Privacy Policy

Effective: March 1, 2026 Last Updated: March 12, 2026
PIPEDA (Canada) GDPR (EU) UK GDPR CCPA/CPRA (California) LGPD (Brazil) Australian Privacy Act

Summary: We collect only the data necessary to provide our services. You have rights over your data, including access, correction, deletion, and portability. We never sell your personal information. This policy applies based on the jurisdiction from which you access our Service, and the rights specific to your location are described in the jurisdiction-specific sections below.

Table of Contents

1. Introduction

Confidion Consulting & Technologies Inc. ("Confidion," "we," "us," or "our") is committed to maintaining the accuracy, confidentiality, and security of your personally identifiable information ("Personal Information"). As part of this commitment, this Privacy Policy governs our actions as they relate to the collection, use, and disclosure of Personal Information when you use the Confidion Sentry web intelligence platform (the "Service").

Our privacy practices are based upon the values set by the Canadian Standards Association's Model Code for the Protection of Personal Information and are designed to comply with applicable privacy legislation worldwide, including but not limited to:

This policy applies to all users who access our Service from any jurisdiction. The rights and protections that apply to you are determined by the jurisdiction from which you access the Service, and we honour the most protective applicable standard.

2. Data Controller Information

We are responsible for maintaining and protecting the Personal Information under our control. We have designated individuals who are responsible for compliance with this Privacy Policy.

For the purposes of applicable data protection laws, the data controller is:

Confidion Consulting & Technologies Inc.

Privacy Office Email: privacy@confidion.com

Website: www.confidion.com

Data Protection Officer

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions about this Privacy Policy or our privacy practices, please contact our DPO:

Email: dpo@confidion.com

EU/UK Representative

For users in the European Union or the United Kingdom, inquiries may be directed to our DPO at dpo@confidion.com, who serves as our point of contact for data protection authorities in the EU and UK.

3. Data We Collect

3.1 Information You Provide Directly

3.2 Information Collected Automatically

3.3 Information from Third-Party Sources

We may receive information from third-party services when you:

4. Open Source Intelligence (OSINT) Data

About OSINT Data Collection: Confidion Sentry is an open source intelligence platform that aggregates and analyses publicly available information from the internet. This section explains how that data is collected, processed, and governed.

4.1 Nature of OSINT Data

The Service collects and processes information that is publicly available on the internet. This includes data accessible without requiring authentication, credentials, or bypassing access controls. We define "publicly available" as information that:

We do not access private, gated, or restricted content. We do not bypass access controls, paywalls, or authentication mechanisms.

4.2 OSINT Data Sources

The Service may collect publicly available data from the following categories of sources:

4.3 OSINT Data May Contain Personal Information

Because the Service aggregates publicly available data, the results may contain personal information about third parties (individuals who are the subjects of searches but are not users of our Service). This may include:

4.4 Lawful Basis for OSINT Data Processing

We process OSINT data under the following legal bases depending on the applicable jurisdiction:

4.5 Rights of Data Subjects in OSINT Results

If you are an individual whose personal information appears in OSINT search results on our platform and you are not a user of the Service, you may still exercise certain rights under applicable privacy laws:

To exercise these rights, please contact us at privacy@confidion.com with sufficient detail for us to identify the relevant data. We will respond in accordance with the timelines required by applicable law.

4.6 User Responsibilities for OSINT Data

Users of the Service are responsible for ensuring that their use of OSINT data complies with all applicable laws in their jurisdiction, including privacy, data protection, anti-discrimination, and employment laws. The Service is a tool; the lawfulness of any particular use depends on the user's purposes and local legal requirements. See our Terms of Service for detailed acceptable use requirements.

The legal basis under which we process your personal data depends on your jurisdiction and the purpose of processing. Below is a summary of our legal bases for processing your account and usage data (for OSINT-specific legal bases, see Section 4.4).

Purpose Legal Basis (GDPR/UK GDPR) Legal Basis (PIPEDA)
Account creation & management Contract performance (Art. 6(1)(b)) Implied consent
Payment processing Contract performance (Art. 6(1)(b)) Implied consent
Service delivery & intelligence searches Contract performance (Art. 6(1)(b)) Implied consent
Security & fraud prevention Legitimate interests (Art. 6(1)(f)) Without consent (§7(1)(a))
Service improvement & analytics Legitimate interests (Art. 6(1)(f)) Implied consent
Tax & legal compliance Legal obligation (Art. 6(1)(c)) Without consent (§7(1)(b))
Marketing communications Consent (Art. 6(1)(a)) Express consent (opt-in)

6. How We Use Your Data

We use collected data for the following purposes:

6.1 Service Delivery

6.2 Communication

6.3 Security & Fraud Prevention

6.4 Service Improvement

6.5 AI-Assisted Analysis

We use artificial intelligence services to assist with threat correlation and analysis of OSINT data. AI processing is conducted within controlled environments, and your data is not used to train third-party AI models. See Section 20 for details on automated decision-making.

7. Data Sharing & Third Parties

We do not sell, rent, or trade your personal information to third parties for marketing purposes. We do not share your personal information for cross-context behavioural advertising.

7.1 Service Providers (Sub-processors)

We share data with trusted third-party service providers who assist in operating our platform. All sub-processors are contractually bound to protect your data, use it only for specified purposes, and meet equivalent data protection standards:

7.2 Legal Requirements

We may disclose your information when required by law or in response to:

Where legally permitted, we will notify you before disclosing your information in response to legal process.

7.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. You will be notified via email and/or prominent notice on our website prior to any change in ownership or use of your personal data, and you will have the opportunity to request deletion of your data.

7.4 With Your Consent

We may share your information for other purposes with your explicit consent.

8. International Data Transfers

Confidion Consulting & Technologies Inc. is based in Canada. Your personal data may be transferred to and processed in Canada and other jurisdictions where our service providers operate.

8.1 Transfer Safeguards

When we transfer data internationally, we ensure appropriate safeguards are in place as required by applicable law:

8.2 Jurisdiction-Specific Transfer Provisions

EU & UK to Canada

Canada has an adequacy finding from the European Commission, meaning personal data may flow from the EU/EEA and UK to Canada without additional transfer mechanisms.

Brazil

Under the LGPD, international data transfers are permitted where the recipient country provides an adequate level of protection or where Standard Contractual Clauses are in place.

Australia

Under the Australian Privacy Act (APP 8), before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient complies with the APPs or equivalent protections.

United States

For data processed through US-based sub-processors, we rely on Standard Contractual Clauses and the EU-US Data Privacy Framework where applicable.

9. Data Retention

Personal Information will only be retained for the period of time required to fulfill the purpose for which we collected it or as may be required by law. Below are our specific retention periods:

Data Type Retention Period
Account data (email, profile) Active account lifetime + 30 days after deletion request
OSINT investigation results 2 years or until deleted by user, whichever is sooner
Entity profiles & dossiers 2 years or until deleted by user, whichever is sooner
Search queries & history 1 year
Data feed items Per feed configuration (user-controlled)
Transaction & billing records 7 years (tax and legal compliance)
Security audit logs 1 year minimum
Security alerts 1 year minimum
Session data Session lifetime (cleared on logout or after 30 minutes of inactivity)
Support communications 3 years after resolution
Rate limit records 24 hours

Upon expiration of retention periods, data is securely deleted or irreversibly anonymized. You may request earlier deletion of your data at any time, subject to legal retention requirements.

10. Your Rights

Depending on the jurisdiction from which you access our Service, you have specific rights regarding your Personal Information. The sections below (Sections 11–16) detail the rights available under each applicable privacy framework. In general, all users have the following baseline rights:

To exercise any of these rights, contact us at privacy@confidion.com. We will verify your identity before processing requests and respond within the timeframe required by applicable law.

11. PIPEDA — Canada

This section applies to users accessing the Service from Canada. Our privacy practices are based on the ten fair information principles set out in the Canadian Standards Association's Model Code and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

11.1 Accountability

We are responsible for maintaining and protecting the Personal Information under our control. We have designated individuals who are responsible for compliance with this Privacy Policy. Our Data Protection Officer can be reached at dpo@confidion.com.

11.2 Identifying Purposes

We collect, use, and disclose Personal Information to provide you with the services you have requested and for the purposes identified in Section 6 of this policy. The purposes for which we collect Personal Information will be identified before or at the time we collect the information. In certain circumstances, the purposes for which information is collected may be clear and consent may be implied, such as where your name and email address are provided as part of the account registration process.

11.3 Consent

Knowledge and consent are required for the collection, use, or disclosure of Personal Information except where required or permitted by law. Providing us with your Personal Information is always your choice. However, your decision not to provide certain information may limit our ability to provide you with our services. We will not require you to consent to the collection, use, or disclosure of information as a condition to the supply of a service, except as required to be able to supply the service.

11.4 Limiting Collection

The Personal Information collected will be limited to those details necessary for the purposes identified by us. With your consent, we may collect Personal Information from you electronically through the Service interface.

11.5 Limiting Use, Disclosure & Retention

Personal Information may only be used or disclosed for the purpose for which it was collected unless you have otherwise consented, or when it is required or permitted by law. Personal Information will only be retained for the period of time required to fulfill the purpose for which we collected it or as may be required by law (see Section 9 for specific retention periods).

11.6 Accuracy

Personal Information will be maintained in as accurate, complete, and up-to-date form as is necessary to fulfill the purposes for which it is to be used.

11.7 Safeguarding Customer Information

Personal Information will be protected by security safeguards that are appropriate to the sensitivity level of the information. We take all reasonable precautions to protect your Personal Information from any loss or unauthorized use, access, or disclosure (see Section 18 for details).

11.8 Openness

We will make information available to you about our policies and practices with respect to the management of your Personal Information. This Privacy Policy and our Terms of Service are always available on our website.

11.9 Customer Access

Upon request, you will be informed of the existence, use, and disclosure of your Personal Information, and will be given access to it. You may verify the accuracy and completeness of your Personal Information and may request that it be amended, if appropriate. However, in certain circumstances permitted by law, we will not disclose certain information to you. For example, we may not disclose information relating to you if other individuals are referenced or if there are legal, security, or commercial proprietary restrictions.

11.10 Handling Customer Complaints & Suggestions

You may direct any questions or enquiries with respect to our privacy policy or our practices by contacting our Privacy Office at privacy@confidion.com. If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

11.11 Response Timelines

We will respond to access and correction requests within 30 days of receiving the request, as required by PIPEDA.

12. GDPR & UK GDPR — European Union & United Kingdom

This section applies to users accessing the Service from the European Economic Area (EEA) or the United Kingdom.

12.1 Your Rights Under GDPR/UK GDPR

12.2 Response Timelines

We will respond to data subject requests within 30 days of receipt. This may be extended by up to 60 additional days for complex or numerous requests, in which case we will inform you of the extension and reasons.

12.3 Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) for processing activities that are likely to result in a high risk to the rights and freedoms of individuals, including our OSINT data aggregation activities.

12.4 Supervisory Authorities

You have the right to lodge a complaint with a supervisory authority:

13. CCPA/CPRA — California, USA

This section applies to California residents as defined under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA").

13.1 Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information:

13.2 Your CCPA Rights

As a California resident, you have the following rights:

13.3 Exercising Your CCPA Rights

To submit a verifiable consumer request, contact us at privacy@confidion.com. We will verify your identity by confirming information associated with your account. You may also designate an authorized agent to make a request on your behalf.

13.4 Response Timelines

We will acknowledge your request within 10 business days and provide a substantive response within 45 calendar days. This may be extended by an additional 45 days where reasonably necessary, with notice.

13.5 Sale and Sharing Disclosure

We do not sell personal information as defined by the CCPA. We do not share personal information for cross-context behavioural advertising. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.

13.6 Financial Incentives

We do not offer financial incentives or price differences in exchange for the retention or sale of personal information.

13.7 Opt-Out Preference Signals

We honour Global Privacy Control (GPC) and other opt-out preference signals as required by California law. When we detect a valid opt-out signal, we treat it as a valid request to opt out of the sale or sharing of personal information.

14. LGPD — Brazil

This section applies to users accessing the Service from Brazil. Processing of personal data is governed by the Lei Geral de Proteção de Dados (LGPD, Law No. 13,709/2018).

14.1 Legal Bases for Processing

We process personal data of Brazilian users under the following legal bases provided in Article 7 of the LGPD:

14.2 Your Rights Under the LGPD

As a data subject in Brazil, you have the following rights under Article 18 of the LGPD:

14.3 Data Protection Officer (Encarregado)

Our Data Protection Officer serves as the Encarregado for purposes of the LGPD. Contact: dpo@confidion.com

14.4 Response Timelines

We will respond to data subject requests within 15 days as required by the LGPD.

14.5 Supervisory Authority

You may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.

15. Australian Privacy Act

This section applies to users accessing the Service from Australia. Our processing of personal information is governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

15.1 Collection of Personal Information (APP 3)

We only collect personal information that is reasonably necessary for, or directly related to, our functions and activities as described in this policy. We collect personal information by lawful and fair means, and where reasonable and practicable, directly from you.

15.2 Notification of Collection (APP 5)

At or before the time we collect your personal information (or as soon as practicable afterwards), we notify you of the matters required by APP 5, including the purposes of collection, the consequences of not collecting the information, and the entities to which we typically disclose such information. This Privacy Policy serves as that notification.

15.3 Use and Disclosure (APP 6)

We will only use or disclose personal information for the primary purpose for which it was collected, or for a secondary purpose where:

15.4 Cross-Border Disclosure (APP 8)

Before disclosing personal information to an overseas recipient (including our Canadian servers and service providers), we take reasonable steps to ensure the overseas recipient does not breach the APPs. Our data processing agreements with overseas recipients require compliance with privacy protections substantially equivalent to the APPs.

15.5 Your Rights Under the APPs

15.6 Automated Decision-Making Transparency

In compliance with the Privacy and Other Legislation Amendment Act 2024, where we use automated decision-making that could significantly affect your rights or interests, we will provide transparency about the use of such systems, the personal information involved, and how to request human review. See Section 20 for details.

15.7 Response Timelines

We will respond to access and correction requests within 30 days as required by the Australian Privacy Act.

15.8 Supervisory Authority

You may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

16. Other Jurisdictions

If you access the Service from a jurisdiction not specifically addressed above, the following general provisions apply:

16.1 New Zealand (Privacy Act 2020)

Users in New Zealand have rights similar to those under the Australian Privacy Act, including the right to access, correct, and request deletion of personal information. Complaints may be filed with the New Zealand Office of the Privacy Commissioner at privacy.org.nz.

16.2 South Africa (POPIA)

Users in South Africa have rights under the Protection of Personal Information Act (POPIA), including access, correction, deletion, and the right to object to processing. Complaints may be filed with the Information Regulator at justice.gov.za/inforeg.

16.3 Japan (APPI)

Users in Japan have rights under the Act on the Protection of Personal Information (APPI), including disclosure, correction, cessation of use, and cessation of provision to third parties. Complaints may be directed to the Personal Information Protection Commission (PPC).

16.4 Other US States

In addition to California, privacy laws in Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Oregon, Indiana, Kentucky, and other US states may provide you with additional rights. If you are a resident of any of these states, you may exercise rights to access, correct, delete, and opt out of certain processing activities. We honour Global Privacy Control (GPC) signals as an opt-out mechanism where required by state law.

16.5 General Approach

For users in any jurisdiction, we are committed to applying the highest standard of data protection reasonably applicable to your circumstances. If your local law provides rights or protections not specifically addressed in this policy, please contact us at privacy@confidion.com and we will work with you to honour your rights under applicable law.

17. Cookies & Tracking Technologies

17.1 What Are Cookies

A cookie is a small file stored on your device when you visit our website. We may use cookies to improve our website's functionality and, in some cases, to provide you with a customized experience.

17.2 Essential Cookies

We use strictly necessary cookies for:

These cookies are essential for the operation of our Service and cannot be disabled. They do not require consent under most privacy frameworks because they are strictly necessary for the service you have requested.

17.3 Cookie Characteristics

Our essential cookies:

17.4 Third-Party Resources

We load resources from the following third parties:

17.5 Managing Cookies

Cookies are widely used and most web browsers are configured to accept cookies automatically. You may change your browser settings to prevent your computer from accepting cookies or to notify you when you receive a cookie so that you may decline its acceptance. Please note that if you disable cookies, you may not be able to use certain features of our Service, particularly those requiring authentication.

18. Data Security

We implement comprehensive security measures to protect your Personal Information from loss, unauthorized use, access, or disclosure.

18.1 Technical Measures

18.2 Organizational Measures

18.3 Breach Notification

Unfortunately, no data transmission over the Internet can be guaranteed to be 100% secure. As a result, while we make commercially reasonable efforts to protect your data, you transmit information at your own risk.

In the event of a data breach that poses a risk to your rights and freedoms, we will:

19. Children's Privacy

Our Service is not intended for individuals under the age of 18 (or the applicable age of majority in your jurisdiction). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at privacy@confidion.com. We will take steps to delete such information promptly.

20. Automated Decision-Making & AI

20.1 How We Use AI

The Service uses artificial intelligence for the following purposes:

20.2 Limitations

AI-generated analysis and threat scores are provided as decision-support tools. They do not constitute final determinations and are not used to make decisions that produce legal effects or similarly significant effects on individuals without human review. Users are responsible for independently evaluating all information before making decisions.

20.3 Your Rights Regarding Automated Decisions

20.4 AI Data Handling

AI analysis is conducted in isolated sessions. Your data is not used to train third-party AI models. We use commercially available AI services under data processing agreements that prohibit the use of input data for model training purposes.

21. Changes to This Policy

We may update this Privacy Policy from time to time. Our website will always contain the most up-to-date version. When we make material changes:

Your continued use of the Service after the effective date of changes constitutes acceptance of the updated policy. If you do not agree to the changes, you must stop using the Service and may request deletion of your account.

22. Contact Us

You may direct any questions, concerns, or requests regarding this Privacy Policy or our data practices by contacting:

Privacy Inquiries

Privacy Office: privacy@confidion.com

Data Protection Officer: dpo@confidion.com

General Support: support@confidion.com

Confidion Consulting & Technologies Inc.

Website: www.confidion.com

Additional Resources