Privacy Statement

This Privacy Statement is issued by Secontinuum Private Limited, a company incorporated under the laws of India with its registered office at B-1204, Block B, 12th Floor, Aparna Cyberlife, Lingampalli, Serilingampally, K.V. Rangareddy, Telangana, India – 500019 (“Secontinuum”, “we”, “us”). Vynnn is a product of Secontinuum.

This statement covers two surfaces, and we describe them separately where they differ:

• Our public websites — www.secontinuum.com and vynnn.com — and the people who visit them or contact us through them.
• The Vynnn service — our multi-tenant, cloud-hosted SIEM and SOC automation platform — and the customers and users who use it.

For all privacy matters, contact contact@secontinuum.com. Dedicated privacy and legal addresses may be introduced later.

We act in two different capacities, and your rights route differently depending on which applies:

• Controller of Account Data. We decide how and why we process data about website visitors, sign-ups, billing, and support. For this data, come to us directly.
• Processor of Customer Data. Security telemetry inside a Tenant belongs to the customer, who decides what to collect and how long to keep it. We process it to provide the Service, on the customer’s instructions. For this data, the customer (for example, your employer) is usually the right first point of contact, and we assist them in responding.

A Data Processing Agreement (DPA) reflecting these roles is available on request at contact@secontinuum.com.

• Website visitors and people who contact us (for example through the demo request form);
• Trial and account users — the people who sign up for or administer a Tenant;
• Customer security analysts and other Users working inside a Tenant;
• Customer end-users whose activity appears in ingested logs — employees, contractors, and, at times, attackers whose actions are recorded in security telemetry;
• Vendor and partner contacts.

Where GDPR or similar laws apply, we rely on:

• Contract — providing the Service and website features you request;
• Legitimate interests — securing our Service and customers, preventing fraud and abuse, and keeping the product reliable;
• Consent — where required, for example for non-essential cookies or optional marketing communications;
• Legal obligation — accounting, tax, and responses to lawful requests.

For residents of California and similar US states: we do not sell personal information, and we do not share it for cross-context behavioral advertising. The categories we collect are described in Section 4; rights and how to exercise them are in Section 13. As an Indian company, we also have regard to India’s Digital Personal Data Protection Act, 2023, as it applies.

• Directly from you — forms, sign-up, support requests;
• From your employer or Tenant administrator, who creates and manages accounts;
• From systems the customer connects — cloud accounts, identity providers, endpoints, and forwarders the customer authorizes;
• From security telemetry the customer sends to the Service;
• From our Subprocessors’ operational logs generated while providing the Service.

Vynnn’s SOC agents use a third-party AI model provider to verify detections, investigate incidents, recommend remediation, and support onboarding tasks such as identifying personal data present in logs. This means relevant Customer Data — telemetry excerpts, detections, and analyst context — can be sent to that provider as a Subprocessor, and that content may include personal data the customer ingested.

We do not use Customer Data — security logs, telemetry, detections, or investigation content — to train AI models. We may use operational data about our own agents’ behavior (actions taken, playbook outcomes, performance and feedback signals) to improve the Service.

We share personal data only as needed to run the Service and our business:

• Our cloud hosting provider — hosting and storage, primary region in the EU (Stockholm);
• Our AI model provider — AI processing as described in Section 7;
• Other service providers that support our business, such as email, billing, and support tooling. An up-to-date list of Subprocessors is available on request at contact@secontinuum.com;
• Professional advisors (lawyers, accountants, auditors) under confidentiality;
• Public authorities, where required by applicable law or valid legal process;
• A successor entity in connection with a merger, acquisition, or asset sale, with notice where required.

We do not sell Customer Data or personal data. Customers can also direct the Service to send data outward themselves — for example to webhook URLs they configure — and are responsible for those destinations.

The Service is hosted in the EU (Stockholm). Some Subprocessors, including our AI model provider, may process data outside the EEA or India. Where personal data is transferred internationally, we rely on appropriate safeguards such as standard contractual clauses.

• Account Data is kept while the account is active and for a reasonable period after closure for security, billing, and legal obligations.
• Security telemetry is retained per the customer’s plan and configuration, then deleted or archived. Expired detections may become unavailable in the console.
• Backups exist for a shorter, overlapping window and expire on their normal cycle.

On termination of a customer agreement, Customer Data is deleted or returned as described in our Terms of Service, except for backups and legal holds.

We protect data with multi-tenant isolation (per-tenant application data and tenant-scoped event stores), encryption in transit (TLS), role-based access control, audit logging of privileged actions, managed secrets storage, and least-privilege access within our infrastructure. Platform staff may access Tenants only for operations, support, and abuse or security response.

No system is perfectly secure, and we do not promise absolute security. We do not currently hold SOC 2, ISO 27001, or similar certifications; we are actively working toward SOC 2 and other compliance certifications.

Depending on where you live, you may have rights to access, correct, delete, export, or restrict the personal data we hold about you, to object to certain processing, and to withdraw consent where processing is based on consent. We do not discriminate against you for exercising them.

• For Account Data (your profile, billing, support history): email contact@secontinuum.com. We may need to verify your identity, and we respond within the timelines required by applicable law.
• For data inside a customer’s Tenant (for example, your activity appearing in your employer’s security logs): the customer is typically the controller, so contact your employer’s or organization’s administrator first. If a request reaches us directly, we will refer it to the relevant customer and assist them in responding.

Tenant administrators control their own Users — they can update profiles, change roles, and remove accounts directly in the console.

Our websites and the Service are for business use by people aged 18 and over. We do not knowingly collect data from children, and we do not offer accounts to them. Note that security telemetry ingested by a customer reflects activity on the customer’s systems; the customer is responsible for what its systems record.

Vynnn’s AI analyses and recommended remediations are assistive: they inform human analysts and administrators, who remain responsible for decisions and actions. We do not make solely automated decisions that produce legal or similarly significant effects about individuals — including a customer’s end-users — and the Service is not designed to be used that way (for example, for employment decisions).

We may update this statement from time to time. The “Last updated” date at the top shows the current version. For material changes we will give notice via the website and/or email before the new version takes effect.

If you believe we have processed your personal data unlawfully, please contact us first at contact@secontinuum.com so we can try to resolve it. You may also have the right to lodge a complaint with a data protection authority in your place of residence or work — for example, a supervisory authority in an EEA member state, or the Data Protection Board of India once operational.

Secontinuum Private Limited
B-1204, Block B, 12th Floor, Aparna Cyberlife,
Lingampalli, Serilingampally, K.V. Rangareddy,
Telangana, India – 500019

Privacy, support, and legal: contact@secontinuum.com