Huntbase privacy policy - how we collect, use, and protect your data.
Version 2026-10-10 · Last updated
Huntbase Ltd ("Huntbase", "we", "us" or "our"), is a cybersecurity threat hunting platform that helps security teams detect, investigate, and respond to threats. Our platform and related services are referred to as the "Services" in this Privacy Policy.
We are committed to protecting and respecting personal data. This Privacy Policy explains how we collect, use, share and protect your personal data when you use our Services, websites or otherwise interact with us.
You can contact us at [email protected].
We act as both a controller and a processor of personal data.
When we act as a Data Controller we determine the purpose and means of processing for personal data we collect directly such as account information, billing data, website usage, and product analytics. For this data, this Privacy Policy applies in full.
When we act as a Data Processor we act on the instructions of our customers who use the Services to ingest, analyse, or act on their own organisational data such as endpoint telemetry and threat intelligence feeds. Our processing of this personal data is governed by our Data Processing Addendum (DPA), which is incorporated into customer agreements, and not this Privacy Policy. For more information about how a customer uses your personal information, or to exercise the rights you may have with respect to that information, please contact that organisation directly.
We collect information about you when you provide it to us, when you use our Services, and from other sources, as further described below.
Information you give us directly: When you create a Huntbase account, purchase a subscription, or contact our support team, we collect the details you provide, which is typically your name, work email address, and billing information. If you authenticate via a third-party provider such as Google, we receive only the profile fields needed to verify your identity (name and email), subject to that provider's own settings and permissions.
Information generated through your use of the platform: As you use the Services, including by running queries, building investigation graphs, uploading telemetry, or configuring integrations, we record interactions with the Services for the purposes of operating and improving the Services. This includes feature usage, search terms entered into the UI, file metadata for any attachments, and diagnostic data such as error logs and crash reports.
Device and network information: We collect standard technical data from the devices you use to access the Services, including your IP address, browser type, operating system, and connection settings. This is used to maintain security, diagnose issues, and enforce our terms.
Cookies and tracking technologies: We use cookies and similar technologies on our website and platform. Please refer to our Cookie Policy for a breakdown of what we use, why, and how to manage your preferences.
Information from third parties: We may receive your contact details from other users (for example, when a team administrator adds you to an account) or from business data providers to support sales and marketing activities.
Information from cloud marketplaces: If you buy Huntbase through a cloud marketplace such as Google Cloud Marketplace, the marketplace sends us your name, email address and the marketplace account and order identifiers for your purchase. We use this only to set up, bill and support your subscription, not for marketing unless you separately opt in. The marketplace operator processes your purchase as an independent controller under its own privacy policy.
We only use your personal data where we have a lawful basis to do so. The table below sets out our processing activities and the legal basis we rely on for each.
| Purpose | Legal Basis |
|---|---|
| Providing, operating, and personalising the Services, including authenticating your account, processing payments, and managing your subscription. | Contractual necessity |
| Communicating with you about the Services, changes to our terms or policies, and responding to your support requests, enquiries or feedback. | Contractual necessity |
| Improving and developing the Services, including use of aggregated or de-identified data to inform product decisions and to train AI and machine learning models that form part of the Services. | Legitimate interests |
| Detecting and preventing fraud, abuse, or security threats, maintaining the integrity of our systems, and protecting our legal rights and those of our customers. | Legitimate interests |
| Marketing and promotional activities directed at existing customers. | Legitimate interests |
| Sending direct marketing to prospective customers, use of non-essential cookies, and publishing customer testimonials or case studies. | Consent |
| Complying with legal obligations, regulatory requirements, or lawful requests from public authorities. | Legal obligation |
We use a limited set of trusted third-party services to operate the Services. Where these services process personal data on our behalf, they are bound by data processing agreements and appropriate transfer safeguards.
| Third Party | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Security of the Services | US / EU |
| HubSpot UK Holdings Limited | CRM and marketing | UK |
| Notion Labs, Inc. | Internal documentation and knowledge management | US |
| PostHog Inc. | Product analytics | EU |
| Produktly | In-app onboarding and guidance | US |
| PropelAuth, Inc. | Authentication and identity management | US |
| Stripe Payments UK, Ltd. | Payment processing | UK |
We will update this table as our sub-processor list changes.
Claude connector: The Services include an optional connector that lets you use Huntbase from Anthropic's Claude (including claude.ai, Claude Desktop and Claude Code). The connector is off by default and an administrator of your organisation must turn it on for that organisation. When you connect Claude and ask it for Huntbase data, the results of the Huntbase tools Claude calls on your behalf are sent to Anthropic. Anthropic processes that data under your own Anthropic account, Anthropic's terms and Anthropic's Privacy Policy, not on our behalf, so Anthropic is not listed in the table above. Connecting is your organisation's choice, and we are not responsible for how Anthropic processes data sent to it.
Huntbase is headquartered in the United Kingdom. Some of our sub-processors operate infrastructure in the United States and European Union.
Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, including:
For transfers to the EU, the UK's adequacy decision for the EEA applies. For transfers to the US, we rely on SCCs or, where applicable, the UK-US Data Bridge.
We retain personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable law or regulation. We retain the following categories of data for the following periods:
Where deletion is not immediately possible — for example, where data is held in encrypted backup archives — we isolate it from active processing and schedule it for deletion at the earliest practicable opportunity.
Under UK GDPR, you have the following rights in relation to your personal data:
You also have the right to object to processing based on legitimate interests at any time, and an unconditional right to object to the processing of your personal data for direct marketing purposes at any time.
To exercise any of these rights, contact us at [email protected]. We will respond within one calendar month. We may need to verify your identity before processing your request.
If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email or via an in-app notice. The "last updated" date at the top of this page reflects the most recent version. We encourage you to review this policy periodically.
For any questions about this policy or to exercise your data rights:
Huntbase [email protected]
If you are an enterprise customer with questions about data processing under a DPA, please contact your account team or the address above.