// PRIVACY POLICY
Privacy Policy
Last updated: 12 October 2026
Cepheus Space Security Inc. ("Cepheus Space", "we") runs www.cepheusspace.com and intel.cepheusspace.com. This policy explains what personal data we collect through these sites, why, and the choices you have. We collect as little as we can.
Summary
- We collect personal data only when you contact us through our form, and only to reply to you.
- We use no cookies for visitors, no advertising and no cross-site tracking. Customers who sign in to the threat intelligence tool get one strictly necessary sign-in cookie.
- We never sell your data.
- We count visits with Cloudflare Web Analytics, which uses no cookies and doesn't track you across sites. Apart from that, our pages load nothing from third parties: fonts and code are served from our own sites.
What we collect
When you contact us
The form asks for your first and last name, work email, and optionally your organisation, the service you're interested in, and a message about your environment. Please don't include sensitive or classified information in the message.
When you visit the sites
Like any website, our hosting providers receive technical data needed to deliver the pages and keep them secure, such as your IP address, browser type and the pages requested. We use this only to operate and protect the service, for example to block abusive traffic. We don't use it to identify or profile visitors.
Visitor statistics
On www.cepheusspace.com we use Cloudflare Web Analytics to see how many people visit and which pages they read. It sets no cookies and stores nothing on your device. We see only totals, such as page views, the pages and sites visitors came from, and country, browser and device type. We can't see who you are, and we don't combine these statistics with any other data.
If your organisation has a threat intelligence account
Customers of the threat intelligence tool on intel.cepheusspace.com have accounts. For each user we keep their work email, name (if given), role, organisation, and when they last signed in. Signing in uses a link we email to you; there are no passwords. While you're signed in, one cookie keeps you signed in. It is strictly necessary, used only on intel.cepheusspace.com, and ends after 12 hours without use and after 30 days at most.
Your organisation's admins can describe what the organisation runs (its asset profile). We use it only to show which advisories affect your organisation and to email alerts about them. Only your organisation can see it, and it never appears in our logs. Each user chooses whether and how they receive alert emails, and can turn them off at any time on their account page.
For security, we keep an activity log of sign-ins, invitations, role changes and removals, including the IP address of each event. Your organisation's admins can see the log, without IP addresses.
Why we use it
- To respond to your enquiry and follow up about it. This is a step you ask us to take before any agreement, and is in our legitimate interest in answering enquiries.
- To provide the threat intelligence tool to customers' users: accounts, sign-in, the asset profile, alerts and the activity log are needed to perform our contract with your organisation.
- To keep the sites secure and available. This is in our legitimate interest in protecting our services and their users.
- To understand how the website is used, through cookieless visitor statistics. This is in our legitimate interest in improving the site.
Who processes it for us
We use these service providers, who act on our instructions:
- Netlify: hosts www.cepheusspace.com, and receives and stores contact-form enquiries and emails them to our team.
- Microsoft (Microsoft 365, provided through GoDaddy): our company email, where enquiries and messages you send us are received and stored.
- Cloudflare: runs our domain's DNS, hosts the threat intelligence portal, its API and customer accounts, and provides cookieless visitor statistics (Cloudflare Web Analytics). Customer account data (names, work email addresses, roles, asset profiles and activity logs) is stored in the European Union.
- Brevo (France): sends sign-in, invitation and alert emails for the threat intelligence tool.
Customer account data is stored in the EU, and our email provider Brevo is based in France. Other providers may process data outside your country, including in the United States, and requests to our sites may pass through Cloudflare's network in other countries on their way. Where required, transfers are covered by the providers' standard contractual safeguards.
How long we keep it
We keep enquiries for as long as we need them to respond and follow up, and for no more than 24 months unless you become a customer or partner. Hosting providers keep technical logs for short periods set by their own policies.
Account data is kept while your organisation is a customer and deleted within 30 days after that, or sooner on request. Sign-in links expire after 15 minutes (invitations after 7 days), and the activity log is kept for 12 months. Records of alert emails we send are kept for 90 days.
Your rights
Depending on where you live, you can ask to access, correct or delete your personal data, object to or restrict how we use it, or receive a copy of it. To do any of these, email us at the address below. We'll reply within one month. You can also complain to your local data protection authority.
Security
We are a cybersecurity company and build our sites to be secure by default: HTTPS only, strict browser security policies, and no third-party scripts. To report a vulnerability, see our security contact.
Changes
If we change how we handle personal data, we'll update this page and the date above.
Contact
Questions or requests about your data: ravikiran.talekar@cepheusspace.com