Privacy Policy

Last updated: 29/04/2026

Introduction

Sandfly Security ("we", "us", "our") provides agentless Linux security and intrusion detection products and related subscription services. We respect your privacy and are committed to handling your personal information responsibly.

This policy describes how we collect, use, disclose, and protect your personal information when you visit our website at https://sandflysecurity.com, purchase or subscribe to our products, or otherwise interact with us.

Sandfly Security complies with the New Zealand Privacy Act 2020 (the Act) when working with personal information. Personal information is information about an identifiable individual (a natural person).

This policy does not limit or exclude any of your rights under the Act. For further information on the Act, visit www.privacy.org.nz.

Changes to this policy

We may update this policy from time to time by posting a revised version on our website. Changes apply from the date the revised policy is posted. Where changes are material, we will take reasonable steps to notify you, for example by email to the address associated with your account or licence.

Information we collect

We collect personal information from you directly wherever practicable. This includes information you provide when you:

• Visit our website or interact with us by email, phone, or our support channels
• Register for an account, trial, or evaluation
• Purchase a licence, subscription, or other product
• Subscribe to our newsletter or marketing communications
• Contact our support team or post on a community forum we host
• Respond to surveys or research requests

We may also receive information from third parties where you have authorised this or where the information is publicly available (for example, business contact information, fraud-prevention data, or payment confirmations from our payment processors).

The categories of personal information we collect include:

• Identity and contact information: name, email address, postal address, phone number, employer, job title
• Account and licence information: username, password (hashed), licence keys, activation records, subscription status, renewal dates, entitlements
• Billing and payment information: billing address, tax/VAT identifier where applicable, transaction history, the last four digits of your card and card type. Full payment card numbers are processed directly by our payment processors and are not stored on our systems.
• Product and service usage data: information generated by your use of our products and services such as licence-server check-ins, version information, and operational telemetry necessary to deliver and support the service. This data does not include the contents of files or systems scanned by our software on your infrastructure.
• Support and communications data: records of correspondence, support tickets, and forum posts
• Website and technical data: IP address, browser type, device information, referring page, pages visited, and similar information collected through cookies and analytics tools
• Marketing preferences: your opt-in status and preferences for receiving marketing communications

How we use your personal information

We use your personal information for the following purposes:

To provide our products and services to you, including verifying your identity, creating and managing your account, issuing and validating licences, delivering subscription services, providing technical support, and hosting community forums.

To process transactions, including billing you, collecting amounts owed, processing payments through our payment processors, issuing refunds, calculating tax, and maintaining records required by tax and accounting laws.

To send service and transactional communications related to your licence or subscription. These include licence activation and renewal notices, billing and receipt notifications, expiry warnings, security advisories that affect a product you have licensed, and other communications necessary to deliver the service. Because these communications are necessary to provide the service you have purchased, you cannot opt out of them while you hold an active licence or subscription, although we keep them to the minimum reasonably required.

To send marketing communications, including product update announcements, newsletters, and information about new features or related products. We will only send marketing communications to you if you have opted in by ticking the relevant checkbox during signup or otherwise affirmatively subscribing. Every marketing email contains an unsubscribe link, and you can change your preferences at any time by contacting us at the address below. Unsubscribing from marketing emails does not stop service and transactional communications.

To improve our products and services, including analysing usage patterns, conducting research, and producing aggregated or anonymised statistics. Anonymised data is not personal information and may be used and shared without restriction.

To moderate content you post in forums or other community spaces we host.

To undertake credit checks, where necessary and with your prior consent.

To protect and enforce our legal rights and interests, including detecting and preventing fraud, abuse, and security incidents, defending claims, and complying with legal obligations.

For any other purpose authorised by you or by the Act.

How we share your personal information

We do not sell your personal information. We share it only as described below.

• Service providers that support our business: including hosting providers, IT and infrastructure providers, payment processors, email and CRM platforms, analytics providers, and customer support tools. These providers process personal information on our behalf under contractual obligations to keep it confidential and secure.
• Other companies within our corporate group, where applicable, for the purposes described in this policy.
• Credit reference agencies, where credit checks are necessary, with your prior consent.
• Professional advisors such as auditors, lawyers, and accountants, under duties of confidentiality.
• A person or organisation who can legally require us to supply your personal information, such as a regulatory or law-enforcement agency, or where authorised by the Act or another law.
• Successors in a corporate transaction, such as a merger, acquisition, or sale of assets, subject to appropriate confidentiality protections.
• Other third parties for anonymised statistical information.
• Anyone else you have authorised.

Some of our service providers are located outside New Zealand. This means your personal information may be stored and processed outside New Zealand. We take reasonable steps to ensure these providers are required to protect your personal information to a standard comparable to that required under the Act.

How long we keep your personal information

We retain personal information only for as long as necessary for the purposes described in this policy, including to satisfy legal, accounting, or reporting requirements. Indicative retention periods are:

• Account and licence records: for the duration of your relationship with us and for a reasonable period afterwards to handle renewals, support queries, and disputes
• Billing and transaction records: for at least seven years where required by tax and accounting laws
• Marketing records: until you unsubscribe or withdraw consent, plus a short period to action your request and maintain a suppression list
• Support correspondence: typically up to three years after the matter is closed
• Website analytics and logs: typically up to 24 months

When we no longer need personal information, we securely delete or anonymise it.

Protecting your personal information

We take reasonable technical and organisational steps to keep your personal information safe from loss, unauthorised access, use, modification, or disclosure. These measures include encryption of data in transit, access controls and authentication for our internal systems, and ongoing monitoring of our infrastructure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Accessing and correcting your personal information

Subject to certain grounds for refusal set out in the Act, you have the right to access your readily retrievable personal information that we hold and to request correction of that information. Before we action a request, we will need evidence to confirm that you are the individual to whom the personal information relates.

If we agree that a correction is reasonable and we are reasonably able to make it, we will make the correction. If we do not make the correction, we will take reasonable steps to notify you of the outcome of your request.

To exercise either of these rights, email us at privacy@sandflysecurity.com. Your email should provide evidence of who you are and set out the details of your request (for example, the personal information you want to access, or the correction you are requesting).

We may, at our discretion, charge our reasonable costs of providing copies of your personal information or making corrections.

If you are not satisfied with how we have handled your personal information or your request, you may make a complaint to the Office of the Privacy Commissioner (www.privacy.org.nz).

Internet use

While we take reasonable steps to maintain secure connections, transmission of information over the internet is at your own risk. If you post personal information on a public part of our website, such as a support forum, you acknowledge and agree that the information is publicly available.

If you follow a link from our website to a third-party site, that site is governed by its own privacy policy. We encourage you to review it before providing personal information.

Cookies

We use cookies and similar technologies on our website to recognise your browser, remember your preferences, understand how the site is used, and support essential functions such as the shopping cart and checkout. We use the following categories of cookies:

• Strictly necessary cookies: required for the site to function, including authentication, cart, and checkout
• Analytics cookies: help us understand how the site is used so we can improve it
• Marketing cookies: used to deliver relevant content and measure the effectiveness of our communications

You can disable cookies by changing your browser settings, although some features of the site may not work correctly as a result.

Contact us

If you have any questions about this policy, our privacy practices, or if you would like to request access to or correction of your personal information, please contact us:

Email: privacy@sandflysecurity.com