Privacy Policy

1. Roles and scope

When a customer integrates AbuseGraph into their application, that customer is typically the data controller (or "business") for personal data submitted through the Service, and AbuseGraph acts as a data processor (or "service provider") on their behalf. When you visit our marketing site, create an AbuseGraph account, or communicate with us directly, we act as a controller for that account and communications data.

This Policy covers both situations. Customer-specific processing terms, including a Data Processing Agreement (DPA), are available on request and control where they conflict with this Policy for customer-submitted data. Under the DPA, you remain the controller for end-user data you submit and AbuseGraph acts as your processor, processing that data only on your documented instructions to provide the Service.

2. Information we process

Depending on how the Service is used, we may process the following categories of information:

• • Account information — name, email address, authentication credentials, workspace membership, billing contacts, and similar details you provide when registering or administering an account.
• • Customer content and event data — information customers submit for risk evaluation in connection with account lifecycle events (for example signup, sign-in, or related flows). This commonly includes identifiers the customer chooses to send (such as an email address or phone number), technical request metadata, and limited device or session characteristics needed to assess risk. Phone numbers are used only for account-protection purposes on the submitting customer's own users — not for list cleaning, resale, or bulk verification.
• • Phone and telecom enrichment — when a customer submits a phone number during a live account event, we may derive or receive limited telecom metadata (such as line type or carrier classification) and, where available and permitted, short-lived footprint-style signals to assess fraud risk. We do not store profile avatars, caller-name (CNAM) records, or persistent raw phone directories. Phone numbers are hashed for retention where needed; enrichment cache entries expire after a short operational window.
• • Technical and usage information — IP address and derived location or network attributes, browser and device characteristics, timestamps, referrers, request headers, API usage metrics, and diagnostic logs that help us operate, secure, and improve the Service.
• • Support and communications — messages, attachments, and related metadata when you contact us.
• • Billing and commercial information — plan selection, invoices, payment status, and related records. Payment card data is handled by our payment processor; we do not store full payment card numbers on our systems.

We do not ask customers to send passwords, payment card numbers, or government ID documents through the risk-evaluation API. Customers control what identifiers and context they include in each request.

3. How we use information

We use information to:

• • Provide, operate, and maintain the Service, including risk scoring, recommendations, monitoring features, and customer consoles
• • Authenticate users, protect accounts, prevent abuse of the Service, and enforce our terms
• • Generate outputs customers request (such as scores, verdicts, reasons, alerts, and activity history)
• • Improve reliability, accuracy, performance, and security of the Service using aggregated or de-identified insights where practical
• • Communicate about the Service, including transactional notices, security alerts, and (where permitted) product updates
• • Comply with law, respond to lawful requests, and establish, exercise, or defend legal claims

We do not sell personal information. We do not use customer event data to build advertising profiles or to market unrelated third-party products. We do not use one customer's event data to score or enrich another customer's traffic. Phone and telecom signals are used only to help the submitting customer prevent fraud and account abuse — not for credit, employment, tenant, insurance, or other consumer-reporting purposes, and not for list cleaning or data brokerage.

4. Legal bases (EEA / UK / similar regimes)

Where GDPR or analogous laws apply and we act as a controller, we rely on one or more of the following bases: performance of a contract; legitimate interests (such as securing our Service, preventing fraud and abuse, and improving reliability) balanced against individual rights; consent where required; and legal obligation. Where we act as a processor, our customers determine the applicable legal basis for submitting personal data to the Service — typically their legitimate interest in preventing fraud and account abuse, or their contractual relationship with the end user whose data they submit. A Legitimate Interest Assessment for our controller activities is available upon request.

5. Sharing of information

Customer information is siloed by workspace. We do not cross-share customer event data, end-user identifiers, fingerprints, visit history, risk outputs, or console content between customers — even when sharing might improve fraud or abuse detection for others. Rematch and history features operate within the submitting customer's workspace only.

We may share information with:

• • The customer workspace that submitted or controls the relevant data
• • Service providers that process data on our instructions to host, secure, monitor, communicate, bill, or support the Service
• • Professional advisors under confidentiality obligations
• • Authorities or other parties when required by law or to protect rights, safety, and security
• • A successor entity in connection with a merger, acquisition, or similar corporate transaction, subject to appropriate safeguards

We require processors that handle personal data to protect it under written agreements and to use it only for the services they provide to us. Subprocessors generally include cloud hosting and edge compute providers; database, object storage, and logging services; email and notification delivery; payment processors; and contracted enrichment or threat-intelligence providers. Some phone or telecom enrichments are assembled by those contracted providers under our instructions — AbuseGraph does not operate consumer-facing scraping against end-user profiles on your behalf. A current list of subprocessors is available to customers upon request at privacy@abusegraph.com.

6. International transfers

We and our service providers may process information in the United States and other countries. Where required, we use appropriate transfer mechanisms (such as Standard Contractual Clauses or equivalent safeguards) and apply additional contractual and technical protections. Customers with residency or localization requirements should contact us before sending regulated data so we can confirm available options.

For phone numbers associated with the European Economic Area, Switzerland, or the United Kingdom, directory or social footprint enrichment may be disabled until we complete additional privacy assessment. Basic telecom metadata may still be processed where supported. Contact privacy@abusegraph.com before relying on phone enrichment for EEA, Swiss, or UK end users.

7. Retention

We retain information only as long as reasonably necessary for the purposes described in this Policy, to comply with legal obligations, and to resolve disputes. Typical retention periods include:

• • Detailed request and evaluation records associated with risk checks: retained for a limited operational window, then deleted or reduced
• • Phone enrichment cache and transient telecom metadata: retained only for a short operational window (typically on the order of days, not months), then deleted or reduced; phone numbers in persistent stores are kept as one-way hashes where retention is required
• • Decision history and customer-visible activity needed for support, auditing, and product features: retained for the customer relationship and a reasonable period afterward
• • Aggregated or de-identified analytics: retained longer where they no longer identify an individual
• • Account, billing, and compliance records: retained as required by law and ordinary business needs
• • Records needed to honor erasure or suppression requests: retained in a minimized form so we can continue to respect those requests

Workspace administrators can configure retention preferences in the console. When a customer account is closed, we delete or anonymize customer-controlled personal data within a commercially reasonable period, subject to legal holds and minimized suppression records.

8. Security

We implement administrative, technical, and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include access controls, encryption in transit, hardened production environments, least-privilege operational practices, logging and monitoring, and vendor diligence for systems that process customer data. No method of transmission or storage is perfectly secure; if we become aware of an incident affecting your personal data, we will notify affected customers and individuals as required by applicable law and our agreements.

9. Your rights

Depending on your location and role, you may have rights to access, correct, delete, or export personal data; restrict or object to certain processing; withdraw consent; and appeal certain decisions. Residents of California and similar U.S. states may also have rights to know, delete, correct, and opt out of "sale" or "sharing" of personal information as those terms are defined by law. AbuseGraph does not sell personal information and does not share it for cross-context behavioral advertising.

If we process your data on behalf of a customer, please contact that organization first; we will assist them in responding. For requests directed to AbuseGraph as a controller, email privacy@abusegraph.com. Workspace owners can also export settings and request deletion from the console. We may need to verify your identity before fulfilling a request. You may also lodge a complaint with a supervisory authority where you live or work.

10. Cookies and similar technologies

Our websites and console may use cookies and similar technologies that are necessary to operate the Service (for example session and security cookies) and, where used, limited analytics to understand aggregate product usage. You can control cookies through your browser settings; disabling some cookies may affect site functionality.

11. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact privacy@abusegraph.com and we will take appropriate steps to delete it.

12. Changes

We may update this Policy from time to time. We will post the updated version with a revised "Last updated" date and, when changes are material, provide additional notice as appropriate. Continued use of the Service after an update becomes effective constitutes acceptance of the revised Policy where permitted by law.

13. Contact

Privacy questions, rights requests, and DPA or subprocessor inquiries: privacy@abusegraph.com