What we collect, why we collect it, where it lives, who can see it, and the choices you have. Companion to /data-collection (the per-category receipt), the Terms of Service, and your in-product /privacy-settings page.
This policy describes our handling of information for three audiences: customers (organizations that license the DataStun platform), customer end-users (people whose endpoints run a DataStun agent), and visitors to the marketing website at datastun.com. Where the rules differ between these audiences, we say so.
Customer metadata stays inside the customer’s tenant. The only data that crosses tenant boundaries is the verdict on a public object — an IP address, DNS name, or executable hash. Those identifiers describe infrastructure used by many organizations, and a verdict that helps one customer helps every customer asking the same question. The fact that you asked is not part of the verdict and is not shared.
This principle is the same one the Terms of Service § 10 describes from the ownership-and-licensing angle. Here we describe it from the privacy angle: what crosses, what does not, and why. The two documents say the same thing in different language; any apparent conflict is a drafting mistake — tell us at [email protected] and we will fix it.
Every other section of this policy refines that principle.
Every category of data the platform observes, stores, or shares is enumerated on the What we collect page, with one entry per category that names the database table and the in-product surface where you can see it. That page is the receipt that backs every claim in this policy. At a high level:
For each endpoint where you install the DataStun agent, the agent reports network connection metadata (IPs, ports, protocols, process names, file hashes, code-signing publishers, byte and timing counters), host inventory (OS, hardware, installed software, patch state, firewall and AV configuration, USB devices), and lifecycle / diagnostic events. We never read the contents of any communication; only its metadata. The agent has no inbound listening socket; it never accepts inbound connections.
Email addresses, password hashes (Argon2id, never plaintext), OAuth identity references (for LinkedIn sign-in, when used), role assignments, session metadata (login times, IP, browser fingerprint hash), billing state, and support-ticket conversations. Support conversations are passed through a multi-pattern scrubber that strips PEM key blocks, vendor-specific API tokens (GitHub, Slack, AWS, Stripe, Anthropic and similar), key-value secret fields, database connection strings, HTTP authorization headers, credit cards (Luhn-validated), social security numbers, email addresses, and high-entropy unstructured strings before any text is written to disk; pre-scrub text is never persisted.
For each unique IP address, file hash, and DNS name observed across all customers, the reputation system (rep) records a verdict that is keyed by the public object itself, not by the customer who first asked. See section 7.
Standard server-log information (IP, browser, referring URL, requested path, timestamp) and a marketing-funnel A/B cookie when one is active. No third-party advertising or behavioral-tracking pixels.
We use the data we collect only to provide and improve the DataStun service. Specifically:
We do not use customer data for advertising. We do not profile end-users for marketing. We do not share fleet data with other customers; we share only the verdicts on public objects under the conditions in section 7.
Where the General Data Protection Regulation (EU GDPR) or UK GDPR applies, our lawful bases for processing are:
For visitors to the marketing site, we rely on legitimate interest (basic server logging) and consent (any optional cookies once we add them).
DataStun is three independent systems:
The default deployment is managed cloud: we operate ten and rep on infrastructure we manage in the United States. You can also self-host any subset of these components on your own cloud or on-premises infrastructure (see section 10).
This section is the most consequential. Read it carefully. It mirrors the corresponding clause in the Terms of Service § 10; the two say the same thing in different language and any apparent conflict is a drafting mistake.
Rep’s authoritative caches (reputation.ip_cache, reputation.file_cache) contain no tenant identifier. There is no tenant_id column on those tables. Verdicts are computed for the public object and returned to every customer who asks about the same object.
The only place any tenant trace exists on rep is the pending-lookup queue (reputation.pending_lookups, reputation.pending_file_lookups), where the first asker is recorded as an audit-trail field for accountability. That field is intentionally not used in the verdict computation and does not appear on the cached result. Once the verdict is written, the record carries no link back to your tenant.
When an external reputation lookup is needed for a file (because rep’s local mirrors lack coverage), we send only the SHA-256 hash. We never upload binaries to VirusTotal, MalwareBazaar, or any external service. A SHA-256 is a 32-byte fingerprint — sufficient to identify a file you already have, but cannot be reversed to the binary itself. See /glossary#hash-only-privacy.
We use a small number of external services to operate the platform. Where any of them touch customer data, the touch is hash-only or otherwise minimized.
.mmdb file for offline geo lookups. No data leaves our infrastructure at query time.datastun.com and tenant.datastun.com. Cloudflare sees the same TLS-terminated requests our origin sees.If you self-host any of these components on your own infrastructure, the corresponding third-party touch goes away. A self-hosted rep with external lookups disabled never contacts VirusTotal, MalwareBazaar, or AbuseIPDB. A self-hosted ten with self-served email never contacts SendGrid.
Cloudflare, SendGrid, and Anthropic act as our sub-processors where their processing is on our behalf. VirusTotal, MalwareBazaar, AbuseIPDB, ip-api.com, MaxMind, and the threat-feed sources are independent controllers we query — their use of the queries we send them is governed by their own terms; we send them only the minimum data the lookup requires (a hash, an IP, or nothing more than a request for a published list).
We have not integrated a payment processor yet. Billing today is simulated — entitlements are driven by customer-stated tier elections, not by real charges. When we integrate a payment processor (likely Stripe), we will update this policy in the same release and notify existing tenants in advance.
We do not sell personal information. We do not share personal information for cross-context behavioral advertising. These statements use “sell” and “share” as those terms are defined under the California Consumer Privacy Act (CCPA / CPRA). We do not run advertising on this site, we do not exchange customer data for value, and we do not enable third parties to use our customer data for their own purposes.
Reputation verdicts on public objects (IPs, hashes, DNS names) are made available to all DataStun customers, but those verdicts are not your personal information and do not carry your identity — see section 7.
Managed-cloud deployments today operate in the United States. International tenants are served from the US until we add other regions.
If your organization requires data to remain inside a specific jurisdiction or on infrastructure you control, you have two options:
Open a self-hosting conversation through the in-product /privacy-settings page or by emailing [email protected].
Retention windows for managed-cloud customers are governed by your tier. The active values for your tenant are visible at the in-product /privacy-settings page. Defaults today:
Subject to applicable law, you have the rights described below. Many can be exercised directly from inside the product (see section 13); for the rest, email [email protected].
Residents of states with comprehensive consumer-privacy laws have rights substantially similar to those listed above: confirmation, access, correction, deletion, portability, and opt-out of sale / targeted advertising / certain profiling. We honor these rights regardless of which state law applies.
For international transfers of EU or UK personal data to the United States, we rely on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable) as the transfer mechanism, supplemented by the technical and organizational measures described in section 16.
Most rights are exercisable from inside the product:
We may need to verify your identity before responding to a rights request — particularly for deletion requests, where a mistaken deletion is irreversible. We will not use the verification information for any other purpose.
If we deny your request, you may appeal by replying to our denial. We will respond to appeals within 45 days. For California and Texas residents, you may then contact the California Privacy Protection Agency or the Texas Attorney General, respectively.
DataStun is a professional and business product. It is not directed to children, and we do not knowingly collect personal information from anyone under 18 years old. If you are under 18, do not create an account or use the service. If you believe a person under 18 has provided us personal information, email [email protected] and we will delete it.
DataStun is operated from the United States. By using the service from outside the US, you consent to the transfer and processing of your data in the United States, subject to the safeguards described in this policy.
For personal data transferred from the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, as applicable, as the transfer mechanism. We supplement those clauses with the technical and organizational measures in section 16.
We use commercially reasonable technical and organizational measures to protect data in transit and at rest. No method of transmission or storage is fully secure; we cannot promise absolute security.
The marketing site (datastun.com) may set a session cookie for the marketing-funnel A/B framework when one is active. We do not use third-party advertising or behavioral-tracking cookies. We do not run cross-session analytics that link visitor identities.
The authenticated tenant platform (tenant.datastun.com) sets a session cookie strictly for authentication and a tenant-selection cookie for users with access to multiple tenants. Both are first-party, secure, and required for the product to function.
Global Privacy Control (GPC). We honor the GPC signal as an opt-out of sale and sharing. As noted in section 9, we do not sell or share personal information, so the practical effect of a GPC signal on this site is informational; we record receipt of the signal for transparency.
Do Not Track (DNT) headers do not have a settled meaning in current law, so we do not take a specific action on them; the GPC signal is the supported mechanism.
We will notify affected customers of any security incident that materially affects their data within 72 hours of confirmation, by email to the registered tenant owners and admins and by in-product notice. The notification will describe what happened, what data was affected, what we are doing about it, and what (if anything) you should do.
We will announce material changes to this policy in-product before they take effect. The version number above will increment and the effective date will be updated. For post-launch material changes, we will provide at least 30 days’ notice to production-tier customers, and any change that broadens what we collect or how we use it will be opt-in for existing tenants. The updated policy will be posted at this URL.
DataStun LLC
Attention: Privacy
Mailing address — to be added once registered-agent address is confirmed.
Email: [email protected]
For rights requests, we aim to respond within 30 days; for jurisdictions whose laws set a different timeline (e.g., Texas TDPSA at 45 days), we meet the statutory deadline.
See also: /data-collection (the per-category receipt) · /terms (terms of service) · /aup (acceptable use policy) · /glossary (feature definitions).
Questions? Email [email protected].