Glasswing AI
Privacy Policy

1 Scope

This Policy applies to personal information processed through:

• Glasswing websites and web pages, including product, purchasing, registration, self-service, account and support pages;
• the Scanner download, activation, entitlement, update, operation, assessment and reporting processes;
• product demonstrations, evaluations, beta programs, webinars, events and partner-supported assessments;
• sales, reseller, distributor, customer, prospect, support and other business communications; and
• other Glasswing products or services that link to this Policy.

This Policy does not govern the privacy practices of customers, reseller partners, distributors, employers, network owners or third parties that independently determine how they process personal information. Their own notices and policies may apply.

2 Our role

Glasswing may process personal information in different legal roles depending on the context:

• Controller or business. Glasswing generally determines the purposes and means of processing information about website visitors, purchasers, account contacts, prospects, event participants and individuals who communicate directly with us.
• Processor or service provider. When Glasswing processes customer personal information solely to provide contracted Scanner or other services on an organization’s behalf, the organization generally determines the purposes of processing and Glasswing acts under the applicable agreement and Data Processing Addendum.
• Independent controllers. Glasswing and a reseller, distributor, payment provider or other third party may each independently process certain information for their own legitimate business, compliance or contractual purposes.

If an organization provides you access to the Scanner, directs an assessment, or submits information about you, questions about that organization’s processing should generally be directed to that organization.

3 Personal information we collect

The information we collect depends on how you interact with Glasswing and which products or services you use. We may collect the categories below.

Category	Examples
Identifiers and contact information	Name, business email address, telephone number, company, job title, username, account identifier and business contact details.
Account and authentication information	Registration status, email-based PIN events, authentication records, session identifiers, access rights, entitlement status and account-security events. Glasswing should not retain a plaintext PIN after its permitted authentication period.
Commercial and transaction information	Products or services requested or purchased, order details, subscription term, seats, license or entitlement records, billing contact, transaction status and customer-support history.
Payment information	Payment status and limited transaction details received from a payment processor. Complete payment-card numbers and security codes should be collected and processed by the authorized payment provider rather than stored by Glasswing.
Website and device information	IP address, browser type, device type, operating system, referring URL, pages viewed, timestamps, cookie or similar identifiers, approximate location derived from IP address and website interaction data.
Scanner endpoint and configuration information	Scanner version, installation and activation events, operating-system type and version, endpoint or device identifier, registered endpoint, license seat, update status and relevant configuration or diagnostic information.
Network and assessment context	Public or local IP-related information where collected, DNS resolver configuration, tested path information, VPN or Zero Trust context where observable, assessment start and completion times, selected baseline, protocol observations, response status and security-control outcomes.
Assessment results and Product Output	Tested AI application or AI agent destinations; Accessible, Blocked, Redirected or Inconclusive classifications; DNS, TCP, TLS/SNI or permitted HTTP observations; risk scores; threat-reputation information; finding confidence; reports; remediation recommendations; and related metadata.
Support and communications information	Emails, telephone communications, questionnaire responses, screenshots, error messages, diagnostic files, logs, incident details and other information provided during sales, evaluation, support or testing.
Professional and relationship information	Employer, business role, reseller or distributor affiliation, customer or prospect relationship, assessment authorization and records of business interactions.
Inferences and analytics	Information derived from the categories above, such as account status, product interest, control-effectiveness observations, risk classifications, likely support needs and aggregate service-usage trends.

4 Scanner limitations and information not intentionally collected

The Scanner is designed to perform controlled exposure testing from an authorized endpoint. It is not designed to monitor employee behavior or determine whether a particular employee used an AI service. Unless expressly described in an applicable agreement, product documentation or in-product notice, the Scanner is not intended to:

• inspect or collect the content of AI prompts or responses;
• upload or download customer files to or from tested AI destinations;
• collect the contents of personal communications;
• capture passwords, authentication tokens or the contents of unrelated network traffic;
• establish that an employee authenticated to, used or transferred data to an AI service; or
• prove that an Accessible result constitutes data leakage or an exploited vulnerability.

Customers and Authorized Users must not intentionally submit sensitive personal information, regulated data, credentials, production secrets or unrelated personal files to Glasswing unless Glasswing has requested the information through an approved secure method and the applicable agreement permits the submission.

5 Sources of personal information

We may obtain personal information:

• directly from you when you visit a website, complete a form, purchase or evaluate a product, register, authenticate, run the Scanner, request support or communicate with us;
• from your employer, an End User Customer, an Authorized Partner, a distributor or another organization that authorizes or administers your access;
• automatically from websites, accounts, devices and Scanner operations;
• from payment processors, authentication providers, hosting providers, analytics providers, customer-relationship systems and other service providers;
• from public sources, business directories, events and professional networks; and
• from cybersecurity, threat-intelligence, domain-reputation and AI-application intelligence sources used to enrich assessment results.

6 How we use personal information

Glasswing may use personal information to:

• provide, activate, authenticate, administer, maintain, update and support the Scanner and other services;
• process purchases, subscriptions, entitlements, renewals and related transactions;
• verify that the correct person, company, endpoint and license are using the service;
• perform authorized exposure assessments and generate, deliver and explain reports;
• maintain product security, investigate suspected misuse, detect fraud and protect Glasswing, customers, partners, users and Protected AI Assets;
• diagnose errors, improve reliability, measure performance and develop product improvements;
• communicate about accounts, purchases, updates, security issues, support, events and requested information;
• manage customer, prospect, reseller, distributor and technology-partner relationships;
• comply with contracts, legal obligations, lawful requests, export controls, sanctions and regulatory requirements;
• establish, exercise or defend legal claims; and
• create aggregate or deidentified information that is not reasonably capable of being associated with an individual, subject to applicable law.

7 Legal bases for processing

Where the GDPR, UK GDPR or another law requires a legal basis, Glasswing relies on one or more of the following, as appropriate: performance of a contract or steps requested before entering a contract; compliance with legal obligations; legitimate interests such as providing and securing services, managing business relationships and improving products; consent where required; and establishment, exercise or defense of legal claims. Where processing is based on consent, consent may be withdrawn without affecting processing already performed.

8 AI and machine learning use

Glasswing may use automated analytics, classification methods and AI-related technologies to identify AI destinations, assign risk or reputation information, classify assessment outcomes, improve product quality and generate decision-support information. Scanner findings are not intended to be the sole basis for decisions producing legal or similarly significant effects about an individual.

Glasswing does not use customer prompts, uploaded files or unrelated employee communications for Scanner testing because the Scanner is not designed to collect that content. Glasswing will not use identifiable Customer Data or Scanner assessment results to train a third-party general-purpose AI model unless that use is expressly disclosed and authorized by the applicable customer agreement or valid consent. Counsel and Product must confirm the final statement against production practices before publication.

9 How we disclose personal information

Glasswing may disclose personal information to the following recipients for the purposes described in this Policy:

Recipient	Purpose
Service providers and subprocessors	Cloud hosting, content delivery, authentication, email delivery, payment processing, analytics, customer relationship management, support, logging, monitoring, security, document delivery and business operations.
Customers and authorized organizations	Provide account administration, assessment results, reports, audit information and support to the organization that purchased, authorized or administers the service.
Authorized partners and distributors	Fulfill authorized sales, provisioning, support, assessment or remediation activities, subject to applicable agreements and authorization.
Professional advisers	Legal, accounting, insurance, audit, security and other professional services.
Government and legal recipients	Respond to law, regulation, subpoena, court order or lawful government request; protect rights and safety; or establish, exercise or defend claims.
Corporate transaction recipients	Support an actual or proposed merger, financing, acquisition, reorganization, sale of assets, bankruptcy or similar transaction, subject to appropriate safeguards.

Glasswing does not disclose customer assessment results publicly unless authorized by the applicable customer or required by law.

10 Sale sharing and targeted advertising

Glasswing does not sell personal information for monetary consideration. Glasswing does not knowingly sell or share personal information of individuals under 16 years of age. Before publication, Glasswing must confirm whether any advertising, analytics, social-media, session-replay or similar technology constitutes a “sale,” “sharing,” targeted advertising or cross-context behavioral advertising under applicable law. If so, the final website must provide the required notice and opt-out mechanism, including recognition of legally required opt-out preference signals where applicable.

11 Cookies and similar technologies

Glasswing websites may use cookies, pixels, local storage and similar technologies to operate the site, maintain sessions, remember preferences, measure usage, secure accounts and understand website performance. Where required, Glasswing will obtain consent before using nonessential technologies and will provide a method to manage choices. The production cookie inventory, vendors, purposes and durations must be documented in a Cookie Notice or consent-management interface linked to this Policy.

12 Payment processing

Purchases may be processed by a third-party payment provider. The provider may collect payment-card, billing and fraud-prevention information under its own privacy notice. Glasswing should receive only the information reasonably necessary to confirm and administer the transaction, such as payer or billing contact information, transaction identifier, payment status, amount and limited card details such as brand and last four digits. The payment provider and exact information flow must be confirmed before publication.

13 Data retention

Glasswing retains personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide services, maintain security and audit records, comply with legal and contractual obligations, resolve disputes and enforce agreements. Retention depends on the category, sensitivity and context of the information; the customer’s instructions; the subscription or evaluation term; security requirements; applicable limitation periods; and legal obligations.

Information	Retention criterion
Website and inquiry information	For the period needed to respond, maintain the relationship and satisfy applicable marketing, suppression, security and legal requirements.
Account, registration and entitlement records	For the account or contractual relationship and a reasonable period afterward for security, audit, dispute and legal purposes.
Authentication and security logs	For a defined security and audit period based on risk, system requirements and applicable obligations. Authentication secrets should expire promptly and should not be retained in plaintext.
Order, billing and transaction records	For the period required by tax, accounting, fraud-prevention, contract and other legal requirements.
Scanner telemetry and diagnostic information	For the period reasonably necessary to operate, secure, troubleshoot and improve the service, consistent with the applicable agreement and DPA.
Assessment results and reports	For the purchased or authorized service period and any additional period stated in the applicable agreement, Order, DPA or customer instruction.
Support communications	For the period needed to resolve the request, document the response, improve support and satisfy legal or contractual requirements.

When retention is no longer required, Glasswing will delete, deidentify or securely dispose of the information, subject to backup cycles, legal holds and technical limitations. Product, Security and counsel must approve a specific internal retention schedule before publication.

14 Security

Glasswing uses administrative, technical and physical safeguards designed to protect personal information against unauthorized access, acquisition, use, alteration, disclosure and destruction. Safeguards may include access controls, least privilege, authentication, encryption in transit, logging, monitoring, endpoint protection, vulnerability management, secure development and incident-response procedures, as appropriate to the information and service.

No system is completely secure. Users must protect credentials and PINs, use authorized endpoints and networks, keep software current, and promptly report suspected compromise. Security incidents will be handled under applicable law and contractual obligations, including any applicable DPA.

15 Individual privacy rights

Depending on location and applicable law, individuals may have rights to request access, correction, deletion, portability or restriction of personal information; object to certain processing; withdraw consent; opt out of sale, sharing or targeted advertising; limit certain uses of sensitive personal information; and appeal a denied request. These rights may be subject to exceptions.

Requests may be submitted to contact@glasswing.ai or through another method stated on the Glasswing website. Glasswing may verify identity and authority before acting. An authorized agent may submit a request where permitted by law. Glasswing will not unlawfully discriminate against an individual for exercising applicable privacy rights.

When Glasswing processes information solely on behalf of a customer, Glasswing may refer the request to that customer or assist the customer as required by the applicable DPA.

16 California privacy disclosures

If the California Consumer Privacy Act, as amended, applies to Glasswing’s processing, California residents may exercise the rights described above. The categories of personal information collected may include identifiers; customer records; commercial information; internet or other electronic network activity; geolocation derived from IP address; professional or employment-related information; and inferences. The business purposes, sources and recipient categories are described in Sections 5, 6 and 9.

Glasswing does not use or disclose sensitive personal information for purposes that require a right to limit unless the final production data inventory establishes otherwise. Glasswing must confirm whether it meets the CCPA applicability thresholds and whether website technologies constitute sale or sharing before publication.

17 EEA United Kingdom and Switzerland

Where applicable, individuals in the European Economic Area, United Kingdom or Switzerland may have rights of access, rectification, erasure, restriction, portability, objection and complaint to a supervisory authority. Glasswing will provide additional information required by law, including the applicable legal bases, relevant legitimate interests, retention criteria and transfer safeguards.

If personal information is transferred to a country not recognized as providing adequate protection, Glasswing will use an approved transfer mechanism where required, such as applicable standard contractual clauses, together with supplementary measures as appropriate. Any claimed participation in a government data-transfer framework must be confirmed before publication.

18 Children

Glasswing products and purchasing services are intended for businesses and authorized adult professionals, not children. Glasswing does not knowingly collect personal information from children under 13 through the website or Scanner. If Glasswing learns that it collected such information without legally sufficient authorization, it will take appropriate steps to delete it. The final age statement should be coordinated with website access controls, marketing practices and applicable jurisdictions.

19 Third party sites and services

Glasswing websites, reports or communications may link to third-party sites or services. Glasswing does not control their privacy or security practices. A link, tested destination or reference in a Scanner report does not constitute endorsement. Individuals should review the third party’s privacy notice before providing information.

20 Data Processing Addendum and customer agreements

When Glasswing processes Customer Personal Data on behalf of a customer, the applicable Data Processing Addendum and customer agreement govern that processing. If this Policy conflicts with a signed agreement concerning processor or service-provider obligations, the signed agreement controls to the extent of the conflict. This Policy does not expand Scanner license rights, authorize an assessment, or replace the applicable Terms of Service, Order, Evaluation Agreement, reseller or distributor agreement.

21 Changes to this Policy

Glasswing may update this Policy to reflect changes in products, data practices, technology or law. The revised version will state its effective date. Where required, Glasswing will provide additional notice or obtain consent before a material change takes effect.

22 Contact us

Questions, privacy requests and complaints may be directed to:

IPivot, Corp. d/b/a Glasswing AI
Attn: Privacy
Email: legal@ipivot.ai
Website: https://www.glasswing.ai