How SafeHaven handles your household's information

1. Information we collect

SafeHaven collects personal information only to deliver the managed family cybersecurity service described in our intake and pricing pages. We collect the minimum information needed to run that service, and we tell you what we are collecting before we do so.

The categories of personal information we collect include:

• Identifiers and contact data. Names, email addresses, phone numbers, and physical addresses of household members you choose to enroll, plus the contact details we use to reach you during onboarding and incident response.
• Account and credential data. Email accounts, usernames, and authentication factors you authorize us to monitor for credential exposure. We monitor the email address you provide; we do not store the credentials themselves.
• Device and network data. Operating systems, device counts, network configuration, and security posture signals for the household devices you enroll in protection.
• Communications content. Messages you send us through the intake form, support channel, or email, and the notes our team produces while working on your account.
• Payment data. When subscription billing begins, payment information is collected and processed by our payment provider under their own privacy notice. We receive only the tokens needed to bill your account.
• Telemetry from our service. Aggregated metadata about how our dashboards and reports are used, strictly operational.

We do not collect sensitive personal data such as government identifiers (Social Security numbers, driver's license numbers, or financial account numbers) and we do not collect biometric or health data. We do not knowingly collect personal information from individuals under the age of 18 outside of the household-enrollment context described in section 6.

2. How we use information

We use the personal information we collect only for the purposes disclosed to you at the point of collection and listed below. We do not sell personal information, and we do not use it for advertising profiling.

• To deliver the SafeHaven service: build your household security profile, configure monitoring, run scans on the schedule described in your plan, and respond to incidents.
• To communicate with you about your account, security events that affect you, and material changes to the service.
• To meet our legal and operational obligations: recordkeeping, fraud prevention, and responding to lawful requests.
• To improve the service in aggregate, such as refining detection rules. Aggregate insights from which individuals cannot reasonably be identified are considered non-personal for this purpose.
• To send you the educational content you have explicitly opted into (such as the self-check nurture emails). You can unsubscribe at any time.

We do not use your household's personal information for automated decisions that produce legal or similarly significant effects on you. Decisions about your account are made by a person on our team.

3. How we share information

We share personal information only with the categories of recipients described below, and only with the information they need to do their job.

• Service providers. Vendors who help us run the service — for example, our ticketing platform, our payment processor, our email-delivery provider, and our breach-intelligence provider. Each is bound by a written agreement that limits their use of your data to providing services to us.
• Professional advisors. Auditors, lawyers, and insurers, when reasonably necessary.
• Government and law enforcement. When we receive a lawful request that, in our judgment, requires disclosure. Where the law allows, we will notify you before responding.
• A new owner. If SafeHaven is acquired or merged, your information may be transferred to the successor, under the protections of this notice.
• With your consent. Anyone else, only if you tell us to.

We do not sell personal information. We do not share personal information with third parties for cross-context behavioral advertising.

4. Your choices and rights

If you are a Texas resident, the Texas Data Privacy and Security Act (TDPSA) gives you the rights described in this section. If you live outside Texas, we extend the same rights to you as a matter of practice. To exercise any of these rights, contact us using the address in section 10. We will respond within 45 days; if we need more time, we will tell you why and when to expect a resolution.

Right to access

You can request a copy of the personal information we hold about you, in a portable format where your request is for the data you provided to us.

Right to correction

If the personal information we hold about you is incorrect, you can ask us to correct it. We will tell you what we changed and what we did not change and why.

Right to deletion

You can ask us to delete the personal information we hold about you. We will do so, except where retention is required to complete a transaction, comply with a legal obligation, or protect against fraudulent or illegal activity. We will tell you if any of those exceptions apply to your request.

Right to data portability

For personal information you provided to us, you can ask us to send it to you, or directly to another organization you designate, in a commonly used, machine-readable format.

Right to opt out of sale

We do not sell personal information, and we have not done so in the twelve months preceding the last-updated date of this notice. The right remains available to you if our practices change.

Right to opt out of targeted advertising

We do not process personal information for targeted advertising. The right remains available to you if our practices change.

Right to appeal

If we decline to take action on a request you make under this section, you can appeal our decision. To appeal, respond to the response we sent you, or contact us at privacy@safehaven.example with "Appeal" in the subject line. If your appeal is denied, you may submit a complaint to the Texas Attorney General.

5. How we protect information

We protect the personal information we hold with administrative, technical, and physical safeguards appropriate to the sensitivity of the data. These include access controls that limit who on our team can see household information, encrypted transport for data in motion, encryption at rest for stored data, audit logging, secure backups, and incident-response procedures.

If a security incident affects your personal information, we will notify you in a timely manner consistent with applicable law and with our runbook.

No system is perfectly secure. The safeguards we describe reduce but do not eliminate risk, and we ask that you take reasonable steps to protect your own credentials, devices, and the network connection you use to reach us.

6. Children's information

SafeHaven is a household service. To deliver that service, parents and legal guardians provide us with identifying information about household members who are minors. We collect that information only as needed to protect the household (such as configuring device monitoring for a child's laptop or phone), and we use it only for that purpose.

If you believe we have collected information about a child in a manner inconsistent with this notice, contact us at privacy@safehaven.example and we will investigate and remove the information where appropriate.

7. Changes to this notice

If we make material changes to this notice, we will post the revised notice with an updated "Last updated" date and, where the changes affect information we have already collected from you, notify you at the email address on file before the changes take effect.

Past versions of this notice are available on request.

8. Contact us

To exercise the rights described in section 4, ask a question about this notice, or submit an appeal, contact us:

• By email: privacy@safehaven.example
• Through the intake form at /intake (for general service questions)

SafeHaven is the data controller for the personal information described in this notice. Our designated contact for privacy matters is reachable at the email address above.