Effective Date: January 1, 2025
At SEC SPACE ("we," "our," or "us"), we are committed to protecting your privacy and maintaining the confidentiality of your information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website sec-space.net and use our services.
Given the sensitive nature of cybersecurity operations, we take extraordinary measures to ensure your data remains secure and private. We believe that privacy is a fundamental right, especially in the cybersecurity domain.
By using our services, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our services.
🔍 Information We Collect
We collect several types of information to provide and improve our services. The categories of information we collect include:
1. Personal Information
When you voluntarily provide it to us, we may collect personally identifiable information, including:
- Contact Information: Name, email address, phone number (when you contact us)
- Account Information: Username, password (if you create an account)
- Professional Information: Company name, job title, industry (optional)
- Communication Data: Messages sent through our contact forms or email
2. Technical Information
We automatically collect certain technical information when you access our services:
- Device Information: Browser type, operating system, device identifiers
- Access Logs: IP addresses, access times, pages viewed
- Cookies and Tracking: Session data, preferences, authentication tokens
- Analytics Data: User behavior, feature usage, performance metrics
3. Security Assessment Data
Important: We do NOT permanently store sensitive data from your security assessments. Data processed through our tools (e.g., PCAP files, exploit attempts, OSINT queries) is processed in real-time and automatically deleted after your session ends or within 24 hours, whichever comes first.
Temporary data that may be processed includes:
- Network packet captures (PCAP files)
- Domain and IP addresses for OSINT queries
- Cryptographic operations input/output
- File uploads for analysis
⚙️ How We Use Your Information
We use the collected information for various purposes, including:
Service Delivery & Operations
- Providing access to our cybersecurity tools and services
- Processing your security assessments and analysis requests
- Maintaining and improving our platform functionality
- Responding to your inquiries and support requests
- Sending service-related notifications and updates
Security & Compliance
- Protecting against unauthorized access and security threats
- Detecting and preventing fraudulent activity
- Monitoring platform performance and stability
- Complying with legal obligations and law enforcement requests
- Enforcing our terms of service and acceptable use policies
Analytics & Improvement
- Analyzing usage patterns to improve user experience
- Developing new features and services
- Conducting research and statistical analysis
- Optimizing platform performance and reliability
Communications
- Sending important security updates and advisories
- Providing customer support and technical assistance
- Sharing product updates and new feature announcements
- Requesting feedback to improve our services
🔒 Data Protection & Security
We implement industry-leading security measures to protect your information from unauthorized access, alteration, disclosure, or destruction:
Technical Safeguards
- Encryption: All data transmitted to and from our servers uses TLS/SSL encryption
- Secure Storage: Data at rest is encrypted using AES-256 encryption
- Access Controls: Strict role-based access control and authentication mechanisms
- Network Security: Firewalls, intrusion detection systems, and DDoS protection
- Regular Audits: Periodic security assessments and penetration testing
Organizational Safeguards
- Employee training on data protection and privacy best practices
- Confidentiality agreements with all staff and contractors
- Principle of least privilege for data access
- Incident response procedures and breach notification protocols
- Regular security awareness training and updates
Data Isolation
Security assessment data is processed in isolated environments:
- Containerized execution environments for each user session
- No cross-user data contamination or access
- Automatic cleanup and destruction of temporary data
- No persistent storage of sensitive assessment data
Zero-Knowledge Architecture: For many operations, we employ zero-knowledge principles where possible, meaning we cannot access your data even if we wanted to. Client-side processing is used whenever technically feasible.
🤝 Data Sharing & Disclosure
We respect your privacy and limit data sharing to essential circumstances only:
We DO NOT:
- ❌ Sell your personal information to third parties
- ❌ Share your security assessment data with anyone
- ❌ Use your data for advertising or marketing purposes without consent
- ❌ Provide access to your information to data brokers
- ❌ Retain sensitive security data after session completion
We MAY share information only in these specific cases:
- Service Providers: Trusted third-party service providers who assist in operating our platform (e.g., hosting providers, payment processors) under strict confidentiality agreements
- Legal Requirements: When required by law, subpoena, court order, or government request to comply with legal obligations
- Protection of Rights: To protect our rights, property, or safety, or that of our users or the public, as required or permitted by law
- Business Transfers: In connection with a merger, acquisition, or sale of assets (with notification and consent requirements)
- With Your Consent: Any other disclosure with your explicit consent
⚖️ Your Rights & Choices
You have several rights regarding your personal information:
Access & Portability
- Right to access your personal information we hold
- Right to receive a copy of your data in a portable format
- Right to know what data we collect and how it's used
Correction & Deletion
- Right to correct inaccurate or incomplete information
- Right to request deletion of your personal data (right to be forgotten)
- Right to update your preferences and contact information
Restriction & Objection
- Right to restrict processing of your information
- Right to object to processing for specific purposes
- Right to opt-out of marketing communications
How to Exercise Your Rights
To exercise any of these rights, please contact us at:
We will respond to your request within 30 days. For security purposes, we may need to verify your identity before processing your request.
🍪 Cookies & Tracking Technologies
We use cookies and similar tracking technologies to enhance your experience:
Types of Cookies We Use
- Essential Cookies: Required for the website to function properly (e.g., authentication, security features)
- Functional Cookies: Remember your preferences and settings
- Analytics Cookies: Help us understand how visitors interact with our website
- Performance Cookies: Collect information about how you use our services to improve performance
Managing Cookies
You can control and manage cookies through your browser settings:
- Block all cookies (may limit functionality)
- Block third-party cookies only
- Clear cookies after each session
- Set preferences for specific websites
Please note that disabling cookies may affect the functionality of certain features on our website.
⏱️ Data Retention
We retain different types of data for varying periods based on legal requirements and business needs:
Retention Periods
- Security Assessment Data: Automatically deleted within 24 hours of session end
- Account Information: Retained while your account is active, plus 90 days after closure
- Communication Records: Retained for 3 years for customer support purposes
- Access Logs: Retained for 90 days for security monitoring
- Analytics Data: Aggregated and anonymized data retained indefinitely
Deletion Requests
Upon receiving a deletion request, we will:
- Verify your identity to protect against fraudulent requests
- Delete personal information within 30 days of verification
- Notify any third parties with whom data was shared (where applicable)
- Provide confirmation of deletion upon completion
Some information may be retained if required by law or for legitimate business purposes (e.g., resolving disputes, enforcing agreements).
👶 Children's Privacy
Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18 years of age.
If we become aware that we have collected personal information from a child under 18 without verification of parental consent, we will take steps to delete that information immediately.
If you believe we have collected information from a child under 18, please contact us at privacy@sec-space.net.
🌍 International Data Transfers
SEC SPACE operates globally. Your information may be transferred to and processed in countries other than your country of residence.
Data Protection Standards: We ensure that all international data transfers comply with applicable data protection laws, including:
- General Data Protection Regulation (GDPR) for EU residents
- California Consumer Privacy Act (CCPA) for California residents
- Standard Contractual Clauses for international transfers
- Adequacy decisions where applicable
- Privacy Shield principles (where applicable)
📝 Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings.
Notification of Changes:
- Updated "Effective Date" at the top of this policy
- Email notification for significant changes (if you have an account)
- Prominent notice on our website for 30 days after changes
- Option to review changes before they take effect
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.
📧 Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Response Time: We aim to respond to all privacy-related inquiries within 30 days.
Last Updated: January 28, 2026
Version: 2.0
Effective Date: January 1, 2025
Previous versions of this policy are available upon request.