Privacy Policy - ThreatLens Security Platform

1. Scope & Purpose

This Privacy Policy explains how ThreatLens ("we", "our", or "the Platform") collects, stores, processes, and protects telemetry and account information in connection with our cybersecurity awareness, phishing simulation, and email security analytics services.

ThreatLens is deployed strictly for organizational risk management, authorized employee security education, and defensive threat intelligence analysis. We do not sell personal data, monetize user information, or share simulation results with external advertising platforms.

2. Information Collected

We process only the telemetry necessary to execute authorized simulations and measure cybersecurity resilience:

Account & Authentication Records: Email address, authorized organizational role (Admin, Analyst, or User), and bcrypt-hashed password credentials managed via Firebase Authentication. We never store plaintext passwords.
Phishing Simulation Telemetry: Timestamp of simulation interactions, target recipient email, campaign identifier, client IP address, and User-Agent string recorded when a simulation tracking URL is accessed.
Email Open Verification: 1x1 tracking pixel requests used solely to determine whether an educational simulation email reached the recipient inbox and was opened.
Flagged Threat Intelligence: Email sender headers, subject line, body text fragments, and threat category submitted by users who report suspicious messages for AI heuristic classification.

Simulation Privacy Principle: Simulation telemetry is collected strictly for employee coaching and organization-level posture metrics. Passwords or credentials entered into simulation landing pages are discarded or hashed; plaintext form credentials are never stored.

3. Data Storage & Infrastructure

Telemetry records, user profiles, and threat reports are persisted in Google Cloud Firebase Realtime Database with TLS 1.3 encryption in transit and AES-256 encryption at rest. Access to administrative records requires valid JWT bearer token authorization.

Local database backups and cache structures are maintained with thread-safe locking and are restricted to authorized system administrators executing the backend service.

4. Data Retention & Deletion

We adhere to data minimization principles:

Simulation click records and open tracking metrics are maintained for 90 days following campaign completion, after which they are aggregated into anonymized metrics or deleted upon administrator request.
Account records persist until account termination by the administrator or upon formal data deletion request.
System administrators may initiate a full telemetry purge at any time using the administrative clear endpoint.

5. Your Rights (GDPR & CCPA Compliance)

Depending on your jurisdiction, employees and users participating in ThreatLens simulations have the right to:

Request access to the personal data and interaction history associated with their email address.
Request rectification of inaccurate account details.
Request the erasure of simulation records in accordance with employer data governance policies.
Inquire regarding the technical criteria and scoring used in risk assessments.

6. Contact & Governance

For inquiries regarding this Privacy Policy, telemetry handling, or compliance procedures, please contact your designated Security Administrator or reach our compliance team at privacy@threatlens.local.