Privacy Notice

Secure Shield operates the WAF, CDN and edge security platform described on this site. For personal data we collect about our customers and website visitors, Secure Shield acts as the data controller. Where we process traffic data on behalf of a customer's own end users, we act as a processor under that customer's instructions.

1. Personal data we collect

• Account data — name, email address, username, login credentials (hashed), and role.
• Configuration data — domains, DNS records, certificates, WAF and rate limiting rules, CDN settings, API token metadata and webhook endpoints.
• Security and traffic telemetry — request counts, bandwidth, cache statistics, source IP addresses, user agents, blocked threat events and timestamps.
• Support and communications — messages you send us, alerts and notification preferences.
• Billing data — plan, subscription status, invoices and transaction records. Card details are never collected or stored by us; they are handled by our payment processor, Stripe.
• Device and log data — IP address, browser and device identifiers, and audit log entries of actions taken in the dashboard.

2. Why we use it, and our legal basis

• Creating and administering your account and providing the Service — performance of a contract.
• Detecting, blocking and investigating attacks, fraud and abuse; keeping audit trails — legitimate interests in securing the platform and our customers.
• Support, service notifications and incident alerts — contract and legitimate interests.
• Product improvement and capacity planning using aggregated usage data — legitimate interests.
• Marketing emails, where applicable — consent, withdrawable at any time.
• Accounting, tax and responding to lawful requests — legal obligation.

3. Who we share data with

• Service providers / subprocessors — cloud hosting, database, email delivery and error monitoring providers, acting on our instructions.
• Stripe, our payment processor — for checkout, subscription management, payments, tax calculation, invoicing and refunds.
• Professional advisers — legal, accounting and audit advisers, where necessary.
• Authorities — where we are required to disclose by law or to protect our legal rights.

We do not sell personal data.

4. International transfers

Our infrastructure and providers may process data outside your country, including outside the UK and EEA. Where that happens we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.

5. Retention

Account and billing records are retained for the life of the account and then for as long as required for tax and legal purposes. Security events, traffic analytics and logs are retained according to your plan's retention window (7 days on Starter, 30 days on Professional, extended retention on Enterprise) and are deleted or aggregated after that. Audit logs are retained for up to 12 months. When data is no longer needed it is deleted or anonymised.

6. Your rights

Subject to applicable law, you may request access to your personal data, rectification, erasure, restriction of processing, portability, and object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time. If you are in the UK or EEA, you also have the right to complain to your supervisory authority. We respond to requests within one month.

7. Security

We apply appropriate technical and organisational measures, including encryption in transit, row-level access controls, least-privilege administrative access, multi-factor authentication options and audit logging of privileged actions.

8. Cookies

We use strictly necessary cookies and local storage to keep you signed in and to maintain your session and preferences. Any analytics cookies are used only in aggregate to understand product usage; you can manage or clear cookies through your browser settings.

9. Contact

For privacy questions or to exercise your rights, contact Secure Shield at privacy@gosecureshield.com.