Privacy policy

Scope

This policy explains how Witen Labs LLC handles information when you visit witenlabs.com, create a Witen account, use the hosted service, or connect Witen software such as the WordPress plugin or Warden. A website operator using Witen remains responsible for that operator's own privacy notices and legal obligations to its visitors and users.

Information we collect

• Account information: email address, name if supplied, authentication records, session records, plan, and account settings.
• Billing information: subscription and transaction identifiers. Payment-card details are handled by our payment processor rather than stored by Witen.
• Security telemetry: source IP addresses, event time and category, login outcome and sometimes username, request path and method, response status, user agent, referrer, query information, detection evidence, enforcement outcome, sensor identity, hostname, software version, and service-health signals. The exact fields depend on the connected software and event.
• Files you deliberately submit: malware samples or backup content only when you enable and use the relevant feature. Malware sample submission is not automatic.
• Website and operational data: IP address, browser and device information, request time, error records, and email-delivery status needed to operate and secure the service. We do not currently use advertising trackers.

Optional website analytics and ad measurement

Separately from analytics, the website asks whether we may remember how you found Witen. If you choose “Remember how I found Witen”, we keep your first eligible public page, the domain of the site that sent you, and any campaign labels in this browser for up to 30 days, and save them with your account if you sign up then. We use them only to understand which posts and links bring people to Witen. The legal basis is your consent, which is optional, is asked for apart from analytics, and does not depend on your analytics choice. So that we can show you agreed, we save the time you said yes and the version of the question you saw. Nothing in this record is sent to Google, and it never includes full URLs, IP addresses, browser identifiers, or advertising click identifiers. You can withdraw at any time through “Analytics preferences”, which clears the browser record and stops future collection; a Global Privacy Control or Do Not Track signal does the same. A record already saved with your account stays while the account exists and is deleted with it; to have it removed sooner, email privacy@witenlabs.com from the address on your account. The optional “How did you hear about us?” answer on the registration form is saved with your account only when you choose to give one.

Our internal content reports use existing website access logs to count requests to public pages and blog posts by referral domain and campaign labels (utm_source, utm_medium and utm_campaign). These reports omit full referrer URLs, other query values, cookies and authentication headers. Campaign labels should describe a campaign, not identify an individual. This reporting does not add browser cookies or send log data to Google.

We use Google Analytics to understand visits to public website and documentation pages. For visits identified as coming from the United States, analytics is on by default unless you turn it off or your browser sends Global Privacy Control or Do Not Track. For other locations, or when we cannot determine the country, the Google tag loads only after you allow analytics. An existing decline takes precedence over the regional default. You can turn analytics off through “Analytics preferences” on any public page.

We estimate the country from your IP address on our server using a locally stored database. We do not send your IP address to a separate geolocation service for this lookup. Location data is approximate, and a VPN can affect the result. This site uses IP geolocation by DB-IP, licensed under CC BY 4.0.

When enabled, Google Analytics uses cookies and receives page-view information, browser and device information, and the network information needed to process the request. We omit URL query strings, fragments, and referrer URLs from our page-view events. We do not send account or admin page views, account identifiers, or security telemetry to Google Analytics. Global Privacy Control and Do Not Track turn analytics off even if you previously allowed it.

The same choice covers Google Ads conversion measurement. When you arrive from one of our Google ads, Google's tag reads the ad-click identifier Google added to the link and keeps it in a first-party cookie. If you then click to install the WordPress plugin, download Warden, start a signup, or choose a paid plan, we report that action to Google so we can tell which ads work. Google processes this as our service provider under restricted data processing. We do not build remarketing audiences, Google signals are off, and ad personalization is disabled. No Google script runs on sign-in, registration, or account pages.

Analytics and ad-measurement cookies have a 60-day lifetime, and your choice is remembered in this browser for up to 180 days. Use “Analytics preferences” on a public page to change your choice. Declining stops measurement and removes the analytics and ad-measurement cookies set by this integration. Essential authentication and security storage is unaffected. See Google's privacy policy for how Google handles information.

Public IP reputation lookups

When public lookup is enabled, we use the submitted IP address to read aggregate observation summaries from the Witen network, the address's daily reputation tier, and any separately attributed third-party context. Results never include customer identities, raw records, paths, or sensor details, and a customer's allowlisted addresses are not published from that customer's data. We do not scan the address. We keep bounded lookup results in memory for up to 30 seconds and may keep a private lookup-interest signal for up to one hour, with expired memory cleaned within another minute. Interest never affects reputation scores or protection decisions.

To limit automated extraction, we use your connection address to derive an opaque rate-limit identifier. Shared counters expire within 24 hours. The lookup application does not store submitted addresses in ordinary logs, browser history or website analytics. Hosting and security infrastructure may retain connection metadata under the operational practices described in this policy.

IP addresses that appear in lookup results

An IP address can be personal data, so this section is for the people whose addresses show up in our public lookup, not just the people who run it.

• What we publish: the address, the kinds of hostile activity the Witen network saw from it (such as failed logins, exploit attempts, and probing), count ranges, the first and last UTC day it was seen, its highest reputation tier on each day, and whether separate third-party blocklists include it. We never publish names, customer identities, sensor details, raw logs, request contents, or usernames.
• Where it comes from: security events reported by the sites and servers Witen protects, including our own, and public blocklists published by the third parties named in each result.
• Why, and our legal basis: to help people defend their networks and systems by deciding what to block or investigate. We rely on our legitimate interest, and that of the people defending their systems, in network and information security.
• Who can see it: anyone who uses the lookup on witenlabs.com, and anyone who uses an AI assistant connected to it, including Witen in ChatGPT. Results we return to ChatGPT are then handled by OpenAI under its own terms.
• How long: results cover only the last 30 days. Older activity drops out of public results automatically. The underlying security records follow the retention rules below.
• Your controls: to object, correct a result, or ask us to stop publishing an address you use, email privacy@witenlabs.com with the address and the date you checked it. When an objection is valid, we stop showing the address in public lookups, including through ChatGPT. We may ask for enough detail to confirm the address is yours, and we will tell you what we did.

Using Witen in ChatGPT

When you ask ChatGPT to check an address with Witen, we use only the IP address you asked about. ChatGPT may include routine request details, such as a locale or an anonymous identifier; we ignore them and do not log them. We never receive your conversation, and we do not receive your name or OpenAI account details. The lookup is otherwise handled exactly like a lookup on our website, as described above. Your conversation is governed by OpenAI's privacy policy and terms.

How we use information

We use information to authenticate users and sensors; provide dashboards, detection, correlation, backups, and enforcement features; identify coordinated attacks; maintain service reliability; prevent abuse; provide support; process subscriptions; satisfy legal obligations; and improve Witen's security decisions.

Login-success signals remain security evidence. They can reveal a compromise when the same address previously attacked another owned sensor, so Witen does not discard them merely because an address is locally trusted or excluded from banning.

Shared threat intelligence

Witen may use observations from participating sensors to produce shared security intelligence, including hostile IP reputation, classifications, confidence, and timing. Shared output is designed to omit the contributing customer, account, sensor, hostname, username, raw log line, and request content. Customer-specific controls, allowlists, login successes, and policy-only blocks are not published as evidence that an address is globally malicious.

We do not sell personal information or use it for cross-context behavioral advertising.

Service providers and disclosure

We disclose information to infrastructure, database, email-delivery, and payment providers only as needed to operate Witen. We may also disclose information when required by law, to protect users or the service, or in connection with a corporate transaction subject to appropriate safeguards. We do not give service providers permission to use Witen customer data for their own advertising.

Retention and deletion

Security history is a core part of the product. While an account is active, we retain useful account and security history rather than applying a blanket 180-day deletion rule. We may bound or aggregate high-volume technical records when the detailed form no longer adds security value. Session, delivery, and diagnostic records are kept for shorter operational periods.

When we complete an account-deletion request, we revoke further sensor ingestion and remove tenant-attributed records from the account database, event store, analytics store, derived customer pivots and statistics, credentials, configurations, submitted backups, and event archives. Rotating production backups are kept in seven daily and four weekly generations and normally expire within 35 days. A separate deletion tombstone is reapplied before any restored backup can return to service.

We may retain records required for legal obligations, fraud prevention, security, or legal claims. We may also retain threat intelligence that has been stripped of customer and account linkage as described above. We will explain an applicable exception when the law permits us to do so.

Your choices and privacy rights

Depending on where you live, you may have rights to know or access information, correct it, delete it, receive a portable copy, object to or restrict processing, or appeal a decision. You may also have the right not to receive discriminatory treatment for exercising a privacy right. We verify requests before acting to protect the account and security data.

To make an access, correction, export, or deletion request, email privacy@witenlabs.com with the subject “Privacy request.”

Security and international use

We use access controls, encryption in transit, scoped credentials, auditing, and tested backup procedures intended to protect Witen data. No system can guarantee absolute security. Witen is operated from the United States, and information may be processed in the United States or other places where our service providers operate.

Children and policy changes

Witen is a business security service and is not directed to children. We may update this policy as the product, providers, or legal requirements change. We will change the date above and provide additional notice when a change materially affects how we handle information.