Privacy
What we collect, why we collect it, how long we keep it, and what you can tell us to do with it. Each clause has a plain-English line beside it — where the two ever disagree, treat the plain-English one as what we meant.
Digital Spectre is not a real company. This site is a design and engineering showcase. There is no product, no service and no customers — the company, the people quoted, the metrics and the customer figures throughout the site are invented for demonstration. Nothing here is an offer, no data is collected from you, and the notice below describes how a company of this kind would handle your data rather than how anyone actually does.
This page is illustrative and is not in force. It is published so you can see the shape the notice would take. It is not a binding privacy notice — if something on it matters to you, ask us and we will answer directly.
Who we are
We're the company you'd complain to.
Digital Spectre is the data controller for information collected through this website and for account data held about our customers. Where we process data on a customer's behalf inside their own environment, we act as a processor under their instructions and our data processing agreement governs instead.
Registered address and company number to be inserted. Questions go to our contact page.
What we collect
What you type into a form, plus basic analytics. Not your agents' data.
- Information you give us. Name, work email, company, role and anything you write in a message when you request a walkthrough or contact us.
- Account information. For customers: users, workspace settings, billing contacts and subscription details.
- Technical information. Our host records standard server logs, including IP address and browser type, to serve the site and protect it from abuse. We run no analytics on top of them.
- Support correspondence. Emails and tickets, kept so we don't ask you the same question twice.
We do not collect special category data through this website, and we ask that you don't include any in free-text fields.
Your agents' data is not ours
The traces stay in your cloud. We're a processor there, not a controller.
The enforcement layer runs inside your own cloud account. Trace data, policy decisions and audit records generated by your agents are yours, held in your infrastructure, and processed by us only where you have asked us to and only under the terms of a data processing agreement.
None of it is used to train models, improve our product, benchmark other customers, or for any purpose you have not agreed to in writing. See our trust page for what is and isn't stored.
Why we process it
To reply to you, run your account, keep the service working, and meet our own legal duties.
- To respond to enquiries and arrange the walkthrough you asked for
- To provide, bill for and support the service under our contract with you
- To keep the site and service secure, and to investigate misuse
- To understand how the site is used so we can improve it
- To meet accounting, tax and other legal obligations
Where the law requires a lawful basis, we rely on contract for account and billing data, legitimate interests for security and site analytics, and consent for any marketing you have opted into. You can withdraw consent at any time without affecting anything done before you did.
International transfers
If data crosses a border, there's a legal mechanism behind it.
Where personal data is transferred outside the region it was collected in, we rely on an approved transfer mechanism — an adequacy decision where one exists, or standard contractual clauses with supplementary measures where it does not. Customer trace data does not move regions at all: it stays in the region of your workspace.
How long we keep it
Enquiries for two years, account data for the contract plus seven, analytics for fourteen months.
- Enquiry and marketing data — 24 months from your last interaction, then deleted
- Account and billing records — the life of the contract plus seven years, to meet accounting requirements
- Support correspondence — 36 months
- Server logs — retained by our host under their own schedule
- Customer trace data — whatever retention you set on your workspace, from 30 days to 10 years
Deletion is propagated to backups within 35 days.
Your rights
Ask us for it, ask us to fix it, ask us to delete it. We won't make it difficult.
Depending on where you are, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to how we use it, receive it in a portable format, and withdraw consent. You also have the right to complain to your data protection authority.
Write to us via the contact page. We respond within one month and won't charge you for it. We may ask you to confirm your identity first, which is a protection for you rather than an obstacle.
Cookies
There aren’t any. No cookies, no analytics, no tracking.
This site sets no cookies at all. There is no analytics package, no tracking pixel and no advertising technology anywhere on it, which is why you have not been asked to dismiss a consent banner.
If that ever changes we will say so on this page before it does, and ask you first wherever the law requires consent.
Security
Encrypted in transit and at rest, access on a need-to-have basis, tested by outsiders.
We apply technical and organisational measures appropriate to the risk, including encryption in transit and at rest, least-privilege access control, logging of internal access, and annual independent penetration testing. Internal access to customer environments is off by default, time-boxed when granted, and written to the customer's own audit trail.
Detail is on our trust page. To report a vulnerability, see the disclosure section there.
Children
This is a business product. It isn't for children and we don't market to them.
Our service is intended for organisations and is not directed at anyone under 16. We do not knowingly collect personal data from children. If you believe we have, tell us and we will delete it.
Changes to this notice
If we change something material, we'll tell you rather than quietly update the date.
We will post any changes on this page and update the date above. Where a change materially affects how we handle your personal data, we will notify account holders by email at least thirty days before it takes effect.