Privacy policy

RouteSpear helps businesses and individuals monitor networks, applications, and infrastructure. This policy explains how personal information is collected, used, disclosed, and retained when you visit our website, contact us, or use RouteSpear Cloud, our agents, APIs, and related services. Personal information means information that identifies, relates to, or can reasonably be linked to a person, including where applicable a household.

1. Scope and responsibility

RouteSpear Inc., doing business as RouteSpear ("RouteSpear," "we," "us," or "our"), is responsible for the processing described here. Our business mailing address is [Business mailing address to be confirmed]. Contact us at privacy@routespear.com.

We act as a controller when deciding how to use website, business-contact, account-administration, billing, and service-security information for our own purposes. For monitoring data and other content processed on a customer's instructions ("Customer Data"), we generally act as a processor or service provider. The customer determines the monitoring purpose, configuration, permissions, and lawful basis. If the customer is itself a processor, we may act as its subprocessor.

Our customer agreement and any applicable data processing agreement ("DPA") govern that processing. This policy does not replace a DPA or the customer's own privacy notice. If your employer or another organization supplies your account, contact it about its monitoring and administration practices. Third-party services have their own privacy notices.

If you use a personal account, you can contact us directly about your information and requests; you do not need to go through an employer. We are the controller for your account, billing, service-security, and other processing whose purposes and means we determine. Our role for monitoring content depends on the processing and applicable law. These descriptions do not impose statutory controller duties on you where the law exempts purely personal or household activity, or reduce our own obligations. You must still respect other people's privacy and have the right to monitor their systems or information.

In a self-hosted deployment, the customer operates the databases and infrastructure. We receive data through connections or interactions that send it to us, such as support requests or use of our hosted services. Self-hosting does not prevent an enabled email, AI, webhook, or other external integration from receiving data.

2. Information we collect

Account, organization, and commercial information

This includes names, email addresses, account and organization identifiers, roles, memberships, preferences, authentication records, and information supplied by an identity provider when you sign in. We process credentials or credential verification material as needed for authentication, including password hashes, session records, and API or integration credentials. Billing information can include company and billing contacts, addresses, tax information, orders, invoices, payment status, usage totals, and transaction references. Payment services, where enabled, may collect payment details directly under their own notices.

Inquiries, support, and collaboration

When you submit a demo or contact form, we receive the fields you complete, your message, submission time, IP address, browser user agent, and referring page. We also process support correspondence and files or diagnostic information you choose to provide. Collaboration content can include incident messages, findings, shared assistant answers, panel definitions, participant names, invitations, guest-access records, and activity timestamps.

Monitoring configuration and measurements

Depending on the checks and capabilities you enable, Customer Data may include:

• IP and hardware addresses, hostnames, domains, URLs, network routes, DNS answers, ports, protocol details, certificates, provider and autonomous-system metadata, and inferred network locations.
• Agent and machine identifiers, operating-system and software details, hardware or interface inventory, process and service information, device labels, and resource-usage metrics.
• Test definitions, schedules, request headers and bodies you configure, scripts, assertions, credential references, and the results, errors, response details, and custom output produced by those tests.
• Latency, loss, availability, timing, health, and confidence information, with timestamps and the source, destination, worker, account, and measurement context needed to interpret it.
• Browser-test URLs, resource and performance details, console or error messages, walkthrough results, and screenshots when enabled.
• Real user browser sessions where you or your organization enables the endpoint connector: visits to configured domains, page and resource URLs, session identifiers, and navigation and resource timings. Stored URLs retain paths while removing credentials, query strings, and fragments. This collector does not collect page text, form values, cookies, request or response bodies, or screenshots; synthetic browser checks are a separate feature.
• Passive network-flow metadata where enabled, including local and remote addresses, ports, connection and byte counts, TCP behavior, and associated local process or interface information. This describes observed host connections rather than synthetic probes.
• Configured log excerpts and event records, extracted metrics, alert evidence, and incident history. Log sources and redaction rules determine what is selected for collection.
• Infrastructure descriptions, maps, floor plans, locations, annotations, and other files or content you submit through available features.

Network path probes do not provide a general recording of users' network traffic. However, application checks, browser captures, logs, scripts, and customer-supplied configuration can contain application content and personal information. Screenshots and redaction rules cannot guarantee that every secret or identifier is removed. Use dedicated monitoring accounts and collect only what you need; do not put secrets in URLs, scripts, messages, or free-text labels.

Support diagnostics can include selected portal activity, device or session details, and a screenshot you choose to capture and attach. Review the preview before submitting. Diagnostics are optional; a support ticket still identifies its submitting user when identity diagnostics are not selected.

Usage, diagnostics, and security

We process connection and request metadata, IP addresses, browser or device information, timestamps, session and authentication events, audit records, errors, agent health, feature usage, quota events, and ingestion accounting. Exact record identifiers and usage receipts may be retained separately from measurement content to prevent duplicate accounting and resolve billing or delivery disputes. These identifiers may remain linkable to an account.

Sensitive information

We do not ask for government identity numbers, health records, biometric identifiers, or other sensitive personal content as part of ordinary monitoring. Credentials and some captured content or precise location information may nevertheless be sensitive under applicable law. Do not submit regulated or highly sensitive content unless its processing is expressly covered by your agreement and appropriate safeguards. A network location estimate does not necessarily identify a person's physical location.

3. Where information comes from

Information comes directly from you; from your organization's administrators and other authorized users; from agents, configured test destinations, devices, and integrations; and automatically from interactions with our services. We may also receive it from identity, hosting, email, and payment providers involved in those interactions, and from public or licensed network-reference sources used to enrich measurements. We do not assume that an address or hostname is anonymous merely because it is publicly reachable.

4. How and why we use information

• Provide the service: create accounts, authenticate users and agents, run configured checks, ingest and display results, enable collaboration and integrations, deliver alerts, and provide support.
• Administer our relationship: answer inquiries, arrange demonstrations, manage orders and usage, issue invoices, and send account, security, or service notices.
• Protect and maintain the service: detect abuse, enforce permissions and quotas, prevent duplicate accounting, investigate failures, plan capacity, and improve reliability and usability.
• Meet legal responsibilities: maintain required records, respond to lawful requests, resolve disputes, and establish or defend legal claims.
• Communicate with permission: send optional product or marketing communications where you have requested them or the law otherwise permits, with a way to opt out. Sending a contact form does not itself subscribe you to a marketing list.

Where a law requires a lawful basis for our controller activities, we rely on performance of a contract with you or steps you request before entering one; legitimate interests in operating a secure business, supporting organizational customers, and preventing abuse; legal obligations; or consent where required. When you represent an organization, administration of that business relationship generally relies on legitimate interests rather than a contract with you personally. We consider the impact on individuals when relying on legitimate interests.

Providing account and technical information necessary to deliver the service is a contractual requirement; without it, the relevant feature may not work. Optional fields and communications are your choice. Where we rely on consent, you may withdraw it without affecting earlier lawful processing. We do not use Customer Data for unrelated advertising. Any use of de-identified statistics must prevent reasonable identification; account IDs and hashed identifiers alone do not make data anonymous.

5. Cookies and browser storage

The public website does not currently use advertising cookies or third-party behavioral analytics. It uses local browser storage for choices such as theme and installation platform. Where a pricing workflow prepares an inquiry, session storage may hold its draft until it is used or the browser session ends. Submitting a form sends the fields you submit to us.

The signed-in portal uses session cookies to maintain authentication and browser storage to remember interface preferences and view state. Identity providers and integrations may use their own cookies when you interact with them. Necessary cookies support functions you request; we will obtain consent for nonessential technologies where required before introducing them.

You can clear or block storage through your browser. Blocking session cookies can prevent sign-in; clearing local storage resets saved preferences. We do not conduct cross-site advertising tracking, so a browser's Do Not Track signal does not change that practice. See the US state disclosures below for Global Privacy Control.

6. AI and connected services

If you or your organization enables Spear Assistant, the configured model provider receives information needed to respond. This can include your prompts, conversation history or summaries, selected page context, unsaved editor content, relevant configuration, tool results, measurements, and images supplied to the feature. Responses, tool activity, and approval records may be saved with the conversation. A smaller model context does not delete the saved conversation.

You or your account's authorized administrators choose the model provider and endpoint. A customer-selected provider's retention, model-training, and regional processing practices depend on that provider and the customer's arrangement with it. Review those settings before sending confidential information. RouteSpear does not use Customer Data to train a general-purpose AI model; this commitment does not override the terms of a service you independently connect.

When public web research is enabled, public-topic queries are sent to Brave Search, and relevant public pages may be retrieved. This feature is designed to exclude private conversation history, page snapshots, and internal tool evidence from the research task. Filtering is not a guarantee that private information can never appear in a query; do not request searches containing secrets or personal information.

An external MCP client or other integration can receive data permitted by its token and your permissions. Disconnecting or revoking access prevents further authorized access but does not erase copies already delivered to that service. AI assistance is intended for operational investigation, not solely automated decisions about people with legal or similarly significant effects. We do not use it for those decisions about you.

7. Who can receive information

• Authorized users and recipients you select. Your organization's permissions govern access to account resources. Incident invitations and explicit publication can disclose selected content to external guests. Recipients may retain copies after access is revoked. Private assistant conversations are not automatically published to an incident room.
• People operating and supporting RouteSpear. Authorized personnel may access information for support, maintenance, security, and other purposes described here, subject to appropriate access restrictions and confidentiality obligations.
• Service providers. Infrastructure, database, storage, backup, email, support, and payment providers may process the information needed for their functions. Our website's email delivery uses Resend. Providers acting on our instructions are subject to appropriate processing and confidentiality terms; a provider may also have independent legal obligations.
• Customer-connected providers. Identity services, model providers, MCP clients, notification endpoints, and other integrations receive the information involved in the features you enable, as explained above.
• Professional advisers and legal recipients. We may disclose information to advisers, authorities, or other parties where reasonably necessary to comply with law, protect rights and safety, investigate abuse, or handle a dispute. We assess requests and disclose only what is appropriate in the circumstances.
• A business successor. Information may be transferred in a financing, merger, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality and data-protection safeguards. We will give notice where required.

Public-agent measurements: an eligible measurement execution on shared public infrastructure may serve multiple authorized customers. Each customer's access remains tied to its authorized subscription and measurement window. This does not make your account, credentials, private-agent telemetry, or test configuration publicly accessible. Private agent access across accounts requires an explicit grant where supported; organization membership alone does not grant it. Sharing an observation is different from selling personal information or sharing it for advertising.

We do not sell personal information or share it for cross-context behavioral advertising, and we do not allow service providers to use Customer Data for their own advertising. Contact us for the providers and processing locations applicable to your hosted service and for any DPA subprocessor information. Supported integrations are not all active subprocessors for every customer.

8. Retention and deletion

We retain information for the purposes described here, subject to the applicable agreement, configured retention, and law. The relevant criteria include the type and sensitivity of data, whether an account or inquiry remains active, security and dispute needs, and legal recordkeeping obligations. Different stores expire independently; removing a test or losing access to a result does not necessarily erase every stored copy.

• Measurements and captured content: the applicable service configuration and agreed retention determine availability of raw results, summaries, browser captures, and log evidence. Retention can differ by data type. Stopping collection does not retroactively delete existing results.
• Conversations and collaboration: saved messages, shared findings, and incident records follow their applicable lifecycle. A published copy can outlive its source conversation. Deleting the source or revoking a guest link does not recall exports or copies held by recipients.
• Accounts, inquiries, and support: retained while needed to maintain the relationship, resolve the matter, and meet relevant recordkeeping or claim requirements; unnecessary information is deleted or de-identified.
• Security, financial, and usage-integrity records: may be retained beyond measurement retention for fraud prevention, exact duplicate detection, accounting, compliance, and disputes. The exact-identifier archive has no automatic expiry in the current software; customer deletion requires a separate review of those records and applicable retention grounds.
• Backups and recovery copies: can remain until their separate retention or recovery periods end. Access is restricted, and deletion instructions must be reapplied when data is restored to active service. A legal hold may delay deletion of relevant information.

To request account closure, an export, or deletion, contact your administrator or us. We will explain the applicable process and any information that must be retained. The customer agreement or DPA governs return and deletion of Customer Data. Do not rely on a universal 30-day deletion or recovery period: an export window, backup expiry, and deletion schedule must be established for the relevant deployment. Self-hosted customers manage their own retention and backups.

9. Locations and international transfers

Account placement, agent execution, support access, backups, and external integrations can involve different locations. A measurement region identifies where the relevant account's measurement service is placed; it is not by itself a promise that all account information, recovery copies, or provider processing stays there. Public agents may execute tests from other countries. Region restrictions must be expressly included in your agreement.

Where personal information is transferred internationally and applicable law requires a safeguard, the relevant arrangement must provide one, such as an adequacy decision or approved contractual clauses with any required supplementary measures. UK transfers may require the applicable UK instrument. We do not claim certification under a transfer framework merely by mentioning it. Contact us for the locations and safeguards that actually apply to your service and how to obtain a copy, subject to lawful redactions.

10. Security

We use technical and organizational safeguards intended to protect information, including authentication, scoped permissions, tenant access checks, agent credentials, and security logging. Transport, storage, backup, and credential protections also depend on deployment configuration. No system or transmission method is completely secure. Keep credentials private, limit access, review captures, and report suspected compromise promptly to security@routespear.com.

We investigate security incidents and provide notifications required by applicable law and our agreements. The security page explains product safeguards and vulnerability reporting; descriptions of controls are not a claim of independent certification.

11. Your choices and privacy rights

You can update available profile settings, ask your organization to change access or monitoring settings, manage connected services, clear browser storage, and opt out of optional marketing messages. Necessary account, billing, and security notices may still be sent.

Depending on your location and the law that applies, you may request access to or a copy of personal information, correction, deletion, restriction, or a portable copy; object to certain processing, including direct marketing; or withdraw consent. These rights have legal conditions and exceptions, including protection of other people's information and required records.

Send requests to privacy@routespear.com or use our contact form. Describe your relationship with RouteSpear and the right you want to exercise. We may verify your identity and authority using proportionate information; please do not send passwords or unnecessary identity documents. An authorized agent may act for you where permitted, with appropriate evidence of authorization.

We respond within the period required by the applicable law and explain any lawful extension or refusal. Requests are generally free unless a legally permitted exception applies. For data we process for an organization, we will refer the request to that organization or assist it under our agreement. Removing your login may not remove records that the organization controls.

You may complain to the data protection authority in your place of residence or work, or where an alleged infringement occurred, where that right applies. You do not have to contact us first. For more information, see the EEA supervisory authorities or the UK Information Commissioner's Office.

12. Additional US state privacy disclosures

Where a US state privacy law applies to our processing of your information, rights may include knowing or confirming what we process, access, correction, deletion, portability, and opting out of sale, targeted advertising, or certain consequential profiling. We will not unlawfully discriminate against you for exercising a privacy right. You may appeal a denied request by emailing our privacy address with "Privacy appeal" and the request reference; we will explain our decision and any further complaint route required by your state's law.

For California residents, the categories described above include identifiers; customer-record and commercial information; internet or electronic-network activity; geolocation information; professional information; and visual, electronic, or other content in customer submissions. Credentials and customer-submitted content may include sensitive personal information. The sources, purposes, recipient categories, and retention criteria for each are described in sections 2–9. Collection and disclosure depend on the features used; we do not claim to collect every category about every person.

We do not sell or share personal information for cross-context behavioral advertising, use sensitive information to infer characteristics about you, or perform profiling for decisions with legal or similarly significant effects about you. A Global Privacy Control or other legally recognized opt-out signal does not require a change to those practices. If those practices change, we will provide the required notice and opt-out mechanisms, including recognition of required signals, before the change.

California requests may include the categories and specific pieces collected, their sources, business purposes, and categories of recipients, as well as correction and deletion subject to exceptions. Use the request methods above; an account is not required. Applicable laws determine response deadlines, identity verification, and whether a particular right applies. This section does not assert that every state law applies to RouteSpear or every customer.

13. Children

RouteSpear is intended for business and personal use by adults and is not directed to children under 18. We do not knowingly collect children's personal information for our own purposes. If you believe a child has provided it, contact us so we can investigate and take appropriate action. Customers must not use the service to collect children's data without the necessary legal authority and an agreement covering that use.

14. Changes to this policy

We may revise this policy to reflect changes in the service, our practices, or law. We will update the revision and effective dates and provide appropriate notice of material changes, such as an account notice or email, before they take effect where required. We will obtain consent when the law requires it; continued use does not replace legally required consent.

15. Contact us

Privacy questions and requests: privacy@routespear.com. You may also use the contact form or write to RouteSpear Inc., [Business mailing address to be confirmed]. Please include enough information for us to locate the relevant account or interaction.