Introduction
This Privacy Policy (this “Policy”) governs how Spearbit Labs, Inc. (DBA Cantina Security), a Delaware corporation (“Cantina,” “we,” “us,” or “our”) protects the privacy of its users and other individuals who provide Personal Information in connection with their access to or use of our website, platform, or application, together with any related products or services we offer (collectively, the “Services”), and describes the types of information we may collect from you or that you may provide to us, as well as our practices for collecting, using, maintaining, protecting, and disclosing that information.
Your use of the Services is governed by our Terms of Use. Some products have additional privacy disclosures, such as the Clarion Privacy & Legal Disclosures at docs.cantina.security/resources/legal and, for Apex trials, the Apex Trial Data Policy at cantina.security/apex/data-policy.
Please read this Policy carefully to understand our policies and practices regarding your information and how we treat it. If you do not agree with our policies and practices, your choice is not to use our Services. We may update or revise this Policy from time to time (see Changes to this Privacy Policy). Your continued use of the Services after we update or revise this Policy will constitute your acceptance of those updates or revisions.
This Policy applies to the Personal Information we collect:
- Through the Services;
- In email, text, and other electronic messages between you and Cantina;
- When you interact with our advertising and applications on third-party websites and services, if those applications or advertising include links to this Policy; or
- When you provide information, data, materials, text, prompts, images, or other content on or through the Services.
This Policy does not apply to information collected by:
- Us offline or through any other means; or
- Any third party, including through an application or content (including advertising) that may link to or be accessible from or on the Services.
This Policy also does not apply to data that Cantina processes on behalf of its clients when providing the Services, such as source code, repositories, pull requests, findings, security alerts, logs, and other materials that clients submit to or connect with Cantina products (“Customer Data”). Customer Data, including any personal information it contains, is governed by the applicable written agreement between Cantina and that client, including any data processing agreement, and by the product-specific terms for the relevant product, such as the Apex Terms of Service and the Clarion Terms of Service. If your personal information is included in Customer Data, please contact the relevant client. Protected health information is processed only under a business associate agreement with the relevant client.
Information We Collect About You and How We Collect It
Cantina recognizes any data related to an identifiable individual or that identifies an individual as “Personal Information” subject to this Policy. Depending on how you interact with Cantina, we collect and use different types of Personal Information. Types of information we may collect include:
- By which you may be personally identified, such as name, payment card information, postal address, e-mail address, telephone number, date of birth, gender, title, or any other identifier by which you may be contacted online or offline; and
- Profile information, such as your username and password, interests, preferences, feedback, and survey responses; and
- Social media profiles and links to your profiles; and
- Feedback and correspondence, such as the information you provide in your responses to surveys, when you participate in market research activities, report a problem with the Services, receive customer support or otherwise correspond with us; and
- About your internet connection, the equipment you use to access our Services, information about how you use the Services and interact with us, and other usage details.
We collect this information:
- Directly from you when you provide it to us.
- Automatically as you navigate through the Services. Information collected automatically may include usage details, IP addresses, and information collected through cookies and other tracking technologies.
- From third parties, for example, our business partners.
Information You Provide to Us
The information we collect on or through our Services may include:
- Information that you provide (e.g. by using or filling in forms on the Services or while interacting with the Services). This includes information provided at the time of registering to use the Services, subscribing to the Services, posting or providing material, or requesting further services.
- Records and copies of your correspondence (including email addresses) if you contact us.
- Details of transactions you carry out through the Services and of the fulfillment of your requests.
- Your search queries and activities on the Services or while interacting with the Services.
Information We Collect Through Automatic Data Collection Technologies
As you navigate through and interact with the Services, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:
- Details of your visits to or interactions with our Services, including traffic data, location data, logs, other communication data, and the resources you access and use through your interactions with our Services.
- Information about your computer and internet connection, including your IP address, operating system, and browser type.
The information we collect automatically may include Personal Information, or we may maintain it or associate it with Personal Information we collect in other ways or receive from third parties. This helps us to improve the Services and to deliver a better and more personalized service, including by enabling us to:
- Estimate our audience size and usage patterns.
- Store information about your preferences, allowing us to customize our Services according to your individual interests.
- Speed up your searches.
- Recognize you when you return to and interact with our Services.
The technologies we use for this automatic data collection may include:
- Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting, you may be unable to access certain parts of our Services. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to the Services.
- Web Beacons. Certain sections of our Services and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixels gifs) that permit us, for example, to count the users who have visited those pages or opened an email and for other statistics related to the Services (for example, recording the popularity of a certain section and verifying system and server integrity).
- Log Files. Like many websites and technology services delivered over the Internet, we collect and store information that your browser sends to us when you visit or interact with the Services. This information may include your IP address, browser type, browser version, domain names, the pages of the Services that you visit, the time and date of your visit, the time spent on those pages, and other statistics.
- Google Analytics. We also use Google Analytics as a tool for tracking and analyzing web traffic to the Services. Google Analytics uses cookies and JavaScript code to compile information that is synthesized into reports about page visits, referring sites, user habits, and similar data.
Google has created an “Opt-out Browser Add-on” for users who wish to use the Services while preventing their data from being accessed or used by Google Analytics. If you want to opt out of the features on the Services that rely on Google Analytics, please follow the directions provided by Google here: https://tools.google.com/dlpage/gaoptout.
Cookies and Similar Technologies We Use
Information About Security Researchers
If you participate in Cantina’s marketplace programs as a Security Researcher, we also collect the information needed to verify your identity and pay you, such as your username, email address, and payout wallet address. Identity verification is performed by our identity verification provider, Persona. Persona shares your username with us. We also collect tax forms (IRS Form W-9 or W-8) from Security Researchers to meet our tax reporting obligations. Where data protection laws such as the GDPR apply, we collect and store tax forms because they are necessary to pay you under our agreement with you and for our legitimate interest in meeting our US tax reporting obligations. We may use automated tools, including AI, to check submitted tax forms for completeness and for consistency with your identity verification. A person reviews any issue these checks raise before it affects your payouts. Payouts are made in USDC on the Ethereum mainnet to a wallet address that you verify. Transactions recorded on a public blockchain, including payouts and wallet addresses, are publicly visible and cannot be changed or deleted by Cantina.
Purpose of Collection
We use information that we collect about you or that you provide to us, including any Personal Information to:
- Provide the Services. We may use your Personal Information to provide the Services, and any other services you may request from us.
- Monitor the Services. We collect your Personal Information for monitoring purposes to help us diagnose problems with our servers, administer and troubleshoot Services, calculate usage levels, analyze industry standards, and analyze transactions, trends, and statistics regarding the use of the Services.
- Respond to Inquiries and Fulfill Requests. We may use your Personal Information to respond to your inquiries and to fulfill your requests for information.
- Communicate with You. We may use your Personal Information to communicate with you about items that may be of interest to you. We may also contact you on behalf of our third-party business partners about a particular offering of theirs that may be of interest to you.
- Improve the Services. We may use your Personal Information to make the Services more stable and user-friendly, to analyze issues with the Services, improve the design and content of the Services, personalize your experience, analyze how the Services are used, offer new Services, and to develop new marketing programs relating to the Services.
- Customer Service. We may use your Personal Information when contacting you regarding customer service, to resolve disputes, or in response when you provide feedback. We may also use your information to send administrative emails regarding the Services or to inform you of any changes to this Policy, our terms, or other agreements with you.
- Support Business Operations. We may use your Personal Information to support our internal business operations, including account management, marketing, security, and advertising.
- Enforce Agreements. We may use your Personal Information to enforce separate agreements between you and us, enforce this Policy, our Terms of Use, other agreements with you.
- Fulfill Other Purposes. We may use your Personal Information to fulfill: (a) any other purpose for which you provide it; (b) any legal or regulatory requirements and any of our internal policies; (c) other purposes disclosed at the time of collection; (d) any other purpose with your consent; and (e) any other purposes set forth in this Policy.
Sale or Sharing of Personal Information
We do not sell your Personal Information in exchange for monetary compensation. We may sell or share your Personal Information for non-monetary compensation by allowing certain third parties (such as online advertising services and marketing partners) to collect Personal Information (i) via automated technologies on our Services for cross-context behavioral advertising purposes and/or (ii) for marketing-related purposes.
Third Party Links
As stated above, our Services may link to third-party websites, online services, or mobile applications and/or contain advertisements from third parties that are not affiliated with us—and which may link to other websites, services, or applications. Please be aware that we are not responsible for the privacy or practices of other websites or third parties. We do not make any guarantee regarding those third-party websites, services, or applications, and we are not liable for any loss or damage caused by the use of such sites. Any data collected by third parties is not covered by this Policy. You should review the policies of the third parties and contact them directly if you have any questions about their services or practices.
Consent and Withdrawal
Where required by law, we will obtain your consent before collecting, using, or disclosing your Personal Information. You may withdraw your consent at any time by contacting us using the details in the Contact Us section. Withdrawal of consent will not affect the lawfulness of processing conducted prior to withdrawal.
Disclosure of Your Information
We may disclose deidentified and aggregated information about our users without restriction.
We may disclose information, including Personal Information to Suppliers to provide you with the Services. Suppliers will collect and use this information in accordance with their own privacy policies, and Cantina is not responsible for Suppliers’ use of this information. “Suppliers” means third-party service providers that perform services on our behalf.
We may disclose Personal Information that we collect or that you provide as described in this Policy:
- To our subsidiaries or affiliates;
- To contractors, service providers, and other third parties we use to support our business and who are bound by contractual obligations to keep Personal Information confidential and use it only for the purposes for which we disclose it to them;
- To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Cantina’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information held by Cantina about users of the Services is among the assets transferred;
- To fulfill the purpose for which you provide it; for example, when using the Services, you may provide us with information to sign up for seminars, request specific information about programs, or register or apply for various programs or services, and we will use the information you provide us to evaluate and process your request or application or provide you with the services you request;
- For any other purpose disclosed by us when you provide the information; and
- With your consent.
We may use for other purposes and disclose to third parties information that does not constitute as Personal Information.
We may also disclose your Personal Information:
- To comply with any court order, law, or legal process, including to respond to any government or regulatory request;
- To enforce or apply the Terms of Use and other agreements between you and Cantina; and
- If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Cantina, our customers, or others, including by exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.
How Long We Retain Your Information
We will keep your Personal Information while you have an account with us or while we are providing the Services to you. Thereafter, we will keep your Personal Information for as long as is necessary to respond to any questions, complaints, or claims made by you or on your behalf or to the extent necessary to keep records required by law.
Choices About How We Use and Disclose Your Information
We strive to provide you with choices regarding the Personal Information you provide to us. We have created mechanisms to provide you with the following control over your information:
- Tracking Technologies and Advertising. You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. Please consult your browser’s documentation to learn how. Note that certain portions of the Services may not operate as intended if you refuse certain cookies.
- Promotional Offers from Cantina. If you do not wish to have your email address/contact information used by Cantina to promote our own products or services, you can opt-out by using the UNSUBSCRIBE feature in the email you receive from Cantina, which will remove you from future email distributions. This opt-out does not apply to information provided to Cantina as a result of a transaction or your interactions with the Services.
We do not control third parties’ collection or use of your information to serve interest-based advertising. However, these third parties may provide you with ways to choose not to have your information collected or used in this way.
Do Not Track
Our Services do not respond to Do Not Track signals. However, some third-party websites do keep track of your browsing activities. If you are visiting such websites, you can set your preferences in your web browser to inform websites that you do not want to be tracked. You can enable or disable Do Not Track signals by visiting the preferences or settings page of your web browser.
Confidentiality and Security
Cantina has implemented appropriate administrative, technical, and physical safeguards designed to protect the integrity and security of your Personal Information. We undertake commercially reasonable efforts to guard against unauthorized access, use, alteration, or destruction of Personal Information. However, no method of transmission over the Internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security. Information about Cantina’s security program, compliance reports, and sub-processors is available on the Cantina Trust Center at https://trustcenter.cantina.security/.
Updating Your Information
If you are a user who has a registered account on the Services, you can review and change some of your Personal Information by logging into the Services and visiting your account details page or by contacting us at the information listed below.
Children Under the Age of 18
Our Services are not intended for children under 18 years of age. We do not knowingly collect information from children under 18. If you are under 18, do not use or provide any information through the Services. If we learn we have collected or received information from a child under 18 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 18, please contact us at the information below.
Changes to this Privacy Policy
We may revise or update this Policy from time to time. If we make material changes to how we treat our users’ Personal Information, we will notify you through a notice on the Services’ home pages. The last date of revision of this Policy is set forth above. You are responsible for ensuring we have an up-to-date active and deliverable email address for you, and for periodically visiting the Services and this Policy to check for any changes.
Accessing and Correcting Your Information
We respect your privacy and are committed to protecting your Personal Information. As such, you may send us an email at the email address set forth below to request access to, correct, or delete any Personal Information that you have provided to us. We cannot delete your Personal Information except by also deleting your user account. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect.
Request Processing and Verification
In order to protect your Personal Information from unauthorized access, deletion, rectification, or restriction, we may require you to verify your identity before we will process any request to know or delete Personal Information. If we cannot verify your identity to our satisfaction, we will not provide or delete your Personal Information.
You may submit a request to know or delete your Personal Information through an authorized agent. Such an agent must present signed written authority to act on your behalf and must be able to verify your identity to our satisfaction.
To submit a request, you should send a communication in writing to support@cantina.security. We will attend to your request in a timely manner within 30 days of receiving your request. If, for any reason, we need to extend this period of time, we will contact you.
Additional Information for Individuals in the EEA and UK
If you are located in the European Economic Area or the United Kingdom, Cantina is the controller of your Personal Information described in this Policy. We process it on the following legal bases:
- Performance of a contract. To provide the Services, manage your account, and pay Security Researchers.
- Legal obligation. To verify identity, collect tax forms, and meet tax, sanctions, and record-keeping requirements.
- Legitimate interests. To secure, monitor, and improve the Services, prevent fraud, and communicate with business contacts, where those interests are not overridden by your rights.
- Consent. For non-essential cookies and marketing communications where required by law. You may withdraw consent at any time.
Subject to applicable law, you have the right to access, correct, delete, restrict, or object to our processing of your Personal Information, and to receive it in a portable format. To exercise these rights, contact us at support@cantina.security. We will respond within 30 days. You also have the right to lodge a complaint with the data protection supervisory authority where you live or work.
International Transfers of Personal Information
Cantina is based in the United States, and we process and store information on servers located in the United States. By accessing or using the Services or otherwise by providing information to us, you consent to the processing, transfer, and storage of your information in and to the United States, where you may not have the same rights as you do under local law. Continually, by using our Services, or by providing any Personal Information to us, where applicable law permits, you consent to the transfer, processing, and storage of such information outside of your country of residence where data protection standards may be different.
Contact Us
If you have any further questions, concerns, comments, or requests, please use the contact information listed below.
Spearbit Labs, Inc. (DBA Cantina Security)
1065 SW 8th St, #2149
Miami, FL 33130
United States