PRIVACY POLICY

Last updated October 20, 2026

This Privacy Notice explains how AirMDR, Inc. ("AirMDR," "we," "us," or "our") collects, uses, and shares personal information when you:

• •Visit airmdr.com or any other website of ours that links to this notice;
• •Contact us, request a demo, register for an event, or otherwise interact with our sales and marketing activities; or
• •Use an account on the AirMDR platform as an authorized user of one of our customers, to the extent we administer that account.
  
  

1. What this notice does not cover: Customer Data

AirMDR provides managed detection and response services and an AI-powered security operations platform to businesses. To deliver those services, we process security logs, alerts, and other data from our customers' environments ("Customer Data"). We do this on our customers' behalf, as their service provider. Our handling of Customer Data is governed by our agreement with each customer, not by this notice.

If your information is part of Customer Data — for example, because your employer uses AirMDR — please direct your privacy questions to your employer.

2. Information we collect

Information you give us. This includes your name, business email address, phone number, job title, company, and anything else you submit through our forms, demo requests, event registrations, emails, or calls. If you are an authorized platform user, it also includes account details such as your name, email address, and login credentials.

Information collected automatically. When you visit our websites, we and our partners collect:

• •Your IP address and the approximate location derived from it;
• •Browser, device, and operating-system information;
• •Referring URLs; and
• •The pages you view, how long you stay, and what you click.
  
  

This collection uses cookies, pixels, and similar technologies (see Section 5). Some of these tools record how you interact with our pages, and some help us identify the company or person visiting our website.

Information from other sources. We obtain business contact and professional information from professional networking services such as LinkedIn, website visitor identification services, data providers, event partners, and publicly available sources. This may include your name, job title, employer, business email address, and professional profile.

3. How we use information

We use the information described above to:

• •Respond to your inquiries and demo requests, and provide information you ask for;
• •Provide, administer, and secure platform accounts;
• •Send sales and marketing communications, and show you advertising on other websites and platforms;
• •Measure how well our websites and marketing campaigns work, and improve them;
• •Protect the security of our websites, services, and business, and prevent fraud and misuse; and
• •Comply with legal obligations and protect our legal rights.
  
  

4. How we share information

We share personal information with:

• •Service providers that work on our behalf under contract. These include providers of hosting, CRM and marketing automation, analytics, communications, and AI models.
• •Advertising and analytics partners, as described in Section 5.
• •Authorities and other parties, when we believe disclosure is required by law or legal process, or is necessary to protect the rights, property, or safety of AirMDR, our customers, or others.
• •A buyer, investor, or successor, in connection with a merger, acquisition, financing, or sale of all or part of our business.
• •Others, with your consent or at your direction.

We do not sell personal information for money. Mobile phone numbers and SMS opt-in data are excluded from all of the sharing described in this section; see Section 7.

5. Cookies and tracking technologies

We and third parties use cookies, pixels, tags, and scripts on our websites. The tools we use change over time; they currently include tools such as:

• •HubSpot, for website analytics, forms, marketing automation, and advertising audiences;
• •Google Analytics and Google Ads, for analytics, ad measurement, and remarketing;
• •LinkedIn Insight Tag, for ad measurement, remarketing, and audience insights;
• •Microsoft Clarity, for session recording and heatmaps that show how visitors interact with our pages; and
• •RB2B, for website visitor identification, which links visits to business contact information such as professional profiles.

Third-party tracking. Some of these third parties collect information about your online activities over time and across different websites. Their use of that information is governed by their own privacy policies.

Your choices. You can block or delete cookies through your browser settings, and use a cookie-preferences tool on our website where we offer one. You can manage ad personalization through the settings that Google and LinkedIn provide. Blocking some cookies may affect how our websites work.

Do Not Track. Our websites do not currently respond to browser "Do Not Track" signals.

6. AI in our services

The AirMDR platform uses artificial intelligence, including models from third-party AI providers under contract, to help analyze security alerts and investigations for our customers. Our contracts with these providers prohibit them from using Customer Data to train their general-purpose models. We do not use Customer Data to train general-purpose AI models without the customer's written consent.

7. SMS security alerts

If you enroll to receive SMS security alerts from AirMDR, we collect your mobile phone number and a record of your consent, including when and how you enrolled. We use this information only to send security alerts about incidents affecting your organization, plus related program messages such as enrollment confirmations and replies to HELP or STOP.

• •Message frequency varies with the number of security incidents. Message and data rates may apply.
• •Reply STOP at any time to opt out, or HELP for help.
• •Enrollment is optional and is not a condition of purchasing our services.
• •No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. We share it only with service providers that help us deliver the messages, such as our SMS provider. All other categories of sharing in this notice exclude SMS opt-in data and consent; this information will not be shared with any other third parties.

The SMS Terms section of our Terms of Service also applies to the program.

8. How long we keep information

We keep personal information only as long as we need it for the purposes in this notice. That period depends on whether you have an active relationship with us, whether you are still engaging with our marketing, and whether we must keep records for legal, tax, accounting, or security reasons. When we no longer need the information, we delete or de-identify it.

9. How we protect information

We maintain administrative, technical, and organizational safeguards designed to protect personal information, and our security program is independently audited (SOC 2). No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. International processing

AirMDR is based in the United States and has operations in India. We and our service providers may process your information in the United States, India, and other countries where our providers operate. These countries may have data protection laws that differ from those where you live.

11. Your choices and requests

• •Marketing emails. You can unsubscribe at any time using the link in our emails. We may still send you non-marketing messages, such as replies to your requests or account notices.
• •Access, correction, and deletion. You can ask us to access, correct, or delete the personal information we hold about you under this notice, or to stop using it for marketing, by emailing privacy@airmdr.com. We respond as required by the laws that apply to us, and otherwise consider requests in good faith. We may need to verify your identity. We may keep some information where we need it for legal, security, or legitimate business reasons.
• •Customer Data. Requests about Customer Data should go to the customer (usually your employer). We will help that customer respond, as our agreement with them provides.
  
  

12. Children

Our websites and services are intended for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it.

13. Changes to this notice

We may update this notice from time to time. When we do, we will post the updated version here and change the effective date at the top. If we make material changes, we may also post a notice on our website.

14. Contact us

If you have questions about this notice or our privacy practices, contact us at:

AirMDR, Inc.
320 Lennox Ave Menlo Park, CA 94025 United States
privacy@airmdr.com