Privacy Policy
How SenseOn handles personal data across our website, commercial process, and platform services.
Who we are
SenseOn Tech Ltd ("SenseOn", "we", "us", "our") is registered in England and Wales under company number 11032394, with its registered office at 8 St. James's Square, London, SW1Y 4JU. We are the controller for the personal data we collect through this website, our sales and marketing activity, and our own business operations.
For customer security data processed in the SenseOn platform, SenseOn usually acts as a processor on behalf of the customer. Those processing terms are governed by the customer agreement and our Data Processing Agreement.
What this policy covers
This policy covers visitors to senseon.io, prospects, event contacts, suppliers, customers, authorised platform users, support contacts, and security researchers. Customer contracts may contain additional privacy and security terms for the SenseOn platform.
Personal data we collect
- Business contact details such as name, role, company, email address, phone number, and country.
- Enquiry, demo, event, support, and commercial communications you send to us.
- Account and administrator details for customers, trial users, and authorised platform users.
- Website and device data such as IP address, browser, pages visited, referral source, consent choices, and basic security logs.
- Customer service data, including support tickets, audit events, usage records, and security telemetry when a customer uses the SenseOn platform or asks us to support it.
- Security and AI feature records, including investigation context, detections, prompts, responses, agent actions, approvals, and audit trails where those features are used.
We may receive data directly from you, from your employer or customer organisation, from our partners, from marketplace and procurement routes, from public business sources, and from the systems used to operate and protect our services.
How we use personal data
We only use personal data where we have a lawful basis, a customer instruction, or another permitted reason under applicable privacy law.
With your analytics consent, we link campaign source information to your sign-up and purchase records.
| Purpose | Legal basis or role |
|---|---|
| Operate the website, respond to requests, arrange demos, manage trials, and administer customer accounts. | Contract, steps before a contract, and our legitimate interest in running a secure B2B service. |
| Deliver, secure, monitor, support, and improve the SenseOn platform. | Contract, legal obligations, and legitimate interests in service quality, security, fraud prevention, and customer support. |
| Process customer security telemetry, support cases, and investigation data where customers use the platform. | Usually as processor under the customer agreement and Data Processing Agreement. Where we act as controller, we rely on contract, legitimate interests, or legal obligation as applicable. |
| Use AI and automation to detect, investigate, report, and respond to security events under customer governance. | Contract and legitimate interests. Customer telemetry is not used to train public foundation models unless we agree that separately in writing. |
| Send service messages, security notices, and requested information. | Contract and legitimate interests. |
| Send marketing communications to business contacts and measure campaign performance. | Consent where required, the soft opt-in where available, and legitimate interests for B2B relationship management. You can opt out at any time. |
| Measure aggregated page views with Vercel Analytics. This measurement is cookieless. | Legitimate interests. |
| Count funnel steps (page views and daily unique visitors). Unique visitors are counted with a hash of IP address and user agent mixed with a random value (a salt) that we replace every day. We delete the hashes within three days and keep only the daily totals. | Legitimate interests. |
| Run Google Analytics, consent-based PostHog analytics and advertising technologies. | Consent. |
| Meet legal, regulatory, accounting, insurance, audit, and dispute-resolution requirements. | Legal obligation and legitimate interests. |
Cookies and similar technologies
We use strictly necessary cookies to operate the website and protect forms. We use Google Analytics and advertising cookies only after the relevant consent. Persistent attribution follows your cookie preferences. You can manage your choices through our Cookie Policy and the Cookie Settings link in the footer.
Some website measurement does not use cookies. We use Vercel Analytics for cookieless, aggregated page-view measurement. The lawful basis is legitimate interests.
We count funnel steps (page views and daily unique visitors). To count unique visitors, we hash the IP address and user agent together with a random value (a salt) that we replace every day. We delete these hashes within three days and keep only the daily totals. The lawful basis is legitimate interests.
UK statistics mode
For visitors located in the UK, PostHog anonymous statistics help us improve the site unless you turn them off. The cookie lasts up to 90 days. This mode has no person profiles, identification or replay.
The legal basis is PECR Schedule A1 paragraph 5 and UK GDPR legitimate interests. Use the one-click Turn off control next to Analytics: on in the banner, or reopen Cookie Settings at any time.
EU and other visitors, including visitors whose location is unknown, are asked for consent before PostHog analytics cookies are used.
PostHog cookieless counting is used after an explicit refusal in consent mode. PostHog counts these visits without a cookie, using a server-side hash. It sets no browser storage. It does not create person profiles, identify you or record replay. The lawful basis is legitimate interests.
Optional linking of your visits
If you tick the optional box when you submit a form or sign in, we use your consent to link this browser's PostHog identifier to a keyed hash of your email, not your email. The site sets the PostHog cookie to expire after 90 days. We do not send your name or company to PostHog.
You can withdraw this consent through Cookie Settings.
AI and security data
SenseOn uses analytics, automation, and AI-assisted workflows to detect, investigate, report, and respond to security events. Customer telemetry, prompts, responses, and investigation records are handled under customer instructions, access controls, audit trails, and security obligations.
We do not sell personal data. We do not use customer security telemetry to train public foundation models unless a customer agrees that separately in writing.
For customers who connect Microsoft Entra, AI-use records, including user names, are kept for 90 days to produce the weekly Insight report.
Sharing personal data
We share personal data only where needed for the purposes described in this policy.
- Hosting, cloud infrastructure, security monitoring, logging, content delivery, and backup providers.
- Customer relationship, support, email, calendar, marketing, analytics, and event-management providers.
- Identity, authentication, payments, procurement, e-signature, and professional services providers.
- AI, automation, and model-service providers where they are needed to deliver contracted platform features or support, subject to contract controls.
- Group companies, advisers, auditors, insurers, regulators, law enforcement, courts, and other parties where required or permitted by law.
Where a third party processes personal data for us, we use contractual controls covering confidentiality, security, purpose limitation, and return or deletion of data.
International transfers
SenseOn serves customers globally. Where personal data is transferred from the UK, EEA, or Switzerland to another country, we use adequacy decisions, the UK International Data Transfer Addendum, standard contractual clauses, or another lawful transfer mechanism, together with risk-based transfer assessments where required.
Retention and security
SenseOn's retention policy is 90 days for anonymous analytics events and 2 years after last contact for identified records.
We keep personal data only for as long as needed for the purpose collected, the customer contract, legal retention periods, security requirements, or dispute handling. Enquiry and prospect records are normally reviewed after 24 months of inactivity. Customer platform data is retained under the customer agreement and configured service terms.
For the website unique-visitor count, we delete the visitor hashes within three days and keep only the daily totals. We replace the salt for that count every day.
For customers who connect Microsoft Entra, AI-use records, including user names, are kept for 90 days to produce the weekly Insight report.
We use technical and organisational measures designed to protect personal data, including access controls, logging, encryption, vulnerability management, and supplier review. No internet service can be guaranteed to be completely secure.
Your rights
Depending on where you are, you may have rights to access, correct, delete, restrict, object to, or receive a copy of your personal data. You may also withdraw consent, opt out of marketing, or object to certain automated or targeted advertising uses.
To exercise your rights, contact privacy@senseon.io. If your request concerns customer-controlled platform data, we may direct the request to the relevant customer.
You can complain to the UK Information Commissioner's Office at ico.org.uk or to your local data protection authority.
Children, changes, and contact
Our website and services are intended for business users and are not directed to children. We do not knowingly collect personal data from children.
We may update this policy as our services, legal obligations, or processing practices change. Material changes will be posted on this page.
Questions about this policy should be sent to privacy@senseon.io.
Notice version: 2026-10-02
Last updated: 2 October 2026