This policy (“Privacy Policy”) explains how IRONSCALES Ltd. (an Israeli company) and its subsidiaries, IRONSCALES, Inc. (a U.S. company) and IRONSCALES Global Limited (a UK company) (collectively, “IRONSCALES”, “we”, “us” or “our”) collects, uses, and discloses personal data as this term is defined under data protection and privacy laws (“Personal Data”) about you when you visit our websites (“Sites”) or when you use certain aspects of our cloud services platform (“Platform”) or application (“App”), (together with the Sites, the “Services”), that enable our clients to protect against phishing attacks and account takeovers with real-time threat detection, automated incident response and remediation, and integrated security awareness training. 

We may change this Privacy Policy from time to time. If we make changes, we will notify you by revising the date at the top of the policy. By continuing to use our Services after we post a revised Privacy Policy, you accept the modified Privacy Policy. We encourage you to check back regularly to stay informed about our information practices and the choices available to you.

OUR ROLE WITH RESPECT TO YOUR PERSONAL DATA

Within the scope of this Privacy Policy, we act as a data controller or “business” for the Personal Data we process. This means that we decide how and why Personal Data is collected and further processed.

We act as a processor or “service provider” in the context of most of the processing activities involved when providing the Services to our clients. In these cases, we do not decide why or how that Personal Data will be processed. In general we will only access such Personal Data at our client’s request in connection with support or account administration matters. We will only access Personal Data to provide the Services that our client has directed us to provide, or if we are required to do so by law.

When you give your data to one of our clients or when we collect your Personal Data on their behalf, our client’s privacy policy, rather than this Privacy Policy, will apply to our processing of your Personal Data. If you have a direct relationship with one of our clients, please contact them to exercise your privacy rights.

COLLECTION OF PERSONAL DATA

The following describes the categories of Personal Data we have collected about you in the last 12 months when using the Services, the categories of sources from which the Personal Data is collected, and the business or commercial purpose for collecting the Personal Data.

Personal Data You Provide to Us 

Personal Data you provide to us through the use of the Services or otherwise include:

• Contact data, such as your first and last name, job title, department, phone number, location, language, email address, and billing address.
• Profile data, such as the username and password that you may have set to establish an online account with us, preferences and any other information that you may add to your account profile.
• Commercial information, such as records of services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
• Communications data based on our exchanges with you, including when you contact us, communicate with us via chat features or otherwise.
• Financial data, such as your account details and billing address.
• Marketing data, such as your preferences for receiving our marketing communications and details about your engagement with them.
• Biometric information, such as facial characteristics extracted from photos uploaded or video conversations, and audio or voice patterns collected for the purpose of creating a template for live comparison and identity verification.
• Other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Information We Collect Automatically

In order to help provide recommendations and promote Ironscales content that is relevant to your interests as well as ensure our Services are compatible with your device, we automatically collect certain information when you when you access the Services. 

• Browser and Device Information: we collect your IP address and user agent string. From this data, we infer operating system, ISP, broad geo-location, and identifiers assigned to your browser version and/or device type.

• Usage Data: we collect information about the Services’ performance and analytics such as the referral host that brought you to the Sites, the date and time your browser or device accessed the page, and the specific pages accessed within a given session.

• View and Click Data: we collect information about whether you view or interact with various elements of the Services. We use this information to understand user engagement, improve the design and functionality of the Sites, and evaluate the effectiveness of our own marketing content.

Third-Party Sources

We combine Personal Data we receive from you with Personal Data we obtain from “Third Party Sources”, such as:

• Public sources, such as government agencies, public records, social media platforms, open-source intelligence sources, and other publicly available sources. This may include publicly accessible information about the employees of our clients or business partners.

• Private sources, such as data providers and data licensors that provide demographic and other information.

• Marketing partners, such as joint marketing partners. 

We collect commercially available information such as public relations announcements, information posted by company employees on behalf of the company, financial information, news regarding the company from these Third-Party Sources.

How We Use Your Personal Data

We use your Personal Data for the following purposes or as otherwise described at the time of collection:

• Service delivery and operation: we use your Personal Data to: 
  • Provide, operate or improve our business and the Services we provide;
  • Personalize the Services, including remembering devices from which you have previously logged in and remembering your selections and preferences as you navigate the Services;
  • Establish and maintain your account profile;
  • Communicate with you about our Services, including by sending announcements, updates, security alerts, and support administrative messages;
  • Provide support for our Services and respond to your requests, questions, and feedback.
• Research and development: we use your Personal Data for research and development purposes, including to analyze and improve the Sites and our business and to develop new products and services. As part of these activities, we may create aggregated, de-identified and/or anonymized data from Personal Data we collect. We make Personal Data into de-identified or anonymized data by removing information that makes the data personally identifiable to you. We may use this aggregated, de-identified or otherwise anonymized data and share it with third parties for our lawful business purposes, including to analyze and improve the Sites and promote our business.
• Marketing and advertising: we, our service providers, and our third-party advertising partners collect and use your Personal Data for marketing and advertising purposes:
  • Direct marketing: we send you IRONSCALES related or other direct marketing communications and may personalize these messages based on your needs and interests. You can opt out of receiving promotional emails from IRONSCALES by following the instructions in those emails or by emailing us at contact@ironscales.com. If you opt out, we may still send you non-promotional communications, such as those about your account or our ongoing business relations.
  • Interest-based advertising: our third-party advertising partners use cookies and similar technologies to collect information about your interaction with the Sites, our communications and other online services over time, and use that information to serve online ads that they think will interest you. This is called interest-based advertising. We also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms.
• Service improvement and analytics: we use your Personal Data to analyze your usage of the Sites, improve the Sites, improve the rest of our business, help us understand user activity on the Sites (including which pages are most and least visited and how visitors move around the Sites), as well as user interactions with our emails, and to develop new products and services.
• Compliance and protection: we use your Personal Data to:
  • Comply with applicable laws, lawful requests and legal processes such as to respond to subpoenas, investigations or requests from government authorities;
  • Protect our, your and others’ rights, privacy, safety or property (including by making or defending a legal claim);
  • Audit our internal processes for compliance with legal and contractual requirements or our internal policies;
  • Enforce the terms and conditions that govern the Sites; and
  • Prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and theft.
• With your consent: in some cases, we specifically ask for your consent to collect, use or share your Personal Data, such as when required by law.

LEGAL BASIS FOR PROCESSING

When we process your Personal Data we will only do so upon the following legal bases:

• We have a legitimate interest in processing your Personal Data. For example, we may process your Personal Data to provide you with the Services (e.g., processing payments for and providing the services you have requested), to communicate with you about changes to our Services, and to provide, secure, and improve our Services;

• We have your consent to show you personalized content that may be of interest to you; and

• Where we need to comply with a legal or regulatory obligation.

We have set out below, in a table format, the legal bases we rely on in respect of the relevant purposes for which we use your personal information.

HOW WE SHARE YOUR PERSONAL DATA 

We share your Personal Data with the following parties and as otherwise described in this Privacy Policy, in other applicable notices, or at the time of collection. 

• Affiliates. Our corporate parent, subsidiaries, and affiliates.

• Service Providers. Third parties that provide services on our behalf or help us operate the Services or our business (these can include hosting, information technology, email delivery, marketing, website analytics, etc.).

• Third parties designated by you. We share your Personal Data with third parties where you have instructed us or provided your consent to do so.
• Professional advisors. Professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us.
• Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for compliance and protection purposes.
• Business transferees. We disclose Personal Data in the context of actual or prospective business transactions (e.g., investments in IRONSCALES, financing of IRONSCALES, public stock offerings, or the sale, transfer or merger of all or part of our business, assets or shares). We also disclose your Personal Data to an acquirer, successor, or assignee of IRONSCALES as part of any merger, acquisition, sale of assets, or similar transaction, and/or in the event of an insolvency, bankruptcy, or receivership in which Personal Data is transferred to one or more third parties as one of our business assets.

DATA RETENTION 

We store the data we collect for as long as is necessary for the purpose(s) for which we originally collected it. We may retain certain information for legitimate business purposes or as required by law. Your Personal Data will be stored until we delete our records in accordance with this Privacy Policy, or if you send a valid deletion request.

Please note that in some circumstances we store your Personal Data for longer periods of time, for example: (i) where we are required to do so in accordance with legal, regulatory, tax or accounting requirements; (ii) for us to have an accurate record of your dealings with us in the event of any complaints or challenges; or (iii) if we reasonably believe there is a prospect of litigation relating to your information or dealings.

COOKIES AND OTHER TRACKING TECHNOLOGIES 

Cookies are small text files that are placed on your device’s hard drive when you use our Services. They allow information gathered on one page to be stored until it is needed for use on another, providing us with statistics about your use of the Services so that they can be improved.

We use session and persistent cookies. Session cookies are deleted when you close your browser. Persistent cookies may remain even after you close your browser, but always have an expiration date. Most of the cookies placed on your device through our Services are first-party cookies which are placed directly by us. Other parties, such as Google, may also set their own (third-party) cookies through our Services. Please refer to the policies of these third parties to learn more about the way in which they collect and process information about you.

We use various technologies to collect information on our Services, including but not limited to cookies and web beacons. We use cookies in the following ways:

• to track how you use our Services;
• to record whether you have seen specific messages we display on our Services;
• to record your answers to forms on our Sites while you complete them; and
• to provide you with future messages about phishing mitigation and our products.

This allows us to analyze and improve upon the performance of our Services, remember your preferences and settings, and measure the success of marketing campaigns geared toward customer acquisition and retention.

If you would prefer not to accept cookies, you can change the setup of your browser to reject all or some cookies. Note, if you reject certain cookies, you may not be able to use all features of our Services. For more information, please visit https://www.aboutcookies.org/.

How We Respond to Opt-Out Signals 

You may also set your browser to send a Do Not Track (DNT) signal or Global Privacy Control (GPC) signals. For more information, please visit https://allaboutdnt.com/ and https://globalprivacycontrol.org/. Please note that our Sites have the capability to respond to GPC signals received from web browsers. However, please note that the technology to detect whether a website honors Global Privacy Control signals does not always work as intended.

PERSONAL DATA REGARDING CHILDREN 

Our Sites are not directed at, or intended for use by, children under the age of 13. We do not sell or share the personal data of data subjects under 16 years of age.

If we are made aware that we may have received Personal Data from or about a child in respect of whom we are not permitted to process Personal Data under applicable law, we will use reasonable efforts to investigate and remove that data from our records as soon as practicable. If you have a reason to believe that we might have any information from or about a child under the permitted age in the relevant location, please contact us at contact@ironscales.com.

HOW WE PROTECT THE INFORMATION WE COLLECT

We take reasonable measures to help protect the information we collect from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction.  However, no transmission over the internet or electronic storage can be completely secure, so we cannot guarantee the absolute security of any data. Nevertheless, we make commercially reasonable efforts to make the collection and security of such information consistent with this privacy policy and all applicable laws and regulations. In addition, IRONSCALES is SOC2 Type II and ISO 27001 certified for information security.

As the security of information depends in part on the security of the computer, device, or network you use to communicate with us and the security you use to protect your user IDs and passwords, please make sure to take appropriate measures to protect this information.

DATA TRANSFERS AND THE DATA PRIVACY FRAMEWORK

We are a global company headquartered in the US and our affiliates, our service providers and other third parties with whom we share Personal Data with operate globally. When you use the Services, certain third parties may collect Personal Data about your online activities over time and across different websites or online services. Please refer to the policies of these third parties to learn more about the way in which they collect and process information about you.

International Transfers of Your Personal Data: Data Privacy Framework

Pursuant to the Data Privacy Framework, (or the EU-U.S. DPF as defined below), some third parties that receive your Personal Data may be located outside of the United States; however, we will either obtain your explicit consent to transfer your Personal Data to such third parties, or we will require those third parties to maintain at least the same level of confidentiality that we maintain for such Personal Data ourselves. We remain liable for the protection of your Personal Data that we transfer to our service providers, except to the extent that we are not responsible for the event giving rise to any unauthorized or improper processing. 

International Transfers of Your Personal Data: Europe 

When your Personal Data is safeguarded by the EU or UK General Data Protection Regulation, or Swiss data protection law, before sending it to parties outside of the European Economic Area (“EEA”), the UK, or Switzerland, we will do one of two things:

1. Seek your consent; or
2. Demand privacy and security: We will ensure the third party maintains the same level of privacy and security for your Personal Data as we do.

In some cases, the authorities of a country may have determined that the laws of other countries, territories or sectors within a country provide a level of protection equivalent to domestic law. You can see here the list of countries, territories and specified sectors that the European Commission recognized as providing an adequate level of protection for personal data, here the list of the UK, and here the list of Switzerland.

We are accountable for the protection of your Personal Data when we transfer it to others. We either send it to a country, territory or sector within a country that is recognized as providing the same level of personal data protection as the country of origin, or use safeguards like the Data Privacy Framework (as defined below) or the Standard Contractual Clauses (also known as the “SCCs”) approved by the European Commission under Article 46.2 of the GDPR, with necessary adjustments for transfers from the UK or Switzerland, or use specific transfer instruments like the UK International Data Transfer Agreement. 

Data Privacy Framework

We adhere to the Data Privacy Framework and have certified to the Department of Commerce our commitment to comply with the Data Privacy Framework Principles. IRONSCALES complies with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce. IRONSCALES has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (“EU-U.S. DPF Principles”) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. IRONSCALES has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (“Swiss-U.S. DPF Principles”) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.

To learn more about the Data Privacy Framework Principles, and to view our certification information, please visit https://www.dataprivacyframework.gov and https://www.dataprivacyframework.gov/list, respectively.

Dispute Resolution

Where a privacy complaint or dispute relating to Personal Data received by IRONSCALES in reliance on the Data Privacy Framework (or any of its predecessors) cannot be resolved through our internal processes, we have agreed to participate in the ICDR-AAA DPF IRM Service. Subject to the terms of the ICDR-AAA DPF IRM Dispute Resolution Procedures, AAA will provide appropriate recourse free of charge to you. To file a complaint with AAA and participate in the ICDR-AAA DPF IRM Dispute Resolution Procedure, please submit the required information here: https://go.adr.org/rs/294-SFS-516/images/2025_Data_Privacy_Notice_of_Arbitration.pdf.

Binding Arbitration

If your dispute or complaint related to your Personal Data that we received in reliance on the Data Privacy Framework cannot be resolved by us, nor through the dispute resolution mechanism mentioned above, you may have the right to require that we enter into binding arbitration with you under the Data Privacy Framework “Recourse, Enforcement and Liability” Principle and Annex I of the Data Privacy Framework.

U.S. Regulatory Oversight

IRONSCALES is subject to the investigatory and enforcement powers of the Federal Trade Commission.

YOUR RIGHTS

You have specific rights regarding your Personal Data that we collect and process. Please note that you can only exercise these rights with respect to Personal Data that we process about you when we act as a data controller or as a “business” under the CCPA. To exercise your rights with respect to information processed by us on behalf of one of our clients, please read the privacy notice of that client. 

In this section, we acknowledge the right of EU, UK and Swiss individuals to access their Personal Data pursuant to the Data Privacy Framework and will grant individuals reasonable access to Personal Data we received pursuant to the Data Privacy Framework Principles. In addition, we will take reasonable steps to permit individuals to correct, amend, or delete such information that is demonstrated to be inaccurate or processed in violation of the Data Privacy Framework Principles. If we have received your Personal Data in reliance on the Data Privacy Framework, you may also have the right to opt out of having your Personal Data shared with third parties and to revoke your consent to our sharing your Personal Data with third parties. You may also have the right to opt out if your Personal Data is used for any purpose that is materially different from the purpose(s) for which it was originally collected or which you originally authorized. An individual may request to access their Personal Data, or otherwise correct, amend, delete, withdraw their consent or limit the processing of their Personal Data in line with the Data Privacy Framework Principles by contacting us. 

You may have the right to ask us to take the following actions in relation to your Personal Data that we hold: 

• Access. Provide you with information about our processing of your Personal Data and give you access to your Personal Data.
• Correct. Update or correct inaccuracies in your Personal Data.
• Delete. Delete your Personal Data where there is no good reason for us continuing to process it - you also have the right to ask us to delete or remove your Personal Data where you have exercised your right to object to processing (see below).
• Portability. Port a machine-readable copy of your Personal Data to you or a third party of your choice.
• Restrict. Restrict the processing of your Personal Data, for example if you want us to establish its accuracy or the reason for processing it.
• Object. Object to our processing of your Personal Data where we are relying on Legitimate Interests – you also may have the right to object where we are processing your Personal Data for direct marketing purposes.
• Withdraw Consent. When we use your Personal Data based on your consent, you may have the right to withdraw that consent at any time.
• Right to Opt Out of the Sale of Personal Data. You may have the right to ask us to not sell your Personal Data at any time, referred to as the right to opt out.

QUESTIONS OR COMPLAINTS

If you are a resident of the EEA or UK and have a concern about our processing of Personal Data that we are not able to resolve, you have the right to lodge a complaint with the data protection regulator where you reside. If you are located in the EEA, the contact information for the data protection regulator in your place of residence can be found here. If you are located in the UK, you can contact the UK ICO. If you need to obtain this Privacy Policy in a different format, please contact us and we will provide you with an alternative.

HOW TO EXERCISE YOUR RIGHTS

To exercise any of the above rights, you or your authorized agent may contact us and submit the required verifying information, as further described below: 

• Via email at privacy@ironscales.com

• Via postal mail at:

  • IRONSCALES, Inc.
    6 Concourse Pky, Suite #1600
    Atlanta, GA 30328

  • Via phone : +1-888-407-0987 

Verification. IRONSCALES may require additional information from you to verify your identity before responding to your request.  That verification process requires that you visit the online webform at the web address specified above and provide the requested information.

Authorized Agent. You may designate an authorized agent to make a request on your behalf.  To do so you must identify your initial online webform entry as originating with a designated agent, at which time we may contact you to further verify the validity of the request. If you use an authorized agent to submit your request, we may require proof of the written authorization you have given. We also may require you to confirm your identity and attest to your Californian residency in order to obtain the information. 

Time to process your request. We will reply to your request within one month from the day we received your request. If we need additional time to process your request, we will inform you of the reason why and the extension period in writing. If you make this request by telephone, we may also ask you to provide the request in writing so that we may verify your identity. If we are unable to honor your request for any reason, we will notify you of the reason within the request time period. 

Third Party Opt-Out of Sales/Share. In order to specifically request Opt-Out of Sale of your personal information, collected through our Sites you can navigate to the “Personal Information” link in the footer or click here.

CONTACT US

If you have any questions or need to contact us, please do so at  privacy@ironscales.com or at:

IRONSCALES, Inc. 
6 Concourse Pky, Suite #1600 
Atlanta, GA 30328 

Phone: +1-888-407-0987

Please allow up to four weeks for us to reply.

European Union Representative

We have appointed VeraSafe as our representative in the EU for data protection matters. While you may also contact us, VeraSafe can be contacted on matters related to the processing of Personal Data.

To contact VeraSafe, please use this contact form: https://www.verasafe.com/privacy-services/contact-article-27-representative/ or via telephone at: +420 228 881 031. 

Alternatively, VeraSafe can be contacted at:

VeraSafe Ireland Ltd.
Unit 3D North Point House 
North Point Business Park 
New Mallow Road 
Cork T23 AT2P 
Ireland

United Kingdom Representative 

We have appointed VeraSafe as our representative in the UK for data protection matters. While you may also contact us, VeraSafe can be contacted on matters related to the processing of Personal Data.

To contact VeraSafe United Kingdom Ltd., please use this contact form: https://www.verasafe.com/privacy-services/contact-article-27-representative/ or via telephone at: +44 (20) 4532 2003. 

Alternatively, VeraSafe United Kingdom Ltd. can be contacted at: 

VeraSafe United Kingdom Ltd 
37 Albert Embankment 
London
SE1 7TL
United Kingdom

Data Protection Officer

We have appointed VeraSafe as our Data Protection Officer (DPO). While you may contact us directly, VeraSafe can also be contacted on matters related to the processing of Personal Data. VeraSafe’s contact details are:

VeraSafe LLC
100 M Street S.E., Suite 600
Washington, D.C.
20003
USA

Email: experts@verasafe.com 
Web: https://www.verasafe.com/about-verasafe/contact-us/


Last Updated & Effective Date: October 8, 2026