This Privacy Policy describes how NorthShield ("NorthShield", "we", "us", or "our") handles information in connection with our websites, customer panel, APIs, onboarding workflows, and DDoS mitigation, remote protection, game protection, and on-premise software services (collectively, the "Services").

By accessing or using the Services, you acknowledge that you have read this Privacy Policy. If you do not agree, you must discontinue use of the Services.

NorthShield acts as a service provider to business customers. In most cases, our customers remain responsible for determining the lawful basis for processing end-user data that transits through protected infrastructure.

Where we process personal data on behalf of a customer, we do so according to our agreement with that customer and only as necessary to deliver, secure, monitor, and support the Services.

We collect information necessary to operate a security and network protection platform. The categories below are illustrative and may vary by service tier and deployment model.

• Account and contact details such as name, business email, company, billing contacts, and authentication credentials.
• Service configuration data including IP prefixes, ASNs, domains, ports, protocols, tunnel parameters, BGP announcements, and mitigation policies.
• Traffic and security telemetry including packet metadata, flow records, attack signatures, mitigation actions, request headers, geolocation indicators, and volumetric statistics.
• Operational logs from our panel, APIs, scrubbing edge, support systems, and audit trails.
• Device and session data such as browser type, operating system, IP address, and session identifiers for panel access.
• Communications you send to us including sales inquiries, support tickets, incident reports, and call recordings where permitted by law.
• Billing and payment-related records processed through our payment providers.

We use collected information for legitimate business and security purposes, including:

• Providing, maintaining, and improving the Services.
• Detecting, filtering, mitigating, and investigating attacks and abusive traffic.
• Authenticating users, managing sessions, and preventing fraud or unauthorized access.
• Operating customer dashboards, alerting, reporting, and SLA measurement.
• Providing technical support, onboarding, and incident response.
• Billing, account administration, and contract management.
• Complying with law, enforcing our Terms of Service, and protecting our rights.
• Developing new features, capacity planning, and service quality analysis using aggregated or de-identified data where feasible.

Because NorthShield provides attack mitigation and network protection, we must inspect traffic metadata and, where configured, application-layer data to identify malicious behavior. You authorize us to process such data for filtering, rate limiting, blocking, alerting, forensic review, and service optimization.

You are responsible for ensuring that your use of the Services, and any data you route through our network, complies with applicable privacy laws and that you have provided any required notices or obtained any required consents from your users.

We do not sell personal information. We may disclose information in the following circumstances:

• To subprocessors and infrastructure providers that help us host, route, monitor, or support the Services, subject to contractual confidentiality and security obligations.
• To professional advisers, auditors, insurers, or potential acquirers under appropriate confidentiality terms.
• When required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect rights, safety, security, or the integrity of the Services.
• In connection with a merger, acquisition, financing, reorganization, or sale of assets, provided the recipient agrees to handle information consistent with this Policy or you are given notice where required by law.

We retain information for as long as reasonably necessary to provide the Services, meet contractual and billing obligations, resolve disputes, enforce agreements, maintain security records, and comply with legal requirements.

Security logs, attack records, and audit trails may be retained for extended periods where needed for incident investigation, trend analysis, fraud prevention, or legal defense. When retention is no longer required, we delete or de-identify information using commercially reasonable methods.

NorthShield operates a globally distributed network. Information may be processed in countries other than your own. Where required, we implement appropriate safeguards for cross-border transfers consistent with applicable law.

Depending on your location, you may have rights to access, correct, delete, restrict, or object to certain processing of personal information, or to receive a portable copy of information you provided.

Requests may be submitted through your account representative or our contact channels. We may need to verify your identity and we may decline requests that are manifestly unfounded, repetitive, would compromise the security of others, or are prohibited by law.

Where we process data on behalf of a customer, we may direct you to that customer when appropriate.

We use cookies, local storage, and similar technologies to operate the website and panel, remember preferences such as theme selection, maintain authenticated sessions, and understand usage patterns.

You can control cookies through browser settings, but disabling certain cookies may impair login, security, or core functionality.

We implement administrative, technical, and organizational measures designed to protect information against unauthorized access, loss, misuse, or alteration.

No method of transmission or storage is completely secure. You acknowledge that inherent risks remain and that we do not guarantee absolute security. You are responsible for safeguarding your credentials, API keys, and internal systems connected to the Services.

The Services are intended for business and professional use. We do not knowingly collect personal information from children under 16. If you believe we have received such information, contact us so we can take appropriate action.

We may update this Privacy Policy at any time. Material changes will be posted on this page with a revised effective date. Continued use of the Services after changes become effective constitutes acceptance of the updated Policy.

Questions about this Privacy Policy or our data practices may be directed to your account manager or through the contact options on our website.