Privacy Policy
Effective date: November 11, 2026
[Company legal name], [registered address], [country] ("HawkDetect", "we", "us") operates the HawkDetect service and the website hawkdetect.com. This policy explains what data we process, why, and your rights. Questions: privacy@hawkdetect.com.
1. Our role
When a company ("Customer") connects its Google Workspace to HawkDetect, the Customer is the controller of its users' email and calendar data and HawkDetect acts as a processor, processing that data only to provide the service on the Customer's instructions. For account data of Customer administrators and visitors of our website, HawkDetect is the controller.
2. Data we process
| Category | Examples | Purpose |
|---|---|---|
| Account data | Name, company, work email, hashed password | Create and secure your account |
| Workspace directory data | Names and email addresses of users in your domain | Let your admin choose which mailboxes to protect |
| Email and calendar content | Headers, sender, subject, body text, links, attachment names, calendar invite details | Analyze new messages and invites for phishing and other threats |
| Verdict records | Subject, sender, date, verdict, explanation, analyzed links | Audit log in your dashboard |
| Technical data | IP address, browser type, session cookie | Security, preventing abuse, keeping you signed in |
Email and calendar content is analyzed automatically. HawkDetect does not use it for advertising, does not sell it, and does not use it to train AI models.
3. Google user data
HawkDetect accesses Google Workspace data through Google APIs with permissions granted by your Workspace administrator (Gmail: read and move messages to Trash; Calendar: read and remove events; Directory: read the user list). HawkDetect's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the user-facing threat-protection features of HawkDetect.
4. How threat analysis works
Messages are analyzed by HawkDetect AI running on infrastructure operated by HawkDetect. To check suspicious links, links may be opened in an isolated sandbox environment operated by HawkDetect. To check reputation, we may send:
- web addresses (URLs) found in messages to Google Safe Browsing;
- domain names (not message content) to public domain registration (RDAP) services to determine the age of a domain.
5. Retention
- Verdict records are kept for 180 days and then deleted automatically.
- Sandbox results and reputation lookups are cached for up to 8 days.
- Full message content is processed in memory for analysis and is not stored as a copy of your mailbox.
- Account data is kept while your account is active and deleted within 30 days after you close it, unless the law requires longer retention.
6. Sub-processors
| Provider | Purpose |
|---|---|
| DigitalOcean, LLC | Website hosting and network infrastructure |
| Tailscale Inc. | Encrypted network connectivity between our servers |
| Google LLC | Google Workspace APIs; Safe Browsing URL checks |
| Public RDAP registries | Domain registration date lookups (domain names only) |
7. Security
We protect data with encryption in transit (TLS), access control on the principle of least privilege, hashed passwords, and audit logging. Our processes follow ISO/IEC 27001 (information security) and ISO 9001 (quality management).
8. International transfers
Where personal data is transferred outside the European Economic Area, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
9. Your rights
Depending on your location (including under the GDPR), you may have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. If your data is processed on behalf of your employer, please contact your company's administrator first; we will assist them. You can also lodge a complaint with your local data protection authority. Contact: privacy@hawkdetect.com.
10. Cookies
We use only a strictly necessary session cookie to keep administrators signed in. We do not use advertising or tracking cookies.
11. Disconnecting
Your Workspace administrator can revoke HawkDetect's access at any time in the Google Admin console (Security → API controls → Domain-wide delegation). After access is revoked, no new data is processed.
12. Changes
We may update this policy. We will post the new version on this page and, for material changes, notify Customers by email.