Menu

Privacy Policy

Effective date: 1 May 2026 · Last updated: 1 June 2026

SpoofShield LLC (“SpoofShield”, “we”, “us”, “our”) is committed to protecting your personal data. This Privacy Policy explains what information we collect, how we use it, and your rights under applicable data protection law including the UK GDPR and EU GDPR.

1. Who We Are

Controller: SpoofShield LLC.

Contact for data protection enquiries: privacy@spoofshield.net

2. What Data We Collect

Account data — when you register, we collect your name, work email address, company name, and billing information (processed by our payment provider; we do not store card numbers).

Alert metadata — when the Outlook add-in detects a threat, it logs: sender email address, recipient email address(es), threat type, risk level, and timestamp. Email body content, attachments, and subject lines are never transmitted to our servers. All detection runs locally inside Outlook on your device.

Usage data — we collect standard web server logs (IP address, browser type, pages visited, timestamps) to operate and improve the service.

Support data — if you contact support, we retain your messages and any attachments you send.

3. How We Use Your Data

We process your data on the following legal bases:

  • Contract performance — to deliver the SpoofShield service, manage your subscription, and provide technical support.
  • Legitimate interests — to detect fraud, improve our detection engines (using aggregated, anonymised alert statistics), and maintain the security of our systems.
  • Legal obligation — to comply with applicable law and respond to lawful requests from authorities.
  • Consent — to send marketing communications, where you have opted in. You may withdraw consent at any time.

    • 4. Data We Do Not Collect

    SpoofShield is designed to be minimally invasive:

  • We do not read, store, or transmit the content of your emails.
  • We do not collect email attachments or subject lines.
  • We do not sell your personal data to third parties.
  • We do not use your data for targeted advertising.

    • 5. Data Sharing

    We share data only with trusted sub-processors necessary to operate the service:

  • Clerk — identity and authentication management.
  • Stripe — payment processing. Card data goes directly to Stripe and is never stored by SpoofShield.
  • Replit / cloud hosting — server infrastructure and deployment.
  • Email delivery providers — for transactional emails (receipts, alerts).

    • All sub-processors are contractually bound to process data only as instructed and to maintain appropriate security standards.

    6. International Transfers

    Some of our sub-processors are based outside the UK/EEA. Where personal data is transferred internationally, we rely on Standard Contractual Clauses (SCCs) approved by the relevant authority, or equivalent safeguards, to protect your data.

    7. Data Retention

    We retain personal data only as long as necessary:

  • Account data — for the duration of your subscription plus 7 years (for legal and accounting obligations).
  • Alert metadata — for 12 months on a rolling basis, after which it is automatically deleted.
  • Support records — for 2 years from closure of the support ticket.
  • Web logs — for 90 days.

    • 8. Your Rights

    Under UK/EU data protection law you have the right to:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — ask us to correct inaccurate or incomplete data.
  • Erasure — request deletion of your data where there is no legitimate reason for us to continue processing it.
  • Restriction — ask us to pause processing your data in certain circumstances.
  • Portability — receive your data in a structured, machine-readable format.
  • Objection — object to processing based on legitimate interests.
  • Withdraw consent — for any processing based on consent (e.g. marketing emails).

    • To exercise any right, email privacy@spoofshield.net. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.

    9. Cookies

    We use strictly necessary cookies for authentication session management (via Clerk). We do not use advertising or tracking cookies. A cookie is a small text file stored on your device; you can block cookies in your browser settings, though this may prevent you from signing in.

    10. Security

    We implement industry-standard technical and organisational measures to protect your data, including encryption in transit (TLS), access controls, and regular security reviews. No method of transmission over the internet is 100% secure; we will notify affected users of any breach as required by law.

    11. Children

    SpoofShield is a business-to-business service and is not directed at children under 16. We do not knowingly collect personal data from minors.

    12. Changes to This Policy

    We may update this Privacy Policy from time to time. We will notify you by email or via a banner in the dashboard for any material changes. Continued use of the service after the effective date constitutes acceptance of the updated policy.

    Questions about this Privacy Policy? Contact our data protection team at privacy@spoofshield.net.