Privacy Policy
Effective 16 October 2026
3AM runs inside your network. Your incidents, logs, metrics and the systems 3AM connects to never reach us. This policy covers the little we do see: what you send us through our websites, the trial and licence emails we send, and the licence check an install makes to our licence service, Warden.
We don't sell personal data, we don't use it for advertising, and our websites set no tracking or advertising cookies.
Who we are
3AM Super Intelligence Inc. ("3AM", "we", "us") is a Delaware corporation. We decide why and how the personal data described here is processed, so we are its controller.
Write to us at [email protected], or by post at 3AM Super Intelligence Inc., c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA.
This policy covers 3am.si, docs.3am.si, get.3am.si, warden.3am.si and the emails we send. It does not cover the 3AM software running on your own systems: there, your organisation decides what 3AM processes, and it never sends that data to us. How we handle the support material a customer chooses to share with us is set out in our Data Processing Addendum.
What we collect, and why
When you request a demo or a trial
On the demo form, or in the installer's trial prompt, you give us your name, work email, company, role, and, if you choose, how large your estate is, what you monitor with today, and a note. We use it to email you a trial code and installation steps, to arrange the demo you asked for, and to follow up about it. We only accept work email addresses, and we keep one trial per company, which we work out from your email domain.
When you submit the form, we also receive your IP address. We use it to stop abuse (a limit on how many requests one address can make in an hour), and nothing else.
When an install uses a licence
A 3AM install checks its licence with Warden: about once an hour by default, or as your contract sets. Each check sends:
- the licence id and the install's fingerprint: a hash identifying the install, which reveals nothing about the machine;
- the 3AM version;
- a usage report signed by the install: how many services it watches, each month's peak, and how many investigations ran each month. Service names are sent only as keyed hashes that we cannot reverse;
- the IP address the request comes from.
No incident data, alerts, logs, metrics, hostnames, credentials or user names are sent. An install can be set to verify its licence offline and never contact Warden (THREEAM_LICENCE_CHECK=offline); air-gapped installs send their usage report by hand, if their contract asks for one.
We use this to confirm that a licence is valid and used on the installs it covers, to deliver renewals and changes, to stop one licence being copied onto many machines, and to bill according to the contract. When you redeem a trial code, download a release, or ask to add an install or upgrade, we record the same kind of data, with the request's IP address.
When you write to us
If you email us, or contact us about a demo, a licence, support or security, we keep the correspondence and the contact details in it, so we can answer and keep a record of what was agreed.
When you browse our websites
Our websites are served by Cloudflare. Like any web server, Cloudflare handles your IP address, browser and the pages requested in order to deliver them and to protect the sites from attacks. We don't run analytics, advertising or session-recording scripts. See our Cookie Notice.
Where it comes from
From you (forms, the installer's trial prompt, emails); from 3AM installs (licence checks and usage reports); from your colleagues, if they name you as a contact for your organisation's licence; and from our service providers (such as Cloudflare's security signals). We don't buy personal data.
What we don't collect
We don't knowingly collect sensitive personal data (such as health, biometric or financial account data), and we don't buy personal data from data brokers. Our services are for businesses and aren't directed to children under 16.
Our legal bases
Where the GDPR, the UK GDPR or a similar law applies, we rely on:
| Purpose | Legal basis |
|---|---|
| Sending the trial code and installation steps you asked for; arranging your demo | Steps you asked for before entering a contract, and our legitimate interest in responding to business enquiries |
| Licence checks, usage reports and billing | Performance of our contract with your organisation, and our legitimate interest in protecting our software from unlicensed use |
| Following up about a demo or trial you asked for | Our legitimate interest in offering our product to business contacts who asked about it. You can opt out at any time |
| Rate limits and abuse prevention, using IP addresses | Our legitimate interest in keeping our services secure |
| Keeping records for tax, accounting and legal claims | Legal obligations, and our legitimate interest in establishing or defending legal claims |
Where we rely on legitimate interests, we have weighed them against your rights; you can ask us for that assessment. Under India's Digital Personal Data Protection Act, 2023, we process your data for the purpose you gave it to us, and you can withdraw consent at any time.
AI and automated decisions
We don't make decisions about you based solely on automated processing that produce legal or similarly significant effects. One thing is automatic: a trial request from a company that already has a trial (judged from the email domain) gets that company's existing trial, not a new one. If you think that's wrong, write to us and a person will review it.
We don't use your personal data, Customer Data or support material to train AI models. How the 3AM software uses AI on your own systems is explained in our AI Notice.
Where your data is stored
We are a US company, and our services run in the United States today: Warden runs on Google Cloud in the US. Our providers may process data in other countries where they operate.
We may move our services to another provider or region. If we do, we will update the sub-processor list first, and the protections in this section will continue to apply wherever the data goes.
When personal data from the European Economic Area, the United Kingdom or Switzerland is processed outside those places by our providers, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum and the Swiss amendments), or another lawful transfer mechanism, together with additional safeguards where they are needed.
How long we keep it
| Data | Kept for |
|---|---|
| Demo and trial requests that don't lead to a contract | Up to 24 months after our last contact with you, unless you ask us to delete them sooner |
| Licence, trial, install and usage records | For as long as the licence relationship lasts, then up to 6 years for tax, audit and legal claims |
| IP addresses used only for rate limits | Up to 30 days |
| IP addresses recorded with a trial redemption, licence check, install request or download | As long as the record they belong to |
| Correspondence | As long as needed to deal with it, and for up to 6 years where it records an agreement |
| Cloudflare's request logs | As set by Cloudflare for its own security and delivery purposes |
When a period ends, we delete the data or anonymise it so it no longer identifies anyone.
How we protect it
Data travels encrypted (TLS) and is encrypted at rest by our providers. Warden's administration is reachable only through Google's Identity-Aware Proxy, by named staff accounts; issuing a licence needs a second person's approval; and every administrative action is written to a hash-chained audit log. Licences are signed with keys held in a cloud key management service. No method of transmission or storage is perfectly secure, but we work to keep your data safe, and we will tell you and the authorities about a breach when the law requires it. See also our security policy.
Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you, and get a copy;
- correct it if it's wrong;
- delete it;
- restrict or object to how we use it, including to stop any follow-up from us;
- port it to another service, in a common format;
- withdraw consent, where we rely on consent;
- nominate someone to exercise your rights if you can't (India);
- complain to your data protection authority, for example in your EU country or to the UK Information Commissioner's Office.
To use any of these, email [email protected]. We will answer within one month (or sooner where the law requires), and we may ask you to confirm your identity first. We won't treat you differently for using your rights. California residents: we don't sell or share personal information, and you may make requests through the same address or through an authorised agent.
Grievances (India): contact our grievance officer at [email protected]. We will acknowledge your complaint and respond within the time the law allows.
California and other US states
In the last 12 months, we have collected these categories of personal information, for the purposes and from the sources described above: identifiers (name, email address, IP address); professional information (company, role); commercial information (trial and licence records); and internet activity (requests to our websites and licence service). We disclose them for business purposes only to the service providers in our sub-processor list. We don't collect sensitive personal information, and we don't sell or share personal information, including that of anyone under 16.
Do Not Track and Global Privacy Control. Our websites don't track you across other sites, so there is nothing for a Do Not Track signal to switch off. We treat a Global Privacy Control signal as a request to opt out of sale and sharing, which we already don't do.
Emails from us
We send the emails you ask for (trial codes, licence notices) and occasional follow-ups about a demo or trial you requested. We don't add you to a newsletter without asking. Every follow-up tells you how to stop them, or you can write to us.
Changes to this policy
When we change this policy, we will update the date at the top of this page. If a change matters, we will also tell customers by email before it takes effect.