Privacy Policy

Last updated: October 21, 2026

Red Kite Solutions Inc. ("Red Kite", "we", "us" or "our") respects your privacy and is committed to protecting the personal information entrusted to us. This policy explains how we collect, use, communicate, retain and protect personal information when you:

• visit our website at red-kite.io and its sub-pages (the "Website");
• use the Red Kite external attack surface management platform, including any instance we host for a customer (the "Platform");
• request a demo, a free trial or join a waitlist;
• correspond with us by email, phone, at events or on social media.

Together, the Website and the Platform are called the "Services".

This policy is written to comply with the Québec Act respecting the protection of personal information in the private sector (as amended by Law 25), the federal Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's Anti-Spam Legislation (CASL) and, where applicable, U.S. state privacy laws.

"Personal information" means any information about an individual that allows that individual to be identified, directly or indirectly. This includes business contact information, such as your name, title and work email address.

By using the Services, you acknowledge that you have read this policy. Where your consent is required, we will ask for it clearly and separately, and you may withdraw it at any time (see “Your rights” below).

Legal information

Publisher
Red Kite Solutions Inc.
355 Rue Peel, Suite 203
Montréal, Québec H3C 2G9
Canada

Person in charge of the protection of personal information (Privacy Officer)
Simon Lacasse, CEO and Chief Information Security Officer
dpo@red-kite.io

Website hosting
Google Cloud Platform (Firebase Hosting and Cloud Run), operated by Google LLC
Servers located in Montréal, Québec, Canada (region northamerica-northeast1)

Our role

• Website, sales and account administration. When you visit the Website, contact us, become a prospect or customer, or are billed by us, Red Kite decides why and how your personal information is processed. We are responsible for that information under this policy.
• Data inside customer instances. Each customer has its own dedicated Platform instance. The data our customers load into or collect with their instance (for example, the domains, IP addresses, hosts and findings they scan) belongs to the customer. For that data, Red Kite acts as a service provider: we process it only to provide the Platform, on the customer's instructions and under our agreement with them. If your information appears in a customer's instance and you have questions about it, please contact that customer first; we will help them respond.

Information we collect

Information you give us

• Contact, demo and trial requests: name, work email, company, phone number (optional), customer type, your message, and whether you agree to receive follow-up emails.
• Waitlists and surveys: information you enter in forms such as our bounty-hunter beta waitlist (hosted on Google Forms).
• Platform accounts: name, work email address, login credentials, role and permissions, and preferences.
• Billing: billing contact name, email, company name and address, and invoice and payment records. We do not store full payment card numbers.
• Correspondence: the content of emails, calls, meeting notes and support requests you exchange with us.

Information collected automatically

• Website: IP address, browser type and version, operating system, device type, language, referring and exit pages, pages viewed, time and date of visits, approximate location derived from your IP address, and campaign parameters (UTM source, medium and campaign) included in the link you followed.
• Platform: login and activity logs (date, time, IP address, actions performed) used for security, auditing and troubleshooting.
• Anti-spam protection: our forms use Google reCAPTCHA, which collects hardware and software information (such as device and browser data) and sends it to Google to tell humans from bots.

See “Cookies and similar technologies” below for details.

Information from third parties and public sources

To find and contact organizations that may benefit from Red Kite, we may obtain business contact information (name, job title, employer, work email, work phone, professional profile such as LinkedIn) from public sources and from the business data provider Apollo.io. We use this information only to contact professionals about our Services in their professional role, and every message lets you opt out.

Information inside customer instances

To deliver the Platform, a customer's instance stores the assets that customer chooses to monitor and the results of the scans (domains, subdomains, IP addresses, ports, technologies, screenshots, vulnerabilities and similar findings). This technical data can sometimes contain personal information, such as names or email addresses found on exposed assets. Customers are responsible for making sure they are authorized to scan the assets they configure.

How we use your information

We use personal information only for the following purposes:

• to operate, secure and improve the Website;
• to answer your questions and to schedule and deliver demos and free trials;
• to create, host, maintain and support customer instances and user accounts;
• to bill, collect payments and keep accounting records;
• to send you service, security and administrative notices about your account or instance;
• with your consent, or where CASL otherwise allows it, to send you information about Red Kite's products, events and news;
• to identify and contact businesses that may be interested in our Services (B2B prospecting);
• to measure Website traffic and understand which pages and campaigns are useful (only if you accept analytics cookies);
• to detect and prevent fraud, spam, abuse and security incidents;
• to meet our legal obligations and to establish, exercise or defend legal claims.

We will not use your personal information for a new purpose without first obtaining your consent, unless the law allows it.

Consent and legal grounds

We collect personal information with your consent, which may be express (for example, ticking the follow-up email box on a form or accepting analytics cookies) or implied where the law allows it (for example, when you send us an email and expect a reply). We also process personal information when it is necessary to perform a contract with you or your organization, to comply with a legal obligation, or where the law otherwise permits it without consent.

You can refuse or withdraw your consent at any time, subject to legal or contractual restrictions. If you do, we may no longer be able to provide some Services, and we will explain the consequences to you.

Cookies and similar technologies

Cookies are small text files stored on your device. When you first visit the Website, a banner asks for your choice. Only strictly necessary cookies are enabled by default. Analytics cookies are used only if you click "Accept All" or enable them in the cookie preferences.

• Strictly necessary: remember your language and cookie choices, keep the Website secure and protect forms from spam (Google reCAPTCHA). These cannot be turned off without breaking the Website.
• Analytics (optional): Google Analytics and Google Tag Manager measure audience size, traffic sources and how pages are used. Google Analytics may set cookies such as _ga and _ga_*. We do not use advertising or retargeting cookies.

You can change your choice at any time through the cookie banner, delete cookies in your browser settings, or install the Google Analytics opt-out browser add-on.

The Platform uses only the cookies or local storage needed to keep you signed in and secure.

Service providers and where information is processed

We share personal information with the service providers below only as needed for the purposes described. They are bound by contract to protect it and to use it only to provide their services to us.

Google Cloud Platform (Google LLC): hosting
Hosts the Website and runs the customer Platform instances (application servers and file storage).
Information: all Website and Platform data described above.
Location: Website in Montréal, Canada. Customer instances in the Google Cloud region agreed with each customer (for example, Canada or the United States).
Google Privacy Policy

MongoDB Atlas (MongoDB, Inc.): Platform database
Stores and backs up the data of customer Platform instances.
Information: Platform accounts, activity logs and the data in customer instances.
Location: the same region as the customer's instance (for example, Canada or the United States).
MongoDB Privacy Policy

Mailchimp Transactional (Intuit): Platform emails
Sends the Platform's automated emails, such as password resets and notifications.
Information: name, email address, email content, and delivery and engagement data.
Location: United States.
Intuit Privacy Statement

Google Analytics and Google Tag Manager (Google LLC): analytics
Measures Website traffic, if you accept analytics cookies.
Information: cookies, IP address, device and usage data.
Location: United States and other countries where Google operates.
Google Privacy Policy

Google reCAPTCHA (Google LLC): spam protection
Protects our forms from bots.
Information: IP address, device and browser data, interactions with the page.
Location: United States and other countries where Google operates.
Google Privacy Policy and Terms of Service

Google Workspace (Google LLC): email and productivity
Email, documents, calendar and forms (including our waitlist form).
Information: contact information and correspondence, form answers.
Location: United States and other countries where Google operates.
Google Privacy Policy

Close (Elastic Inc.): customer relationship management
Stores and manages our contacts, prospects, customers and sales communications.
Information: name, title, company, work email and phone, communication history, form submissions.
Location: United States.
Close Privacy Policy

Apollo.io (Apollo.io, Inc.): business contact data and outreach
Provides and enriches business contact information and helps us send professional emails.
Information: name, job title, employer, work email and phone, professional profile, email engagement.
Location: United States.
Apollo.io Privacy Policy

QuickBooks (Intuit): invoicing and accounting
Issues invoices, records payments and keeps our books.
Information: billing contact name, email, company name and address, invoice and payment records.
Location: Canada and the United States.
Intuit Privacy Statement

We do not sell or rent personal information, and we do not share it with third parties for their own marketing.

Information processed outside Québec and Canada

Some of our service providers store or process personal information outside Québec, including in the United States. Before communicating personal information outside Québec, we assess whether it will receive adequate protection, considering its sensitivity, the purpose of its use, the safeguards in place and the applicable legal framework, and we put written agreements in place. Information processed in another jurisdiction may be accessible to that jurisdiction's courts, law enforcement and regulators under its laws. You may contact our Privacy Officer for more information.

Other disclosures

We may also communicate personal information:

• to comply with the law, a court order, a subpoena or a valid request from a public authority;
• to protect the rights, property or safety of Red Kite, our customers or others, including to prevent fraud or security incidents;
• to professional advisors (lawyers, accountants, auditors) bound by confidentiality;
• to a buyer, successor or investor, under a confidentiality agreement, as part of a proposed or actual merger, financing, acquisition or sale of all or part of our business, as permitted by law;
• with your consent.

Data retention

Except as otherwise permitted or required by applicable law or regulation, we will only retain your personal information for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Under some circumstances we may anonymize your personal information so that it can no longer be associated with you. However, we never anonymize, aggregate or use the data in customer instances, including to train artificial intelligence models, without the customer's prior written authorization.

Security

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including:

• encryption in transit (TLS 1.2 or higher) for the Website and the Platform, and encryption at rest (AES-256) for customer data and backups;
• a dedicated cloud project, Kubernetes cluster and database for each customer;
• mandatory multi-factor authentication and least-privilege access for our staff;
• automated, encrypted backups, with restoration tested at least once a year;
• an independent penetration test at least once a year, plus continuous vulnerability scanning and patching;
• background checks and annual security awareness training for staff;
• confidentiality obligations for staff and service providers.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your Platform credentials confidential.

Confidentiality incidents

If we have reason to believe that a confidentiality incident involving personal information has occurred, we act promptly to reduce the risk of harm and prevent it from happening again. We keep a register of incidents. If an incident presents a risk of serious injury (or a real risk of significant harm), we notify the Commission d'accès à l'information du Québec and/or the Office of the Privacy Commissioner of Canada, and the affected individuals, as required by law. Where we act as a service provider, we notify the affected customer without undue delay.

Automated decisions and profiling

We do not make decisions about individuals based solely on automated processing of their personal information. The Platform's automated risk scoring applies to technical assets, not to people.

Children

The Services are intended for businesses and professionals. They are not directed to individuals under 16, and we do not knowingly collect their personal information. If you believe we have collected such information, contact us and we will delete it.

Your rights

Subject to the law, you have the right to:

• access the personal information we hold about you and learn how it is used and to whom it has been communicated;
• correct information that is inaccurate, incomplete or ambiguous;
• withdraw your consent to a use or communication of your information;
• ask for deletion, or ask that we stop distributing your information or de-index any hyperlink attached to your name, where the law allows;
• data portability: receive personal information you provided to us in a structured, commonly used technological format, or have it sent to another organization;
• opt out of marketing at any time by clicking the unsubscribe link in our emails or writing to us;
• file a complaint with a privacy regulator.

To exercise a right, write to our Privacy Officer at dpo@red-kite.io. We may ask you to confirm your identity before acting on your request. We respond in writing within 30 days. Access and correction are free; we may charge a reasonable fee for transcribing, reproducing or sending information, and we will tell you in advance. If we refuse a request, we will explain why and tell you how to challenge the decision.

If your request concerns data inside a customer's instance, we will forward it to that customer and help them respond.

If you are not satisfied with our response, you may contact:

• the Commission d'accès à l'information du Québec if you are in Québec;
• the Office of the Privacy Commissioner of Canada elsewhere in Canada.

Information for U.S. residents

We do not sell personal information and we do not share it for cross-context behavioural advertising. Depending on the state you live in, you may have rights to know, access, correct, delete or obtain a copy of your personal information, and to appeal our decision. We honour these requests as described in “Your rights” above, and we will not discriminate against you for exercising them.

Links to other websites

The Website links to third-party sites and services such as GitHub, LinkedIn and our documentation. Their privacy practices are governed by their own policies, and we are not responsible for them. Contributions to our open-source project on GitHub are public and governed by GitHub's terms.

Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows when it was last changed. If we make significant changes, we will post a notice on the Website and, where appropriate, notify customers by email before the changes take effect.

Contact us

For any question, request or complaint about this policy or how we handle personal information, contact:

Simon Lacasse, Privacy Officer
Red Kite Solutions Inc.
355 Rue Peel, Suite 203
Montréal, Québec H3C 2G9, Canada
dpo@red-kite.io