a demo request or email — such as your name, work email, company, and any message — used to respond to you.

b. Service telemetry (customer deployments). Redacted security-event records generated by the product: the masked snippet, the matched data element or brand, the site/domain, the action taken (IGNORE/WARN/BLOCK), the enforcement mode, timestamps, and — where a customer configures managed identity — an employee identifier chosen by the customer. This data belongs to the customer organization; SpectGrid processes it on their behalf.

c. Operational data. Standard information needed to run the service securely — authentication and session data, extension heartbeat/version for coverage reporting, API-key usage metering, and server logs.

We do not collect general browsing history. The extension acts only on the sites a customer configures, and usage signals (for example, visits recorded for shadow-AI reporting) are limited to a curated set of known AI tools — never arbitrary browsing.

4. How we use information

• To provide, operate, secure, and improve the service.
• To respond to demo requests and support inquiries.
• To generate the analytics, reports, and audit trail available to the customer’s own administrators.
• To meet legal, security, and contractual obligations.

We do not sell personal information, and we do not use customer telemetry to train models.

5. Controller and processor

For customer service data, the customer organization is the controller and SpectGrid acts as the processor, handling data under the customer’s agreement and instructions. For website and account contact data, SpectGrid is the controller.

6. Sharing & sub-processors

We share information only with service providers that help us run the platform (such as cloud hosting and database infrastructure), under contract and only as needed to deliver the service; where required by law; or to protect the rights and safety of SpectGrid, our customers, and the public. A current sub-processor list is made available to customers as part of enterprise onboarding.

7. Data isolation & retention

Each customer organization’s data is isolated at the database level (row-level security), so one tenant can never access another’s. Customer event data is retained according to the retention policy the customer configures in their console, within platform limits, and is deleted thereafter. Website contact data is retained only as long as needed to respond and for reasonable business records.

8. Security

We encrypt data in transit, restrict access on a least-privilege basis, and design the product so the most sensitive values never reach our servers. For more detail, see our Security & Trust page.

9. Your rights

Depending on your location, you may have rights to access, correct, delete, or restrict the processing of your personal information. Because most service data is controlled by the customer organization, requests about that data are directed to the relevant customer; we assist them as processor. For website/contact data, contact us using the details below.

10. International transfers

Where information is processed in a country other than your own, we rely on appropriate safeguards for any such transfer, as described in our customer agreements.

11. Changes to this policy

We may update this policy from time to time. Material changes will be reflected here with a revised “last updated” date.

12. Contact

Questions about privacy? Email [email protected].