Privacy Policy

This Privacy Policy explains how GreyArm, LLC (“GreyArm”, “we”, “us”) collects, uses, shares and protects personal information when you use our websites, web console, desktop sensor, mobile apps and related services (the “Services”). GreyArm, LLC is the controller of the personal information described here, except where we process information on your behalf about other people who use the devices and networks you monitor — for that information, you decide what is monitored and we act on your instructions.

Contact us about privacy at support@greyarm.com.

The desktop sensor analyzes activity on your computer locally. Used without an account, its findings stay in a data file on that computer and are never sent to us; the app sends only anonymous product-usage analytics, which you can turn off. Information about what GreyArm detects reaches our servers only when you create an account and link a device to it.

Information you give us

Information from devices you link

When you link a computer running the desktop sensor, it sends us, roughly every 30 seconds while running:

Command lines and file paths can contain folder names, usernames or other text you typed. We use them only to identify and explain AI activity.

Information from the mobile apps

Your session token (kept in your device’s secure storage) and, if you allow notifications, a push token, platform and device name or model so we can deliver alerts. The mobile apps contain no advertising or third-party analytics SDKs.

Product-usage analytics in the apps

The desktop sensor and mobile apps send us usage events — for example, that the app opened, which screens were viewed, that a scan finished and how long it took, how many agents and devices it counted, and which features (such as containment or the DNS shield) were used — together with a random install identifier, app and operating-system version, device type and model, and language. These events never include what GreyArm detects: no program names, paths, command lines, hostnames or network addresses. You can turn this off in the desktop app under Settings → Monitoring → Share usage analytics.

Website and web console analytics

We use Google Analytics 4 to understand how people use our websites and web console — pages viewed, buttons clicked, sign-ups, and whether a subscription was started — so we can improve them. Google Analytics uses cookies and receives your IP address, browser and device information, and an identifier for your browser; when you are signed in we also send an opaque account identifier (never your name or email) so usage across devices is counted once. When a subscription payment succeeds, our server reports the purchase (plan and amount, not card details) to Google Analytics. Google’s advertising features, ad personalization and Google Signals are turned off. In the EEA, the UK and Switzerland, analytics cookies are only set if you accept them, and you can change your choice at any time with “Cookie settings” in the website footer.

Information collected automatically

When you use our websites, web console or APIs, our servers record technical information such as IP address, browser and device type, and timestamps. We derive approximate location (city, region, country) from IP addresses to secure accounts — for example, to show you where a sign-in came from. See our Cookie & Storage Policy.

• Provide the Services — show your devices, agents, alerts and network in the web console and mobile apps, deliver alerts, relay containment commands you send, and keep your account working.
• Billing — run trials and subscriptions, send receipts and trial reminders, and prevent payment fraud.
• Security and integrity — authenticate you, detect abuse, bots and unauthorized access, and protect our users and systems.
• Improve detection — understand which AI software is appearing so we can update our catalog and rules. We use aggregated or de-identified information for this wherever possible.
• Communicate — send service and security messages and, if you subscribe, our newsletter. You can unsubscribe from marketing at any time.
• Legal — comply with law, enforce our terms, and establish or defend legal claims.

Where the GDPR or similar laws apply, we rely on: performance of our contract with you (providing the Services and billing); our legitimate interests in securing and improving the Services, which we balance against your rights; your consent (non-essential cookies, newsletter, push notifications), which you can withdraw at any time; and legal obligations (tax and accounting records, responding to lawful requests).

We do not sell personal information and do not share it for cross-context behavioral advertising. We disclose it only as follows:

Our service providers may use personal information only to provide services to us, under contracts that require them to protect it.

We protect information with encryption in transit (TLS), hashed passwords, access controls, and monitoring. The desktop sensor stores its local data in its application-data folder, protected by your operating-system account; anyone with access to that account can read it. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and regulators as the law requires.

Wherever you live, you can:

• use the desktop sensor without an account, unlink any device, and turn off network discovery or the DNS shield;
• turn off push and email notifications in the app and unsubscribe from marketing email using the link in every message;
• decline or withdraw analytics cookies with “Cookie settings” in the website footer, block cookies in your browser, install Google’s Google Analytics opt-out add-on, and turn off usage analytics in the desktop app;
• access, correct, export or delete your personal information — see Account & Data Deletion, or email support@greyarm.com.

EEA, UK and Switzerland

You also have the right to restrict or object to processing, to data portability, to withdraw consent, and to complain to your local data-protection authority.

U.S. state privacy rights

Residents of California and other states with consumer-privacy laws may request to know, access, correct and delete personal information and to opt out of its sale, sharing for targeted advertising, or profiling. We do not sell or share personal information or use it for targeted advertising or profiling with legal effects, and we do not use sensitive personal information to infer characteristics. We honor Global Privacy Control signals as an opt-out request. We will not discriminate against you for exercising your rights. You may use an authorized agent; we may ask you to verify your identity and the agent’s authority. If we deny a request, you may appeal by replying to our decision.

In the past 12 months we have collected the categories of personal information described in “Information we collect” — identifiers, commercial information, internet or network activity, approximate geolocation, and inferences in the form of risk assessments of software — for the purposes and recipients described above.

We respond to verified requests within the time the law requires, usually 30 to 45 days.

If you install GreyArm on devices other people use, information about the software they run and the AI services those devices contact will be visible to you. You are responsible for having the right to monitor those devices and for giving any notice or obtaining any consent the law requires. See our Acceptable Use Policy.

The Services are not directed to children, and accounts are only for adults. We do not knowingly collect personal information directly from children under 13 (or under 16 where the law sets a higher age). A parent or guardian may use GreyArm on a child’s device; in that case, information about the device is collected at the parent’s direction and is controlled by the parent’s account. If you believe a child has given us personal information, contact support@greyarm.com and we will delete it.

We are based in the United States, and we and our service providers process information in the United States and other countries. Where we transfer personal information from the EEA, UK or Switzerland, we use safeguards such as the European Commission’s Standard Contractual Clauses and their UK and Swiss equivalents.

We will post any changes here and update the effective date. If a change is material, we will notify you by email or in the product before it takes effect.

GreyArm, LLC · support@greyarm.com. We answer privacy requests within 30 days, and sooner where the law requires.