Privacy Policy

This Privacy Policy (“Policy”) applies to personal data processed through securityring.ai, the SecurityRing administrative application, APIs, email delivery workflows, tracking and landing domains, security-awareness simulations, training pages, reports, support, and related services (collectively, the “Service”). It does not apply to a Customer’s own systems or to a third-party website or service governed by its own privacy notice.

“SecurityRing,” “we,” “us,” or “our” means 9DSEMBER SOFTWARE PRIVATE LIMITED, a private limited company incorporated in India that operates the SecurityRing service. “Customer” means the organization using the Service. “Recipient” means a person included in a Customer-authorized simulation, assessment, notification, or training experience. An applicable customer Order Form may include additional contracting details.

If you are a Recipient or Customer employee, your organization is normally the best first contact for questions about why a simulation was conducted or how results are used. We will assist the Customer with applicable privacy requests.

You can play Real or Fake without providing your name or email. We store an anonymous challenge session, answers and score for up to 24 hours so you can complete the game. A temporary session token is stored in your browser tab. We use short-lived request counters to limit abuse.

When you choose to share, we ask for your name, email and agreement to store them for this challenge. Contact details are stored separately from the public result, are scheduled for deletion after 90 days, and are not added to a marketing subscription. This version does not send emails or issue certificates. Backups may retain deleted records for up to 14 additional days.

A public result contains your score and challenge edition. Your name appears only if you choose to show it. Your email is never included in the result page, share URL or score image. Shared result links expire after 30 days. If you share to a social platform, that platform applies its own privacy policy and may keep a copy of your post or image after the result link expires.

Public challenge data is separate from customer workforce records and does not affect an employee risk score. For access or deletion requests, use the privacy contact listed at the end of this policy.

We obtain personal data from the following sources:

• Customers and administrators: through account setup, roster import, direct entry, integrations, campaign configuration, content upload, support, and Order Forms.
• Recipients: through their browser or email client when a message is delivered, opened, clicked, reported, or used to interact with a Customer-authorized training experience.
• Identity and email providers: such as authentication profile, delivery, bounce, complaint, sender, mailbox, and domain-status information.
• Service providers: such as hosting, security, content-generation, media, brand, scheduling, or support providers used for the requested function.
• Automatic collection: from website, application, API, tracking, and training-page requests and from essential cookies or similar security mechanisms.
• Public or Customer-approved sources: for threat intelligence, security news, brand information, and campaign recommendations. We do not use public sources to build Recipient mailing lists.

Recipient contact lists come from the relevant Customer’s internal workforce or directory records. SecurityRing does not purchase, rent, scrape, or combine public lists for simulation delivery.

Where processing is based on legitimate interests, we consider necessity, proportionality, reasonable expectations, and the rights of affected people. Where consent is the basis, consent may be withdrawn for future processing. SecurityRing does not determine the Customer’s employment-law basis for conducting a simulation.

We may create aggregated or de-identified statistics that are not reasonably linkable to a person or Customer and use them to operate, secure, and improve the Service. We do not attempt to re-identify such data except to test whether de-identification remains effective, as permitted by law.

Customer-authorized simulation emails may contain a unique pseudonymous link and a small image used to measure delivery and opening. When an email client or security scanner loads the image or link, we may record the associated campaign and Recipient token, time, IP address, user agent, requested host, and whether the request appears to come from an automated scanner. A tracking token is not intended to reveal the Recipient’s identity in the URL; the mapping is held server-side.

Training pages may record clicks, form-submission attempts, phishing reports, quiz responses, video progress, and supported attachment, QR, OAuth-consent, device-code, or synthetic-media events. These signals allow the Customer to evaluate the exercise, distinguish likely automated activity, provide training, and produce reports. Open and click detection is not perfectly accurate because email clients, privacy features, proxies, and security scanners may block or trigger resources automatically.

SecurityRing currently uses essential technology needed to authenticate, secure, and operate the Service:

These mechanisms are required for requested authentication, security, and Customer-authorized simulation functionality. The SecurityRing marketing site does not currently use advertising cookies. It may load fonts or other basic assets from service providers, which receive standard request information such as IP address and user agent. Following a link to an external scheduling service or other third-party site is governed by that provider’s privacy notice.

Browser “Do Not Track” signals are not governed by a common standard. Because we do not sell personal data or use it for cross-context behavioral advertising, a Global Privacy Control signal does not change those practices; we will honor such signals where legally required.

We disclose personal data only as reasonably necessary for the purposes above, including to:

• the relevant Customer and its Authorized Users, who can access workforce records, campaign status, interaction results, and reports according to their permissions;
• cloud and infrastructure providers, including hosting, compute, database, storage, content delivery, monitoring, and security services such as Amazon Web Services;
• identity and collaboration providers, such as Google for OAuth authentication and Customer-configured Google Workspace delivery;
• email and messaging providers, depending on configuration, such as Amazon SES, Mailgun, Mailchimp Transactional, Zapmail, Gmail API, or Customer-configured SMTP services;
• AI, media, and content providers, depending on the feature and configuration, which may include OpenRouter, Anthropic, OpenAI, Google Gemini, Amazon Polly, HeyGen, Context.dev, and rendering services;
• domain, DNS, registrar, certificate, and mailbox providers, such as Hostinger, Zapmail, Mailgun, AWS, or a Customer-selected provider when domain workflows are requested;
• professional advisers and business-service providers, such as auditors, counsel, insurers, payment, accounting, sales, support, and scheduling providers;
• authorities or affected parties, where we reasonably believe disclosure is required by law or necessary to protect rights, safety, security, or prevent abuse; and
• a successor or transaction participant, in a merger, financing, reorganization, insolvency, or sale, subject to appropriate confidentiality and applicable law.

The exact providers used may depend on Customer deployment, sender route, AI model, media feature, region, and Order Form. Service providers are authorized to process personal data only for contracted services or as required by law. A Customer may request current subprocessor information through its SecurityRing contact.

SecurityRing does not sell personal data for money or other valuable consideration and does not share personal data for cross-context behavioral advertising, as those terms are defined under California law. We do not use Customer workforce or Recipient interaction data for third-party advertising, data-broker activity, or unrelated marketing. We do not knowingly sell or share personal data of people under 16.

We disclose data to service providers and contractors for business purposes described in this Policy. Those operational disclosures are not a sale or targeted-advertising share when processed under applicable legal restrictions.

SecurityRing operates from India and uses providers that may process data in India, the United States, and other countries. A Customer’s Order Form or deployment may specify a primary hosting region, but support, delivery, security, domain, AI, or media providers may operate elsewhere. The laws of those countries may differ from the laws where you live.

Where required, we use contractual and organizational safeguards for cross-border transfers, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, data-processing agreements, transfer risk assessments, or another lawful transfer mechanism. Customers may contact us for information about safeguards relevant to their deployment.

We retain personal data only as long as reasonably necessary for the purposes described, Customer instructions, security, dispute resolution, and legal obligations. Default or typical periods are below; an Order Form or DPA may specify different periods.

When a Customer relationship ends, SecurityRing will delete or return Customer personal data as required by the agreement and DPA. Data may remain temporarily in protected backups until overwritten through normal cycles and may be retained where required by law, to resolve disputes, enforce agreements, preserve security evidence, or prevent abuse. Retained data remains protected and is not used for unrelated purposes.

SecurityRing uses administrative, technical, and organizational safeguards designed for the nature and risk of the data processed. Measures include encrypted transport, encryption at rest for primary cloud data stores, role- and workspace-based access controls, tenant partitioning, short-lived access tokens, HttpOnly session cookies, secrets management, least-privilege cloud permissions, logging, rate limits, suppression controls, security headers, and backup and incident-response processes.

No security measure guarantees absolute protection. Customers are responsible for their identity-provider policies, Authorized Users, integrations, devices, sender infrastructure, campaign configuration, and exported copies of reports or data. Please report a suspected vulnerability or misuse to abuse@securityring.ai without publicly disclosing sensitive details.

If we confirm a personal-data incident, we will investigate, mitigate, and notify affected Customers or authorities as required by applicable law and the relevant DPA.

Depending on your location and the law that applies, you may have rights to request access to or information about personal data; obtain a copy; correct inaccurate data; request deletion; restrict or object to processing; obtain portability; withdraw consent; opt out of certain processing; appeal a denied request; nominate another person where applicable; and complain to a data-protection authority or board. You also may have a right not to be discriminated or retaliated against for exercising privacy rights.

This section applies if the California Consumer Privacy Act, as amended (“CCPA”), applies to SecurityRing’s processing as a business. For data processed solely for a Customer, SecurityRing acts as that Customer’s service provider or contractor and the Customer is responsible for responding to applicable requests.

In the preceding 12 months, we have collected the categories below. We use them for the business purposes in Sections 4–7 and disclose them to the corresponding categories of recipients described in Section 7.

Sources are described in Section 3. Retention is described in Section 10. We have not sold or shared these categories for cross-context behavioral advertising in the preceding 12 months. We use sensitive personal information only for permitted purposes such as authentication, security, and providing the requested Service, not to infer characteristics for unrelated purposes.

California residents may request to know, access, correct, or delete personal information and may use an authorized agent, subject to verification and legal exceptions. Because we do not sell or share personal information for cross-context behavioral advertising, there is no need to opt out of those practices. We will not discriminate or retaliate for exercising CCPA rights. Submit requests as described in Section 12.

The Service automates message delivery, event classification, cohorting, metrics, content generation, and recommendations. It may show risk indicators or suggested next steps based on campaign configuration and observed interactions. These outputs support human-led security training and program decisions.

SecurityRing does not intend the Service to make solely automated decisions that produce legal or similarly significant employment effects. Customers are required to review outputs, account for scanner and measurement error, use results proportionately, and not use a score or interaction as the sole basis for termination, discipline, compensation, promotion, hiring, or another significant decision. If a Customer chooses a use beyond this intended scope, it is responsible for additional notices, impact assessments, rights, human review, and legal requirements.

The Service is designed for organizations and adult workforce security programs, not for children or personal consumer use. Administrative users must be at least 18. Customers must not submit data about or target a person under 18 without SecurityRing’s prior written agreement and a documented lawful basis, including any required parent or guardian authorization. If you believe a child’s data was provided improperly, contact us so we can investigate and work with the relevant Customer.