Privacy notice
What personal data we hold about the people who visit and use ThreatCast, why, for how long, and what you can ask us to do. Last updated 12 October 2026.
Who we are
ThreatCast is the controller of the personal data described here. Contact us at the request form.
When an organisation uses ThreatCast, that organisation decides what it adds (its team members, suppliers, domains, software and device lists) and is the controller of that data. We act for it as its processor. If you work for a customer and want to see or delete data about you, ask the owners of your organisation first; we help them answer. The Trust page lists the providers involved and how long each kind of data is kept.
What we collect, and why
| Data | Why | Basis | Kept |
|---|---|---|---|
| Request form: name, work email, company, team size, note | To reply to your request for access | Legitimate interests (answering the person who asked) | Closed requests are deleted after 90 days |
| Your account: email address, role, preferences | To let you sign in and use the service for your organisation | Contract with your organisation; legitimate interests | While you are a member, then removed or anonymised |
| Sign-in records: email, IP address, browser, time, whether it worked | To spot and stop unauthorised access | Legitimate interests (security) | 90 days |
| Audit log: which account did what, and when | So an organisation can see who changed what | Legitimate interests; contract with your organisation | While the organisation is a customer |
| Emails we send you (invites, the weekly summary) | To deliver the service you asked for | Contract with your organisation | Held by our email provider for its own log period |
We do not sell personal data, show advertising or build profiles to sell. We do not use analytics or advertising cookies. The cookies we set are the ones that keep you signed in and remember display choices such as light or dark mode.
Who else handles it
The providers that run the service (database and sign-in, hosting, email, and, only for organisations that switch it on, the Claude add-on) handle personal data on our behalf. Each is listed with what it receives and where it is on the Trust page. Where a provider is outside the UK, it relies on a recognised transfer mechanism. We share data with the authorities only where the law requires it.
Your rights
You can ask to see the personal data we hold about you, to have it corrected or deleted, to receive a copy you can move elsewhere, to restrict or object to how it is used, and to withdraw anything you agreed to. Signed-in members can download their own data and delete their own account from their settings. For anything else write to the request form. We answer within one month.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk. We would like the chance to put it right first.
Changes
If this notice changes in a way that matters, we will say so on this page and tell signed-in members. See also the terms.