Privacy, Cookies & Telemetry Policy
How ThreatPoint processes client-side local storage and security telemetry under UK data protection law. Designed with privacy by default: zero marketing trackers, zero cross-site tracking, and no intrusive consent banners.
2. Fraud Prevention & IP Reputation
ThreatPoint analyzes technical connection indicators to defend web properties against automated exploits, credential stuffing, carding attacks, and malicious bot traffic.
We act as a Controller for telemetry captured directly on our own infrastructure, sensor network, public endpoints, and website (threatpoint.co.uk). This data is processed to defend our perimeter and construct baseline IP risk reputations.
When enterprise clients query our API with IP addresses or transaction metadata, we act as a Data Processor under a formal Data Processing Agreement (DPA). We evaluate the payload against threat intelligence models solely on the client's documented instructions.
Categories of Technical Data Processed
We collect solely network identifiers and machine-generated protocol metrics. We never collect Special Category Data (UK GDPR Article 9) or attempt to resolve IP addresses to real-world residential postal records:
3. Lawful Basis: Legitimate Interests
We process technical personal data under our Legitimate Interests (Article 6(1)(f) of the UK GDPR). Preventing cyber-attacks and securing computer systems are explicitly acknowledged as legitimate interests under European and UK data protection frameworks:
Our Legitimate Interests Assessment (LIA) verifies that machine-level analysis of IP traffic poses negligible risk to the fundamental freedoms of individual users, while providing critical security benefits across interconnected digital ecosystems.
4. Data Retention Schedule
Technical logs are rotated and purged automatically on strict timeframes according to operational sensitivity.
| Telemetry Category | Operational Purpose | Retention Window | Disposition Method |
|---|---|---|---|
| Raw HTTP & Edge Ingress Logs | Attack mitigation, triage & troubleshooting | 30 to 90 Days | Automated cryptographic overwrite & purge |
| Active Firewall & Rate-Limiting Rules | Brute-force and bot mitigation state | 7 to 30 Days | Automatic dynamic de-listing |
| IP Reputation & Proxy Scores | Reputation trend evaluation | Rolling 180 Days | Purged or degraded to subnet aggregates |
| Aggregated Threat Indicators | Botnet signatures, high-risk CIDRs | Indefinite (Anonymised) | Non-personal statistical summaries |
5. Data Subject Rights & Objection
Individuals in the United Kingdom and EEA possess statutory rights regarding personal data, including the right to request access, rectification, erasure, and restriction of processing.
Where we process an IP address under legitimate interests, you have the right to object or request a reputation re-evaluation. If you believe your IP address has been incorrectly classified or is suffering a false-positive flag:
Note: Under Article 21(1), processing may continue if compelling legitimate security grounds are demonstrated (such as addressing active, ongoing volumetric DDoS attacks or automated vulnerability probing).