Cynoculist Inc.
Effective Date: September 15, 2026
This Privacy Policy describes how Cynoculist Inc. ("Cynoculist," "we," "us," or "our"), a Delaware corporation operating from the New York / New Jersey metro area, collects, uses, and discloses information obtained through our marketing website (the "Site"), Cynoculist Hub (our AI Security Control Plane), and its products DASTA-AI, Intel GRC, and AetherSOC.
We are committed to respecting your privacy and protecting the data you entrust to us. This policy outlines our practices concerning personal and technical information collected through our marketing website and our professional software applications.
Our Site serves as an informational resource and does not utilize user authentication; however, our authenticated applications are subject to the specific data treatments described below.
While our primary marketing website does not use cookies, our authenticated web applications (Cynoculist Hub and its products Intel GRC, DASTA-AI, and AetherSOC) utilize strictly necessary cookies.
These cookies are essential for session management, user authentication, and maintaining security across multi-tenant environments.
Because these cookies are strictly necessary for the operation of the services and are not used for behavioral tracking or advertising, they are active by default. In compliance with global data privacy standards, a cookie consent banner is not required for these functional elements.
We collect information through the following channels:
Information provided via "Contact Us" forms, including name, email address, and company details.
For users of Cynoculist Hub and its products (Intel GRC, DASTA-AI, and AetherSOC), we collect names, email addresses, and organizational affiliations to facilitate Role-Based Access Control (RBAC).
To provide automated security assessments via the DASTA-AI platform, we collect user-provided target URLs, crawl exclusions, and authentication inputs (such as login credentials or field hints).
To provide autonomous alert triage and enrichment via the Aether SOC platform, we process security alerts ingested from connected cloud and SIEM sources (AWS GuardDuty, GCP Security Command Center, Azure Sentinel, Wazuh, and custom webhooks). These alerts may contain IP addresses, resource identifiers, and event metadata. Network indicators (IPs, domains, file hashes) extracted from alerts may be submitted to third-party threat intelligence, IP reputation, and exposure data sources solely for enrichment. No user personal data is transmitted to these services. All alert data is scoped per organization and is not shared across tenants.
We process system findings and scan results to generate technical summaries and executive risk narratives.
For subscribers of the DASTA-AI Personal license, payment processing is handled securely via Stripe. We do not store full credit card numbers on our servers. All other licenses are billed by enterprise invoice and do not involve card processing.
Test artifacts, prompts, and model responses collected during authorized red-team engagements are retained only for the duration needed to deliver findings and are scoped to the client tenant.
User-authored policy content remains the customer's property. We process that content solely to provide authoring, versioning, review, and attestation features.
We process attendance, completion, and quiz records to deliver training evidence for the customer's security awareness program.
We do not sell personal information. We share data only with the following subprocessors necessary to maintain our cloud infrastructure and application logic:
We may disclose information if required to do so by law or in the good faith belief that such action is necessary to comply with legal obligations.
We implement industry-standard administrative and technical safeguards to protect your data. For automated reporting workflows, we utilize data de-identification techniques to ensure sensitive technical strings are protected during the generation of risk summaries.
While we strive to protect all data, no method of transmission or electronic storage is 100% secure; therefore, we cannot guarantee absolute security.
California residents possess the following rights regarding their personal information:
Request details regarding the categories of data collected over the past 12 months.
Request the deletion of personal information, subject to certain legal and functional exceptions.
We will not deny service or change pricing based on the exercise of your privacy rights.
To exercise these rights, please contact privacy@cynoculist.com.
Our applications and services are designed for professional security and business use. We do not knowingly collect information from individuals under the age of 18.
We may update this Privacy Policy to reflect changes in our service offerings or regulatory requirements. We will notify users of significant changes by updating the "Effective Date" at the top of this policy.
New York / New Jersey Metro Area (Remote-first)
A Delaware corporation
This Privacy Policy was last updated on September 15, 2026