1. Scope of This Policy
This policy describes the categories of data retained through Blue Lantern Security’s hosted platform, installed software, integrations, and security toolset, the retention periods that apply to that data, and the controls used to limit access to customer information. When Blue Lantern processes personal information on behalf of a customer through the Services (for example, when a customer submits emails or files for analysis, when Blue Lantern monitors a customer’s environment under a Seat License, or when Blue Lantern processes data from a customer’s connected mail, browser, endpoint, identity, or security integrations), Blue Lantern acts as a service provider under the California Consumer Privacy Act and applicable state privacy laws, and, where applicable, as a processor under data protection laws, processing such information only as necessary to provide the Services and in accordance with the customer’s instructions as reflected in Blue Lantern’s Terms of Service and Data Processing Addendum. In that capacity, Blue Lantern’s customers are responsible for providing any required privacy disclosures to their own users and for directing requests related to personal information processed through the Services.
It also applies to visitors of Blue Lantern Security’s websites: the public marketing site at bluelanternsecurity.com and the application site at bluelanternsecurity.io. Analytics and cookie practices for each site are described in Section 10.
The policy is focused on operational product data: account identity data, authentication credentials, analysis inputs, generated reports, transaction metadata, and data collected through installed software and integrations.
The Services are not directed to individuals under the age of eighteen (18), and Blue Lantern does not knowingly collect personal information from children. If Blue Lantern becomes aware that it has collected personal information from a child under eighteen, it will take reasonable steps to delete such information.
2. Account Data and Access Controls
When a user signs up for an account, Blue Lantern Security retains the user’s email address, password credential, first name, and last name. This information is stored in AWS Cognito and within our internal systems for identity and account administration purposes.
During authentication, a user’s account information is used to grant access only to that user’s own account data. Users are not permitted to access another customer’s data. Access is restricted through the unique identifier associated with the user in AWS Cognito.
3. API Keys
Each user may generate up to one API key for use in place of a username and password when authenticating to the platform through supported programmatic interfaces.
API keys are stored in encrypted form and are maintained in a separate database used for authentication validation. This database is used only to support authentication and access control workflows.
4. SaaS Analysis Inputs and Generated Reports
Blue Lantern Security’s SaaS services primarily deliver analysis to users in the form of reports. Those reports are retained for 90 days so that users have a report history to review, download and use as audit evidence through the user interface or API before they are deleted from our systems.
Reports may be generated from customer-submitted emails or files, which can contain sensitive information. The original submitted file or email content is retained for no more than one day. If sensitive values such as IP addresses, domain names, or email addresses appear within the generated report itself, those values may remain available for the one-week lifetime of that report.
Reports are accessible only to the user who generated them and are stored in a dedicated file system area associated with that user.
5. Transaction Logs and Payments
Metadata about each analysis run is retained in our transaction log database for the life of the account and is deleted when the account is deleted, and subscription transaction records are retained indefinitely. This allows users and administrators to confirm that a particular run occurred and which account it was billed to.
Card payment processing for purchases made through the application site is handled by Stripe. Blue Lantern retains transaction records including Stripe checkout metadata, the date of the transaction, the number of seats licensed, and the amount paid.
These transaction records do not contain the underlying analysis results or the customer inputs used to produce those results.
6. Operational Security Logs
Blue Lantern retains application and security logs, which can include IP address data, user-agent data, and API request data, for one (1) year. Blue Lantern also keeps a record of each sign-in to the application site (the user, email address, and time), which is retained until the user deletes their account.
These logs are maintained for security and operational monitoring and are retained separately from customer-facing account profile information.
7. Installed Software and Monitoring Features
Blue Lantern Security’s installed software and monitoring features include browser extensions, device agents, email add-ins, and security integrations that may collect and transmit data to Blue Lantern systems as part of ordinary operation so Blue Lantern can provide monitoring, analysis, alerts, reports, and related account functionality.
Data collected through installed software and integrations may include the URLs of pages visited by monitored users, device hostnames, pass/fail security check results reported approximately hourly, email metadata and content processed through connected Microsoft 365 or Gmail accounts, API credentials or tokens for connected services such as CrowdStrike, Defender, and Microsoft 365, and run history such as scanned URLs and device hostnames. Email content retrieved through connected mailboxes is deleted within 24 hours after analysis. Run history is retained for the life of the account and is deleted when the account is deleted, unless the customer deletes it earlier or it is anonymized or deleted as required by applicable law. Integration credentials and tokens are deleted from Blue Lantern’s live systems immediately when the user deletes the integration or the account, subject to the backup expiration period described in Section 11. Subscription transaction records are retained as described in Section 5.
8. External Communications and Optional Features
Certain cloud-hosted analysis tools, installed software components, and optional features may send limited information to third-party services when that is necessary to perform a requested security check, verify a configuration, or retrieve externally available security context. For example, Blue Lantern’s cloud analyzers may perform WHOIS, RDAP, and DNS lookups on submitted domains or IP addresses, and the URL analyzer may load a submitted URL, or a URL transmitted automatically by a monitored browser, from Blue Lantern-controlled servers to evaluate the page or destination. Before loading a URL transmitted automatically by a monitored browser, Blue Lantern removes the URL fragment (the portion after “#”) and the common tracking parameters utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, gbraid, wbraid, fbclid, dclid, _gl, gclsrc, and gad_source; it does not remove other query parameters or path components. These communications may reveal the submitted domain, IP address, URL, or related metadata to the relevant third-party lookup service, network endpoint, or cloud-provider service involved in the requested check.
9. How and Why We Use Your Data
Blue Lantern uses the data described in this Privacy Policy for the following business purposes: (a) providing, operating, and maintaining the Services, including performing security analysis, generating reports, and delivering monitoring results; (b) authenticating users, managing accounts, and enforcing access controls; (c) processing transactions and administering Seat License subscriptions; (d) communicating with users about their accounts, the Services, and changes to these policies; (e) providing customer support and responding to troubleshooting requests; (f) protecting the security and integrity of the Services, including detecting and preventing unauthorized access, fraud, and abuse; (g) measuring website use, sign-up conversions, and advertising campaign performance when a visitor has accepted the cookie banner; (h) complying with applicable laws, regulations, and legal processes; and (i) creating aggregated or de-identified usage and performance information that does not identify any individual user, for the purpose of analyzing and improving the Services and understanding usage trends. Blue Lantern will not use data collected through the Services for purposes materially different from those described above without providing notice to affected users.
10. Third-Party Providers, Browser Session Data, Website Analytics, and Advertising; Who We Share Your Data With
The analytics, advertising, and session storage practices described in this section apply to the application site at bluelanternsecurity.io. The public marketing site at bluelanternsecurity.com sets no cookies and loads no analytics or advertising tags, and therefore does not present a cookie banner.
Blue Lantern may disclose the data described in this Privacy Policy to the following categories of recipients, and only to the extent necessary for the stated purpose: (a) service providers that perform functions on Blue Lantern’s behalf, such as AWS for cloud hosting, storage, and authentication, Cloudflare for content delivery and network security, and Stripe for payment processing; (b) the analytics and advertising providers described in this Section 10, as described below; (c) law enforcement agencies, courts, regulators, or other governmental authorities when Blue Lantern is legally required to do so, or when disclosure is reasonably necessary to protect Blue Lantern’s rights, the safety of any person, or the integrity of the Services; (d) professional advisors, such as auditors and attorneys, under obligations of confidentiality; and (e) a successor entity in connection with a merger, acquisition, reorganization, or sale of all or substantially all of Blue Lantern’s assets, in which case Blue Lantern will notify affected users before their data is transferred and becomes subject to a different privacy policy. Blue Lantern does not sell personal information for money. Blue Lantern may share identifiers, internet or other electronic network activity information, and usage data with advertising partners for cross-context behavioral advertising, campaign measurement, conversion tracking, attribution, and audience-building, but only where the visitor has accepted the cookie banner or otherwise provided the required consent. Visitors may opt out of this sharing by declining the cookie banner or changing cookie preferences through the link in the application site footer, or by using a recognized Global Privacy Control signal.
Blue Lantern Security uses AWS Cognito for account identity and authentication workflows. When users purchase Seat Licenses through the application site, payment processing is initiated through Stripe.
For authenticated use of the application site, the frontend keeps session authentication values, including the current ID token, access token, and expiration timestamp, in browser memory only; they are not written to browser storage. They are discarded when the user signs out, the session expires, or the page is closed or reloaded. To restore a session after a reload, the frontend stores a non-sensitive flag in browser session storage indicating that the user was signed in, and stores the user’s selected account in browser local storage.
Blue Lantern uses Google Analytics 4 (measurement ID G-75PPMEX26G) to understand how visitors navigate the application site so we can improve it. Google Analytics may set first-party cookies (typically named _ga and _ga_<id>) and collect information such as page paths, referring URL, approximate geographic region derived from IP, device and browser characteristics, and timestamps. Data collected by Google Analytics is processed by Google and may be transferred to and stored on servers operated by Google, including outside the visitor’s country.
Blue Lantern also uses Microsoft Advertising’s Universal Event Tracking (UET) tag (tag ID 97248234) to measure the effectiveness of advertising campaigns and to attribute conversions originating from Microsoft search and display networks. When enabled by visitor consent, UET may set first-party cookies (typically named _uetsid and _uetvid) and collect information such as page paths, referring URL, conversion events, device and browser characteristics, and approximate geographic region derived from IP. Single-page-app route changes are tracked automatically. Data collected by UET is processed by Microsoft Corporation, may be transferred to and stored on servers operated by Microsoft including outside the visitor’s country, and may be used by Microsoft for advertising measurement, attribution, and audience-building consistent with Microsoft’s own privacy and advertising policies.
Blue Lantern also uses the Meta Pixel (pixel ID 972010459011763) to measure the effectiveness of advertising campaigns and to attribute conversions originating from Meta’s networks, including Facebook and Instagram. When enabled by visitor consent, the Meta Pixel may set first-party cookies (typically named _fbp and _fbc) and collect information such as page paths, referring URL, conversion events, device and browser characteristics, and approximate geographic region derived from IP. Single-page-app route changes are tracked automatically. Data collected by the Meta Pixel is processed by Meta Platforms, Inc., may be transferred to and stored on servers operated by Meta including outside the visitor’s country, and may be used by Meta for advertising measurement, attribution, and audience-building consistent with Meta’s own privacy and advertising policies.
Blue Lantern also uses the Google Ads conversion tag to measure sign-up conversions and the effectiveness of Google advertising campaigns. When enabled by visitor consent, the Google Ads conversion tag may set first-party cookies or use similar identifiers and may collect information such as page paths, referring URL, conversion events, device and browser characteristics, approximate geographic region derived from IP, and timestamps. Data collected through the Google Ads conversion tag is processed by Google and may be transferred to and stored on servers operated by Google, including outside the visitor’s country, and may be used by Google for advertising measurement, attribution, and audience-building consistent with Google’s own privacy and advertising policies.
Google Analytics, Microsoft Advertising, the Meta Pixel, and the Google Ads conversion tag are loaded using Consent Mode, with analytics_storage, ad_storage, ad_user_data, and ad_personalization all set to denied by default. No analytics or advertising cookies are set, and no measurement data is sent to Google, Microsoft, or Meta, unless and until a visitor accepts the cookie banner presented on first visit to the application site. Accepting the banner switches all four signals to granted for the duration of the visitor’s recorded consent, except that if the visitor’s browser sends a Global Privacy Control signal, accepting the banner grants only analytics_storage and the three advertising signals remain denied; declining keeps them denied and functions as an opt-out of sharing personal information for cross-context behavioral advertising.
A visitor’s consent decision is recorded in browser local storage under the key bl_consent_v4. To change or withdraw consent at any time, a visitor can use the link in the application site footer to reopen the banner and make a new selection. Visitors may also clear site data in their browser, use a browser or extension that sends a recognized Global Privacy Control signal, or use browser settings, extensions, or Google’s and Microsoft’s own opt-out mechanisms to block these tags independently of this banner. If the banner version changes in the future, any prior consent will be invalidated and visitors will be re-prompted under the updated terms.
11. Account Deletion, Anonymization, and Backup Archives
Before account deletion is finalized, any active API key must be revoked.
When an account is deleted, Blue Lantern deletes the related AWS Cognito records and deletes the integration credentials and tokens associated with the account from its live systems. Internal identity records are anonymized, and transaction log records are anonymized rather than removed in full. An organization account administrator may delete an organization account, and an individual user may delete a personal account, through the account settings on the application site. If Blue Lantern closes an organization account or the Terms of Service terminate, Blue Lantern will make Customer Data and reports then held by Blue Lantern available for export for a limited period following a timely written request, as described in the Terms of Service, after which such materials may be deleted in accordance with Blue Lantern’s ordinary retention schedule. Blue Lantern has no obligation to restore, recreate, retain, or export submitted inputs, reports, or other materials that were deleted, anonymized, or aggregated in accordance with Blue Lantern’s ordinary retention schedule before the export request was received. If no export request is received, Blue Lantern may delete Customer Data and reports after that closure or termination in accordance with its ordinary retention schedule. Cancellation of a Seat License does not, by itself, delete the account; paid monitoring features stop, and enrolled browser extensions, device agents, and mailbox integrations stop transmitting monitoring data, at the end of the paid billing period, after which account access may revert to the Free Tier where available.
Blue Lantern maintains encrypted backups of its primary application database, which holds account, membership, run history, integration configuration, and alert-rule records, and which are retained for seven (7) days, and encrypted point-in-time recovery copies of its API key records, which are retained for thirty-five (35) days. Integration credentials and tokens are stored separately, are not included in these backups, and are permanently deleted when the integration or account is deleted. Other data deleted from Blue Lantern’s live systems, including integration configuration records, may remain in those backups until the applicable backup expires at the end of its retention period and may not be selectively removed from backups before then. Access to backups is restricted, and backups are used only to restore Blue Lantern’s systems.
12. Data Location, Security Measures, and Support Records
Blue Lantern processes SaaS customer data in the eastern United States. Data stored locally by installed software remains in the environment where the customer installs and operates the software, except to the extent the customer connects, submits, or transmits data through the Services. Communications with Blue Lantern systems, including account, monitoring, integration, update, and support communications, are made to Blue Lantern systems located in the eastern United States.
Blue Lantern encrypts data in transit and at rest and restricts access to production environments.
Support and troubleshooting emails, together with related support materials voluntarily provided by the customer, may be retained for up to one year.
13. Your Rights
Depending on your jurisdiction, you may have rights with respect to the personal information Blue Lantern holds about you, including the right to access, correct, or delete your personal information, the right to restrict or object to certain processing, and the right to data portability. Blue Lantern will not discriminate against any user for exercising privacy rights available under applicable law. To exercise any of these rights, contact [email protected] with sufficient information to identify yourself and describe your request. Blue Lantern will respond to verified requests within thirty (30) days, or within the timeframe required by applicable law, whichever is shorter. If Blue Lantern processes your personal information on behalf of an organization that is a customer of the Services, you should direct your request to that organization, as Blue Lantern may only be able to respond at the direction of its customer. The Services do not respond to Do Not Track signals from web browsers. The Services may contain links to third-party websites or resources. Blue Lantern is not responsible for the privacy practices or content of those third-party websites, and this Privacy Policy does not apply to any information you provide to or that is collected by such third parties.
14. Your California Privacy Rights
This section applies to residents of California and supplements the information in this Privacy Policy.
Blue Lantern collects the following categories of personal information: (a) identifiers, such as name, email address, IP address, device hostname, and online identifiers; (b) internet or other electronic network activity information, such as browsing activity collected through monitored browser extension use, URLs submitted or scanned through the Services, API request logs, device security check results, and interactions with the Services; (c) commercial information, such as subscription and transaction records; (d) professional or employment-related information, to the extent provided in connection with an organization account; and (e) account, integration, and security configuration information, such as connected service identifiers, integration tokens or credentials, and customer-selected security settings.
Blue Lantern uses personal information for the business purposes described in this Privacy Policy, including providing and securing the Services, processing transactions, communicating with users, improving the Services, performing security analysis and monitoring, and measuring advertising campaigns. Blue Lantern does not sell personal information for money. Blue Lantern may share identifiers, internet or other electronic network activity information, and usage data with advertising partners for cross-context behavioral advertising, campaign measurement, conversion tracking, attribution, and audience-building after the visitor accepts the cookie banner, and Blue Lantern has engaged in that sharing during the preceding twelve months only to the extent described in this Privacy Policy.
California residents may submit verified requests to: (a) know what personal information Blue Lantern has collected, used, disclosed, sold, or shared; (b) delete personal information Blue Lantern holds about them, subject to certain exceptions; (c) correct inaccurate personal information; and (d) opt out of the sale or sharing of personal information. Blue Lantern does not sell personal information for money. California residents may opt out of sharing for cross-context behavioral advertising by declining the cookie banner or changing cookie preferences through the link in the application site footer (which serves as Blue Lantern’s “Do Not Sell or Share My Personal Information” mechanism), or by using a recognized Global Privacy Control signal. Blue Lantern will not discriminate against a user for exercising any of these rights. To submit a request, contact [email protected].
15. Privacy Requests, Policy Updates, and Contact
Users may request information about their data, or submit privacy-related questions, at any time by contacting [email protected]. Blue Lantern will respond to verified privacy-related requests within thirty (30) days, or within the timeframe required by applicable law, whichever is shorter.
Blue Lantern Security may update this policy from time to time to reflect changes in its products, infrastructure, or retention practices. The latest version will be posted on this page, which is linked from both bluelanternsecurity.com and bluelanternsecurity.io, with an updated effective date.
Questions regarding this policy may be sent to [email protected].