Privacy Policy

1Information We Collect

We collect the following categories of information:

• Account information — business name, email address, and password (handled by our authentication provider, Supabase) when you create an account.
• Log files you upload — the system, security, network, or application log data you choose to submit for analysis.
• Generated content — the security assessments, findings, executive reports, and AI Analyst conversations produced from your uploads.
• Billing information — for paid plans, payment details are collected and processed directly by our payment processor (Stripe); KnightHawk does not store full card numbers.
• Usage and device information — pages visited, actions taken in the dashboard, browser/device type, and approximate location (via IP), collected through analytics tools described in Section 5.
• Communications — messages you send us through the contact form, support tickets, or email.

2How We Use Information

We use the information we collect to:

• Create and maintain your account and authenticate your access to the Service
• Generate the security assessments, CMMC readiness content, and reports you request
• Process payments and manage subscriptions
• Send transactional email (account confirmation, password reset, report notifications) and, where applicable, product updates
• Monitor, secure, and improve the Service, including diagnosing technical issues
• Measure the effectiveness of our marketing, including paid search campaigns
• Comply with legal obligations and enforce our Terms & Conditions

We do not sell your personal information or your log data to third parties.

3Log File & Report Data

Isolation. Log files and reports you submit are associated only with your own customer account. Other customers cannot access your uploads, findings, or reports.

Access to your systems. Watchtower does not remotely access, scan, or modify your computers or networks. It analyzes only the log file you actively choose to upload.

Minimization. We aim to retain only what is necessary to deliver the Service — primarily the parsed event data and generated report content that power your report history, AI Analyst Q&A, and (where applicable) CMMC evidence tracking — rather than indefinitely archiving raw uploaded files. We are continuing to harden the technical retention behavior of underlying processing infrastructure to match this goal as closely as possible, and we do not represent that raw uploaded file content is guaranteed to be deleted immediately upon processing.

If you have specific questions about how a particular upload was retained or want a copy deleted, contact us using the details in Section 12 and we will address the request.

4AI Processing & Third-Party Vendors

To generate your assessment, parsed log event summaries (not raw uploaded files) are sent to our AI provider (currently OpenAI's API) to produce the report narrative, findings, and remediation guidance. We rely on the following categories of subprocessors to operate the Service:

Vendor	Purpose
Supabase	Account authentication and session management
OpenAI	AI-generated report analysis and AI Analyst Q&A
Stripe	Payment processing for paid plans
Resend	Transactional account email delivery
Hostinger	Hosting infrastructure for the application and website

These vendors are only permitted to use your data to provide services to KnightHawk, not for their own independent purposes, and are subject to their own privacy and data-handling terms.

5Cookies, Analytics & Advertising

We use the following tools to understand how visitors use our website and application, and to measure advertising performance:

• Google Analytics (GA4) & Google Ads — measures site usage and campaign performance. Google may set cookies to attribute a conversion (such as account creation) back to an advertisement you clicked.
• FullStory — session-replay analytics that helps us understand how visitors interact with our pages so we can fix usability issues.

You can control cookies through your browser settings. Disabling cookies may limit some functionality of the Service.

6Data Retention

We retain account information and generated reports for as long as your account remains active. If you close your account or request deletion, we will delete or anonymize your account information and report data within 30 days, except where we are required to retain records for legal, tax, or fraud-prevention purposes.

7Data Security

We use industry-standard safeguards — including encrypted connections (HTTPS/TLS), authenticated access, and per-customer data isolation — to protect information submitted to the Service. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8Your Rights & Choices

Depending on where you live, you may have rights to access, correct, export, or delete the personal information we hold about you. To exercise any of these rights, contact us using the details in Section 12. We will respond to verified requests within a reasonable time and in accordance with applicable law.

9Children's Privacy

The Service is intended for business use by individuals who are at least 18 years old. We do not knowingly collect personal information from children, and the Service is not directed to children.

10International Users

KnightHawk is based in the United States and our infrastructure is hosted in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States.

11Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the Effective Date at the top of this page and, where practicable, notify registered account holders by email. Continued use of the Service after an update constitutes acceptance of the revised policy.

12Contact

If you have questions about this Privacy Policy or how your information is handled, contact us:

KnightHawk Cybersecurity LLC
Email: info@knighthawkcybersecurity.com
Website: knighthawkcybersecurity.com