Privacy Policy

1Who We Are

JumperNet Solutions Inc. (“ThreatCode”, “we”, “us”, “our”) is a corporation incorporated under the laws of Canada, with its registered office in Toronto, Ontario, operating the AI-powered security intelligence platform at threatcode.net (the “Service”). For any privacy-related inquiries, please contact our Privacy Officer at [email protected].

2Information We Collect

We collect personal information only when necessary for the purposes described in this policy, and only when you provide it to us or when we are permitted to do so under applicable law.

2.1 Information You Provide Directly

• Account information: name, email address and profile image when you register. ThreatCode does not use passwords; you sign in with Google or with a one-time link sent to your email.
• Payment information: billing details processed by Stripe. We do not store full card numbers.
• Communications: messages you send to our support address.
• Published content: analyses you choose to publish to a public link.

2.2 Information Collected Automatically

• Usage data: pages viewed, features used, search queries, and AI features invoked.
• AI usage records: which AI feature was used, the model used, token counts and cost — used to apply plan allowances and to bill accurately.
• Device and browser information: IP address, browser type, operating system, device identifiers.
• Log data: access times, error logs and referring URLs.
• Cookies: a session cookie, as described in section 8.

2.3 Information From Third Parties

• Sign-in providers: if you sign in with Google, we receive your name, email address and profile image from Google.
• Payment processors: subscription and payment status from Stripe.

We do not collect personal information from the security intelligence we aggregate. The threat data we display — including dark-web and criminal-forum intelligence — is obtained from public and commercial threat sources and concerns threat actors and campaigns, not our users.

3How We Use Your Information

4Legal Basis for Processing (PIPEDA)

Under PIPEDA, we collect, use and disclose personal information on the following grounds:

• Consent: you have given us consent to process your information for specific purposes, for example marketing emails. You may withdraw consent at any time, subject to legal and contractual restrictions.
• Contractual necessity: processing is necessary to perform our agreement with you, such as delivering the subscription you purchased.
• Legal obligation: processing is required to comply with applicable law.
• Legitimate interests: processing supports our legitimate interests in securing and improving the Service, where those interests are not overridden by your rights.

5Sharing Your Information

We do not sell, rent or trade your personal information.

5.1 Service Providers

We share information with trusted third-party vendors who help us operate the Service, under contracts that limit their use of it to providing services to us:

5.2 Legal Requirements

We may disclose your information when required by law, subpoena or other legal process, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

5.3 Business Transfers

In the event of a merger, acquisition, financing or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

6International Data Transfers

ThreatCode is based in Canada. Our production infrastructure is hosted with a cloud provider in the United States, and our service providers (Google, Resend, Stripe and Anthropic) may process information in the United States and other countries. As a result, your personal information may be transferred to, stored in and processed outside of Canada.

Where information is transferred outside Canada, we take reasonable steps to ensure it receives a comparable level of protection, including contractual protections with our service providers. You may contact our Privacy Officer for information about our practices regarding service providers outside Canada.

7Data Retention

We retain your personal information for as long as necessary to provide the Service and for the purposes described in this policy. Account information is retained while your account is active. AI usage records are retained for allowance enforcement, billing and abuse prevention. When you delete your account, we delete or anonymise your personal information within a reasonable period, except where we are required or permitted to retain it — for example for tax, accounting or legal purposes.

8Cookies and Tracking Technologies

ThreatCode uses a session cookie that is strictly necessary to keep you signed in. We do not use third-party analytics, advertising or cross-site tracking cookies, and we do not operate advertising pixels. Because we use only strictly necessary cookies, no consent prompt is required for them under applicable law.

9Your Privacy Rights

Under PIPEDA and applicable Canadian law, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete personal information.
• Withdraw consent, subject to legal and contractual restrictions.
• Request deletion of your account and associated personal information.
• Ask questions or lodge a complaint about our handling of your information.

To exercise any of these rights, contact our Privacy Officer at [email protected]. We will respond within the timeframes required by applicable law. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

10Email Communications and Anti-Spam (CASL)

ThreatCode complies with Canada’s Anti-Spam Legislation (CASL). We send transactional messages — such as sign-in links, receipts and security notices — as part of the Service. Commercial messages are sent only with your consent, and every such message includes an unsubscribe mechanism. You may withdraw consent at any time by using the unsubscribe link or by contacting us.

11Data Security

We implement industry-standard technical and organisational measures to protect your information, including encryption in transit, access controls, and least-privilege access to production systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12Children

The Service is not directed to individuals under the age of 18, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

13Note to Users Outside Canada

ThreatCode is operated from Canada and our services are designed primarily for users in Canada and the United States. If you access the Service from another jurisdiction, you do so on your own initiative and are responsible for compliance with local law. Where local law grants you rights beyond those described here, nothing in this policy limits those rights.

14Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through the Service, and we will update the “Last updated” date above. Your continued use of the Service after a change takes effect constitutes acceptance of the updated policy.

15Contact Us

For any questions, concerns or requests related to this Privacy Policy or your personal information, contact our Privacy Officer: