Privacy Policy for SecureNow

Account data. Your name, email address, company name, and profile image if you sign in with Google; your organization memberships and roles; your billing status. Stripe handles payments, so we never see your full card number.

Security telemetry from your applications. When you install the SecureNow package in an application you operate, it sends us request metadata (time, method, route, status code, duration, user agent), the client IP address of each request, traces, logs, and the security events you choose to send, such as sign-in attempts. The package redacts credentials, cookies, card numbers, email addresses and one-time codes inside your application before anything leaves it. Request bodies are captured only if you turn that on.

IP addresses. We process IP addresses to detect attacks, score IP reputation, enforce your blocklists, rate limits and challenges, and show you who is attacking your applications. We also record the IP address of your own requests to SecureNow, for security, abuse prevention and audit logs.

AI app connections. When you connect an AI app such as Claude or ChatGPT to your SecureNow account, we store which app you connected, the organization and access level you approved, and hashed access tokens. Each tool call is logged with the tool name and redacted arguments, for security and auditing. We don't receive your conversations with the AI app, only the requests it sends to SecureNow's tools.

Website use. Pages viewed on securenow.ai, browser type, approximate location derived from the IP address, and the cookies needed to keep you signed in.

Optional advertising. If you accept advertising in Privacy settings, we send limited events from our website and app to Meta using its Pixel and Conversions API. These include interest in pricing and setup, trial intent, registration, application setup, product feature categories, checkout and confirmed payments. Payment events include the amount and currency. We use a random advertising identifier and, where available, Meta advertising cookies to connect consented activity across securenow.ai and app.securenow.ai. We exclude names, email addresses, customer application identifiers, telemetry, security findings, prompts, search terms and private page addresses from advertising event data.

• To run the service: detection, the firewall, alerts, AI investigations, forensics and dashboards.
• To protect SecureNow and our customers: abuse prevention, account security and audit logs.
• To bill you, provide support, and tell you about your account and service changes. Marketing email only if you opt in.
• With your consent, to measure and improve Meta advertising and reach people interested in SecureNow.

We don't sell personal data, and we don't train AI models on your telemetry.

• Request telemetry (traces and logs): 7 days, then deleted.
• Alerts, blocklist entries, investigations and audit logs: for the life of your account.
• AI app access: access tokens expire after 1 hour and refresh tokens after 30 days without use; disconnecting an app revokes them at once.
• Account data: until you delete your account.
• Advertising choice and random advertising identifier cookies: up to 180 days. Revoking consent stops future optional advertising events and removes Meta advertising cookies immediately. If a network error delays withdrawal, we retain the first-party identifier solely to retry that withdrawal, then remove it when our server confirms it. Meta manages retention of events already received under its own privacy policy.

Advertising is optional and disabled until you accept. Use the persistent Privacy settings button on our website or app to accept, reject, or revoke your choice at any time. Accept and reject are offered equally. We honor Global Privacy Control and Do Not Track browser signals as a rejection. Your choice is shared across our website and app in this browser; rejecting does not affect access to SecureNow. Learn more in Meta's privacy policy.

You can access, correct, export or delete your data, and delete your account yourself in Settings. You can disconnect AI apps in Settings → Connected apps, and stop or limit telemetry capture at any time. If you're in the EU or UK, you also have the right to object, to restrict processing and to complain to a supervisory authority (in France, the CNIL). Contact contact@securenow.ai to exercise any of these rights.

When you instrument your application, you decide what is sent and you are the controller of your end users' data, such as the IP addresses of visitors to your site. SecureNow processes that data on your behalf. You are responsible for informing your users and having a legal basis to collect it.

Data is encrypted in transit and at rest. API keys and access tokens are stored only as hashes, access is role-based, and changes are written to audit logs.

We store service data in the EU (Paris). Some providers, such as OpenAI, Anthropic, Stripe, Resend, Google and Meta, may process data in the United States under applicable transfer safeguards, including standard contractual clauses.

SecureNow is a service for businesses and is not directed to anyone under 18.

We'll email you before significant changes take effect. Questions: contact@securenow.ai.