Privacy Policy

Spider Gadget, Lda. ("Spider Gadget", "SpiderIQ", "we", "us", or "our"), a company incorporated under the laws of Portugal and headquartered in Lisbon, operates the SpiderIQ cybersecurity platform available at spidergadget.io. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website, use our platform, or interact with our services.

We are committed to protecting your privacy and processing your personal data in accordance with the General Data Protection Regulation (GDPR), the Portuguese Data Protection Law (Lei n.º 58/2019), and other applicable privacy legislation.

By accessing or using SpiderIQ, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with its terms, please discontinue use of our services.

2.1 Information You Provide Directly

• Account registration data: full name, work email address, company name, company size, and password (stored as a cryptographic hash)
• Contact form submissions: name, email, company, inquiry type, and message content
• Free trial sign-up data: name, email, company, selected plan, first scan target, and scan type
• Billing information: processed exclusively by our payment processor; we do not store full card numbers
• Communications: emails, support tickets, and chat messages you send to us

2.2 Information Collected Automatically

• Log data: IP address, browser type and version, operating system, referring URLs, pages visited, and timestamps
• Device identifiers: hardware model, unique device identifiers, and mobile network information
• Usage data: features accessed, scan configurations, API call patterns, and session duration
• Cookies and similar tracking technologies (see Section 9)

2.3 Information from Third Parties

• Partner referral data when you are introduced to SpiderIQ through a certified partner
• Publicly available threat intelligence data used to enhance vulnerability detection
• Single sign-on (SSO) providers if you authenticate via an identity provider

We use the personal data we collect for the following purposes:

• Providing, operating, and maintaining the SpiderIQ platform and its features
• Processing free trial and subscription sign-ups and provisioning portal access
• Sending transactional communications including account confirmations, security alerts, and invoices
• Responding to support requests, inquiries, and feedback
• Improving and personalising our services based on usage patterns and feedback
• Conducting security research and developing new vulnerability detection capabilities
• Complying with legal obligations, including responding to lawful requests from public authorities
• Detecting, preventing, and addressing fraud, abuse, and security incidents
• Sending marketing communications where you have given explicit consent or where a legitimate interest applies
• Generating aggregated, anonymised analytics to understand platform usage trends

For users in the European Economic Area (EEA), we process your personal data under the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR): processing necessary to provide the services you have requested or to take pre-contractual steps
• Legitimate interests (Art. 6(1)(f) GDPR): improving our platform, preventing fraud, and direct marketing to existing customers
• Legal obligation (Art. 6(1)(c) GDPR): compliance with applicable laws and regulatory requirements
• Consent (Art. 6(1)(a) GDPR): marketing emails to prospects, non-essential cookies, and any processing where we have explicitly requested your consent

You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

We do not sell, rent, or trade your personal information. We may share your data with:

5.1 Service Providers — trusted third-party vendors who process data on our behalf under data processing agreements, including cloud infrastructure providers, email delivery services, payment processors, and analytics platforms.

5.2 Business Partners — certified SpiderIQ partners, only where you have engaged with them directly or consented to such sharing.

5.3 Legal Requirements — when required by law, court order, or governmental authority, or when necessary to protect the rights, property, or safety of SpiderIQ, our users, or the public.

5.4 Business Transfers — in connection with a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

We retain personal data for as long as necessary to fulfil the purposes described in this policy, unless a longer retention period is required by law:

• Active account data: retained for the duration of your subscription plus 90 days after termination
• Scan results and vulnerability reports: retained for 12 months after generation, or as configured by your organisation
• Contact and support records: retained for 3 years from last interaction
• Financial and billing records: retained for 7 years in compliance with Portuguese tax law
• Server logs: retained for 90 days for security and debugging purposes
• Marketing consent records: retained until consent is withdrawn plus 3 years

Upon expiry of the applicable retention period, data is securely deleted or anonymised.

As a cybersecurity company, we hold ourselves to the highest standards of data protection. Our security measures include:

• Encryption in transit using TLS 1.3 for all data transmitted between your browser and our servers
• Encryption at rest using AES-256 for all stored personal data and scan results
• Role-based access controls (RBAC) limiting employee access to personal data on a need-to-know basis
• Multi-factor authentication (MFA) enforced for all internal systems and customer-facing portals
• Regular penetration testing and vulnerability assessments of our own infrastructure
• SOC 2 Type II and ISO 27001 certified security controls
• Incident response procedures with notification timelines compliant with GDPR Article 33

Despite these measures, no method of transmission over the internet is 100% secure. In the event of a data breach affecting your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours as required by GDPR.

Under GDPR and applicable privacy laws, you have the following rights regarding your personal data:

• Right of access (Art. 15): obtain a copy of the personal data we hold about you
• Right to rectification (Art. 16): request correction of inaccurate or incomplete data
• Right to erasure (Art. 17): request deletion of your data where no legitimate basis for retention exists
• Right to restriction (Art. 18): request that we limit processing of your data in certain circumstances
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format
• Right to object (Art. 21): object to processing based on legitimate interests or for direct marketing
• Rights related to automated decision-making (Art. 22): not be subject to solely automated decisions with significant effects

To exercise any of these rights, contact our Data Protection Officer at privacy@spidergadget.io. We will respond within 30 days. You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.

We use cookies and similar technologies to operate and improve our services. For full details, please see our Cookie Policy. In summary:

• Strictly necessary cookies: required for the platform to function; cannot be disabled
• Performance cookies: help us understand how visitors interact with our website
• Functional cookies: remember your preferences and settings
• Analytics cookies: used to measure traffic and usage patterns (requires consent)

You can manage your cookie preferences at any time through our cookie consent banner or your browser settings.

SpiderIQ is headquartered in Lisbon, Portugal, within the European Economic Area. Where we transfer personal data to third-party service providers outside the EEA, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Transfers to countries with an adequacy decision from the European Commission
• Binding Corporate Rules where applicable

SpiderIQ is a professional cybersecurity platform intended exclusively for business use. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us immediately at privacy@spidergadget.io and we will promptly delete such information.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify registered users by email at least 14 days before the changes take effect
• Display a prominent notice on our website

Your continued use of SpiderIQ after the effective date of any changes constitutes your acceptance of the revised policy.

For privacy-related inquiries, data subject requests, or to contact our Data Protection Officer: