Date Last Revised: October 30, 2026
This Privacy Policy describes how Critical Start, Inc. and its subsidiaries and affiliates (collectively “Critical Start” or “we” or “us” or “our”) collect, use, maintain, and disclose personal information from users of our websites and from customers who use our products and services (“Products and Services”) including related Web portals.
Please note that this Privacy Policy does not apply to the information we process solely on behalf of our customers as a processor or service provider. Such processing of personal information is governed by agreements between us and our customers. These agreements require our customers to comply with applicable privacy laws and, to the extent the customers are legally required, provide privacy notices to the individuals whose data our customers process using Critical Start’s offerings.
This Privacy Policy does not pertain to personal information of Critical Start employees.
Please read this Privacy Policy carefully. By using the website, or otherwise interacting with us, you agree to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree to this Privacy Policy, please do not use or access the website.
Critical Start delivers security solutions to help protect organizations from advanced cyberattacks. Critical Start will collect data on behalf of and under the legal instructions of our customers in connection with the Products and Services. In that context, our customers are the data controllers and Critical Start is the data processor subject to the terms of the applicable contractual agreement between Critical Start and applicable customers.
To protect our customers from attackers, Critical Start collects information directly from our customers. Most of the information we collect through our Products and Services is metadata or log alerts, for example, data about how a device is being used, information about software applications, login times, processes launched or executed files, and what operating systems are being utilized. Depending on local laws, some of the data we collect is considered personal data, such as IP addresses or device ID names. Also, we collect personal data if it appears within usernames, filenames, file paths, and machine names. However, we only use the data that we collect through our Products and Services as permitted by the applicable customer agreement, including any applicable data processing agreement, and as otherwise permitted by applicable law.
Please see our Data Protection Agreement located in the Critical Start Trust Center (trust.criticalstart.com) for more information. If there is a conflict or inconsistency between this Privacy Policy and your contractual agreement with Critical Start, the applicable contractual agreements shall control with respect to the Products and Services.
When you use or access the website/web portal, we collect certain categories of information about you from a variety of sources.
Some features of the website require you to directly provide us with certain information about yourself. You may elect not to provide this information, but doing so will prevent you from using or accessing these features. Information that you directly submit through our website includes:
We also automatically collect certain information about your interaction with the website, when you open an email, or connect to our wireless internet access (“Usage Data”). To do this, we use cookies, pixels, SDKs, web beacons/clear gif, and other geolocation tracking technologies (“Tracking Technologies”). Usage Data includes:
For more information on how we use Tracking Technologies and your choices, see the section below, “Cookies and Other Tracking Technologies”.
We obtain information about you from outside sources, including information that we collect directly from third parties and information that you choose to have shared with us. Such third parties and information includes:
Any information we receive from outside sources will be treated in accordance with this Privacy Policy. We are not responsible for the accuracy of the information provided to us by third parties and are not responsible for any third party’s policies or practices. For more information, see the section below, “Third Party Websites; Links and Embedded Content”.
With respect to the categories of information we collect, we use information about you as described below:
As you interact with our website, we use automatic data collection technologies to collect certain information about your equipment and analyze information on site performance and usage, browsing actions and patterns, including Cookies, user data for sales tools, tracking codes in coordination with offers made on social media sites, and visitor IP addresses and domain names for reporting and website usage analysis. This information is collected via Tracking Technologies (as defined above).
The website automatically uses cookies and Tracking Technologies to track your use of the website in order to facilitate and enhance the user experience on the website, to learn and track how you access and use the website, including when and how users visit the website and how popular particular website pages are and aren’t, to provide you with customized advertising, and for other purposes as described herein.
Most browsers accept cookies and other Tracking Technologies automatically, but you may be able to control the way in which your devices permit the use of Tracking Technologies. If you so choose, you may block or delete our cookies from your browser; however, blocking or deleting cookies may cause some of the website, including certain features and general functionality, to work incorrectly. Changing your cookie preferences in one browser will not necessarily carry over to other browsers, so you may need to adjust your preferences each time you get a new device, install a new browser, upgrade an existing browser, or alter or delete a browser’s cookie file. If you have questions regarding the specific information about you that we process or retain, as well as your choices regarding our collection and use practices, please contact us using the information listed below.
Cookies are small pieces of information that are stored on your device’s hard drive by your web browser.
The website uses both cookies that we implement (sometimes referred to as first-party cookies) and cookies implemented by third-party service providers (sometimes referred to as third-party cookies). The types of information collected by a cookie and the purposes for which that information is used will depend on the type of cookie. By way of illustration, the types of cookies used, the types of information collected by those cookies, and the purposes for which that information are used are described below.
For more information about cookies, including about advertising cookies and your choices regarding cookies, we suggest you visit the following websites: https://www.consumer.ftc.gov/articles/0042-online-tracking; http://www.allaboutcookies.org; http://www.youronlinechoices.com; and http://www.youronlinechoices.eu.
The website uses third-party analytics tools (e.g., Google Analytics) to collect and process data about your use of the website. Our analytics providers may set and read cookies to collect this data, and your web browser will automatically send data collected by those cookies to our analytics providers. Our analytics providers use this data to provide us with reports that we will use to improve the website structure and content.
For example, we utilize Google Analytics and other analytical tools offered by Google. For more information on how Google uses this data, visit Google’s page on How Google uses data when you use websites or apps that use Google Services. To prevent this data from being used by Google Analytics, follow the instructions to download and install the Google Analytics Opt-out Browser Add-on for each browser you use. Using the Google Analytics Opt-out Browser Add-on will not prevent us from using other analytics tools and will not prevent data from being sent to the Service itself or to Google.
Managing Cookies / Do Not Sell or Share My Personal Information: You can manage non-essential cookies and similar technologies by clicking the “Your Privacy Rights” link in the footer of our website. Some non-essential cookies and similar technologies may be used for analytics, targeted advertising, or cross-context behavioral advertising, which may be considered a “sale,” “sharing,” or targeted advertising under certain U.S. state privacy laws. You can use the cookie preference center to opt out of those activities. You cannot opt out of strictly necessary cookies because they are required for the website to function and to remember your privacy choices.
Social Features: Certain features of the website allow you to initiate interactions between the website and third-party services or platforms, such as social networks (“Social Features”). Social Features include features that allow you to access our pages on third party platforms, and from there “like” or “share” our content. Use of Social Features allows a third party to collect and/or use information about you. If you use Social Features, information you post or make accessible may be publicly displayed by the third party service. Both we and the third party have access to information about you and your use of both the website and the third-party service. For more information, see the section below, “Third Party Websites and Links”.
Do Not Track & Global Privacy Controls: Your browser settings may allow you to transmit a “do not track” signal, “opt-out preference” signal, or other mechanism for exercising your choice regarding the collection of information about you when you visit various websites. Our website is being updated to recognize the Global Privacy Control (GPC) signal which enables you to opt out of certain uses or disclosures of information about you. If you notify us of your preference through GPC, we will honor your request only for the browser or device that sends the GPC signal. If you do not have an account or are not logged into your account, your request to opt out through the GPC will not apply to any account information. To learn more about Global Privacy Control, you can visit https://globalprivacycontrol.org/.
We disclose information about you to third parties for legitimate purposes subject to this Privacy Policy, including the following categories of third parties:
Where required to comply with applicable law, Critical Start will disclose your personal data to government or law enforcement officials. Additionally, we will disclose your personal information as necessary to enforce applicable terms of service and to ensure the safety and security of our business, employees, and customers.
This section of the Privacy Policy applies to residents of countries or jurisdictions located in the EEA, including, without limitation, the European Union and the United Kingdom.
Legal Bases We Rely on When Processing Personal Information: To the extent the European Union’s General Data Protection Regulation or other similar law applies to you (including, without limitation, those located in the United Kingdom) and is applicable to Company, we process personal data about you for the purposes set forth in this Privacy Policy under the following legal bases (as applicable):
Additional Rights for those in the EEA: To the extent the European Union’s General Data Protection Regulation or other law granting particular rights to data subjects applies to you (including, without limitation, those located in the United Kingdom) and subject to all applicable exceptions and exemptions granted under such applicable laws, you may have the following rights with regard to our processing of personal data about you:
We do not use personal data about you in furtherance of automated profiling decisions that produce a legal or similarly significant effect.
Please see the “Exercise Your Rights” section below for information about how to make a request.
International Transfers of Personal Information: Due to the fact that Critical Start and its service providers may operate systems, personnel, and facilities in different locations, personal data about you and other information will be transferred to, stored in, and processed in countries outside of the jurisdiction from which you access the website, including the United States. By accessing, receiving, or using the website, Products and Services, or by providing consent to us (where consent is required by applicable law), you specifically acknowledge and agree that information may be transferred outside of the country from which you access the website (including, for example, to the United States) and that such countries’ data protection and related laws, regulations, and rules may be different than, and may not be as protective as, those of the jurisdiction from where you access the website. Your use of or access to the website constitutes your consent to such transfers, to the extent permitted by applicable law. Where required by applicable law, we will take steps designed to ensure that personal data transferred internationally is protected in accordance with applicable legal requirements.
Additionally, where required by applicable law, we have ensured that personal data about you included in such transfers is adequately protected through the use of contractual clauses or other adequate measures allowed or required under such applicable laws for example, by signing relevant EU standard contractual clauses as approved by the European Commission (the form for these clauses can be found here). Subject to applicable law, you have the right to obtain details about the mechanism under which personal data about you is transferred cross-border. For more information about these transfer mechanisms, please contact us as set out in the “Contacting Us” section below.
We will retain your personal data as needed to fulfill the purposes for which it was collected. We will retain and use your personal data as necessary to comply with our business requirements, legal obligations and resolve disputes. When providing the Products and Services, Critical Start retains personal data for as long as our customer’s account is active and a short period thereof, as necessary to provide the Products and Services, as permitted in our agreement with customers, to resolve any billing disputes, as needed for compliance audits and assessments, or as required or permitted under applicable law.
We deidentify information about you such that it cannot reasonably be used to infer information about you or otherwise be linked to you (or we collect information that has already been deidentified), and we use such deidentified information for any purpose. To the extent we possess or process any deidentified information, we will maintain and use such information in deidentified form and not attempt to re-identify the information, except solely for the purpose of determining whether our deidentification process satisfies legal requirements. We will retain aggregated anonymized or de-identified data for longer periods of time, in accordance with applicable law and any applicable Customer agreement.
Shine the Light: California Civil Code Section 1798.83 permits California residents to request a notice from us describing which categories of personal information we have shared with third parties or corporate affiliates for those third parties or corporate affiliates’ direct marketing purposes within the last calendar year, and the name and address of such parties. If you are a California resident and would like a copy of this notice, please send an email to privacy@criticalstart.com with “California Privacy Rights Request” in the subject line.
Processing of Personal Information Subject to the CCPA: The California Consumer Protection Act (CCPA) provides consumers who are California residents with specific rights regarding the processing of their personal information. Critical Start’s privacy policy aligns with the requirements of the CCPA. If you are a California resident, we are required to provide additional information to you about how we use and disclose your personal data, and you may have additional rights regarding how we use your personal data. In the preceding 12 months, we (i) collected the following categories of personal information about residents for the following purposes, and (ii) (where indicated below) disclosed for a business or commercial purpose (as identified below) to third parties the following categories of personal information:
| Category | Categories of Purposes (defined in the “Use of Information” section above) | Categories of Recipients (defined in the “Disclosures of Personal Data” section above) |
|---|---|---|
Identifiers such as Name, e-mail address, IP address |
|
|
Commercial information such as records of products or services purchased | ||
Internet or other similar network activity such as information regarding your interactions with us | ||
Approximate geolocation data such as IP address | ||
Audio, electronic, visual, thermal, olfactory, or similar information such as photographs, video recordings and voice recordings | ||
Professional or employment-related information such as title of profession, employer, business contact information | ||
Inferences drawn from other personal information |
The criteria we use to determine how long to retain personal data about you is described in the section above, “Retention Period”.
Additional Rights Under the CCPA: California law provides residents with certain rights with respect to their personal information. Subject to all applicable limitations, exemptions, or exceptions of these rights, you may have the right to:
We do not use personal information about you in furtherance of automated profiling decisions that produce a legal or similarly significant effect.
We do not discriminate against users for exercising the rights granted to them under applicable law and that are applicable to our processing of personal information.
To exercise these rights, please see the “Exercise Your Rights” section below.
Selling and/or Sharing of Personal Information:
We do not sell your personal information as the concept of “selling” is traditionally understood as being the exchange of something for money. However, we share your personal information with third parties for the purpose of cross-contextual behavioral advertising purposes (e.g., targeted advertising). U.S. state data protection laws hold such disclosures and sharing to be considered “selling” or “sharing”. Therefore, you have the right to opt out of such activities. In the preceding 12 months, we have sold or shared the following categories of personal information with the following categories of third parties and for the following purposes:
| Category of Personal Information | Categories of Purposes | Categories of Recipients |
|---|---|---|
Identifiers | Analytical and targeted advertising purposes (including, without limitation, cross-contextual behavioral advertising). | Analytics, marketing, advertising, and remarketing partners and service providers |
Internet or other electronic network activity information |
You may have the right to opt out of the selling and targeted advertising as described herein. You may exercise this right to opt out by utilizing the Global Privacy Control as mentioned in the “Do Not Track & Global Privacy Controls” section above, or by clicking the “Your Privacy RIghts” option in the footer of the website and changing your Cookie Settings as described on that webpage. If you have any questions, concerns, or would like more information on our ability to opt out, you can contact us by emailing: privacy@criticalstart.com.
We do not have actual knowledge that we “sell” or “share” (as those terms are defined under the CCPA and used throughout this section) personal information of residents under 16 years of age.
Where India’s Digital Personal Data Protection Act, 2023 applies, we process personal data for lawful purposes based on the following grounds, as applicable:
| Lawful basis under DPDP Act | Statutory support | Types of personal data | Use/purpose |
|---|---|---|---|
Voluntary provision for specified purpose | Section 7(a) — processing is permitted for the specified purpose for which the Data Principal voluntarily provided personal data, unless she has indicated she does not consent. | Contact information; business contact information; account information; commercial information; and other information you choose to provide through the website, web portal, forms, communications, account registration, purchases, or support requests. | To respond to inquiries, provide requested information, process purchases or requests, administer accounts, provide customer support, and provide or facilitate the website, Products, and Services requested by you. |
Operation, security, and protection of the website, Products, and Services | Section 7(a), where the processing is tied to the specified interaction or service requested; and Section 7(i), where applicable in an employment/safeguarding context. | Device information, IP address, usage data, log data, account/access information, security information, and related technical data. | To provide, operate, secure, maintain, troubleshoot, and protect the website, Products, and Services; prevent misuse, fraud, unauthorized access, or security incidents; and protect Critical Start’s rights, property, systems, users, customers, and personnel. |
Legal compliance / legal process | Section 7(d) permits processing to fulfill obligations to disclose information to the State or its instrumentalities; Section 7(e) permits processing for compliance with judgments, decrees, or orders. | Contact information, account information, transaction records, security records, communications, and other information required for legal, regulatory, audit, dispute, or compliance purposes. | To comply with applicable law, regulatory requirements, governmental or law enforcement requests, subpoenas, court orders, judgments, decrees, legal claims, audits, investigations, or similar legal processes. |
Consent for optional or non-necessary processing | Section 6 — consent must be free, specific, informed, unconditional, unambiguous, given by clear affirmative action, and limited to personal data necessary for the specified purpose; withdrawal must be available with comparable ease. | Usage data, cookie identifiers, device information, interaction data, marketing information, inferences, enrichment data, email engagement data, social/embedded media interaction data, and identifiable data used for broader analytics, research, or product-development purposes. | To process personal data for purposes not necessary for the requested interaction or service, including optional analytics, personalization, optional marketing communications, targeted advertising, retargeting, enrichment, email tracking, non-essential cookies or similar technologies, third-party social or embedded media features, and broader service-improvement, research, or product-development activities using identifiable personal data. |
Where we rely on consent, you may withdraw consent at any time through the applicable consent mechanism, including our cookie settings, preference center, account settings, unsubscribe links, or by contacting us at privacy@criticalstart.com, subject to applicable law and any processing that is required or permitted without consent.
Individuals in India may have the right to access information about their personal data; request correction, completion, updating, or erasure; submit grievances; and nominate another individual to exercise their rights in the event of death or incapacity. To exercise these rights, withdraw consent, or submit a grievance, please use the methods described in the “Exercising Your Rights” and “Contacting Us” sections below. You may also have the right to complain to the Data Protection Board of India after first exhausting our grievance redressal process.
Where required, we will make notices and consent requests available in English or any language specified in the Eighth Schedule to the Constitution of India. Our website, Products, and Services are not intended for children under 18 in India, and we do not knowingly process personal data of children in India without verifiable parental consent where required.
Where we process personal data on behalf of customers in connection with the Products and Services, including customer security logs, alerts, metadata, and other customer environment data, that processing is governed by the applicable customer agreement, including any applicable data processing agreement. In that context, customers generally determine the purposes and means of processing and are responsible for providing any notices and obtaining any consents required under applicable law.
If you are located in Canada, we collect, use, and disclose personal information as described in this Privacy Policy and in accordance with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act, where applicable. You may contact us using the information in the “Contacting Us” section below to request access to or correction of personal information about you, ask questions about our privacy practices, or submit a privacy complaint. We may transfer personal information to service providers or affiliates outside Canada, including in the United States, where it may be processed, stored, or accessed and may be subject to the laws of those jurisdictions.
If this Privacy Policy expressly stated above that you have certain rights, or applicable law grants you certain rights as it relates to the information we collect about you, you may exercise any of these rights by contacting us using the information provided below. You may submit a request to us by:
Emailing: privacy@criticalstart.com
Visiting: Critical Start Privacy Request Form
Calling: 877-684-2077 and selecting Option 4
Or by following the opt out methods and processes identified above. For clarity, to exercise your rights to opt-out of targeted advertising, or the “selling” or “sharing” of personal information about you, you must follow the instructions provided under the Your Privacy Rights section noted above.
Additionally, you may have the right to appeal our decision regarding a request related to these rights by contacting us using the information provided below. If the appeal is denied, you may submit a complaint to the applicable government regulator or authority in the jurisdiction in which you are located (for example, the state Attorney General in the state in which you reside).
When you submit a request or an appeal, we will limit our collection of information about you to only what is necessary to securely fulfil your request or process your appeal. Making a request or appeal does not require you to create an account with us.
To verify certain requests — for example, requests to know, delete, or correct — we may need to collect additional information to verify your identity and the request before providing a substantive response to the request.
Some jurisdictions, depending on your location, permit you to authorize an agent to make requests on your behalf to exercise your rights. If you have a registered agent to act on your behalf, we have the right to authenticate such agent’s authority to act.
Our website and our Products and Services are not intended for children under 13 years of age. No one under age 13 may provide any information to or on our websites or our Products and Services. We do not knowingly collect personal information from children under 13. If you are under 13, do not use or provide any information on our websites, or our Products and Services, or on or through any of the features, including registration features, use any of the interactive or public comment features of the website or provide any information about yourself to us, including your name, address, telephone number, e-mail address or any screen name or username you may use. If we learn we have collected or received personal information from a child under 13 without verification of parental consent, we will take reasonable measures to promptly delete that information. If you believe we might have any information from or about a child under 13, please contact us at privacy@criticalstart.com.
Critical Start uses reasonable efforts designed to maintain the accuracy and integrity of personal data and to update it as appropriate. Information you provide to us should be relevant to the purposes for which it is to be used, and, to the extent necessary for those purposes, should be accurate, complete, and up to date.
Critical Start has implemented physical and technical safeguards designed to protect personal data from loss, misuse, and unauthorized access, disclosure, alternation, or destruction. Despite these precautions, no data security safeguards guarantee 100% security all the time.
We provide links to third party websites or platforms. If you follow links to sites or platforms that we do not control and are not affiliated with us, you should review the applicable privacy notice, policies and other terms. We are not responsible for the privacy or security of, or information found on, these sites or platforms. Information you provide on public or semi-public venues, such as third-party social networking platforms, may also be viewable by other users and/or users of those third-party platforms without limitation as to its use. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owner or operators.
We also use YouTube to make content in video format available to you. By accessing a part of the website where videos are available, watching an embedded video, or otherwise interacting with any content made available through YouTube, you signify your agreement with YouTube’s terms and conditions. YouTube collects and otherwise has access to usage data (e.g., what videos you accessed and watched) through videos embedded in the website as further described in YouTube’s Privacy Notice. YouTube adheres to Google's privacy policies and principles, part of which allows you to control certain privacy settings and which data are collected.
The Data Privacy Officer shall review and approve any material changes to this program as necessary. Any questions, concerns, or comments regarding this Privacy Policy may also be directed to our DPO at privacy@criticalstart.com.
Critical Start will maintain, monitor, test, and upgrade information security policies, practices, and systems to assist in protecting the personal data that it collects.
This Privacy Policy may be amended from time to time. If we make material changes in how we use personal information, we will provide notification by email, by means of a notice on this website, or other reasonable means. We encourage Customers and users to periodically review this page for the latest information on our privacy practices.
If you have any questions about this Privacy Policy or our privacy practices, please contact us at:
Critical Start, Inc.
6100 Tennyson Parkway, Suite 200
Plano, TX 75024
