Privacy Policy
1. Introduction
Magnitude, Inc. ("the Company," "we," "us," or "our") operates magintude.com and provides the Magnitude vendor risk monitoring platform (the "Service"). This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to information collected through the Service and through direct communications with you.
Magnitude is a Boston-based SaaS company that helps enterprise security and procurement teams monitor third-party vendor risk on a continuous basis. Our platform ingests signals from security advisories, public breach data, regulatory filings, and news sources to generate risk scores and alerts for the vendor relationships our customers manage. This policy describes both the information we collect from visitors to this website and, at a high level, our approach to data processed as part of delivering the Magnitude Service to subscribers.
We are based at 116 Huntington Avenue, Floor 8, Boston, MA 02116, and can be reached at [email protected].
2. Information We Collect
2.1 Information You Provide
We collect information you submit directly, including:
- Contact details (name, work email, phone, company name, job title) when you fill out a form, request access to the platform, or contact us;
- The content of messages or inquiries you send us;
- Account credentials and profile information you provide when you create or manage a Magnitude account.
2.2 Information Collected Automatically
When you visit magintude.com, we automatically collect limited technical information:
- IP address and approximate location (city and region level);
- Browser type, operating system, and device class;
- Pages visited, referring URLs, and time on page;
- Cookie and similar identifiers (see Section 5 and our Cookie Policy).
2.3 Vendor Monitoring Data (Platform Customers)
Customers who subscribe to the Magnitude platform provide information about the vendor relationships they wish to monitor: vendor names, known domains, contract identifiers, and associated metadata. The Company processes publicly available signals about those vendors (security advisories, breach disclosures, regulatory actions, news coverage) to produce risk assessments for the customer's use. This vendor-relationship data is processed on behalf of the subscribing customer organization and is not used for any purpose other than delivering the Service. Magnitude does not use customer-submitted vendor data to train machine learning models without explicit written agreement.
2.4 We Do Not Knowingly Collect Children's Data
magintude.com is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact [email protected] and we will delete it.
3. How We Use Information
Magnitude is a business-to-business service. Most of the personal information we process relates to employees and representatives of prospective or current enterprise customers. We use the information we collect to:
- Respond to inquiries, provide product demonstrations, and support access requests;
- Provision, operate, maintain, and improve the vendor risk monitoring platform;
- Send service updates, security notices, and (with your consent where required) marketing communications about Magnitude;
- Deliver risk alerts and reports to authorized users within a subscriber organization;
- Detect, investigate, and prevent fraud, abuse, or unauthorized access;
- Comply with legal obligations, including responding to lawful requests from authorities.
We do not sell personal information for monetary value. Where applicable state law treats certain advertising arrangements as a "sale" or "share," see your state's section below.
4. Sharing of Information
We share personal information only with:
- Service providers acting on our behalf (for example, cloud hosting, transactional email delivery, and usage analytics) under contractual confidentiality and data-processing terms;
- Authorities, when required by law, court order, or to protect the rights, safety, or property of the Company, our customers, or others;
- A successor entity in the event of a merger, acquisition, or asset sale, subject to this Policy and any applicable legal requirements.
We do not sell personal information to third parties.
5. Cookies and Tracking
We use cookies and similar technologies to operate the site, remember preferences, and measure usage. For details and your choices, see our Cookie Policy.
6. Data Retention
We retain personal information only as long as needed for the purposes described in this Policy, to comply with legal or accounting obligations, and to resolve disputes. Specifically:
- Inactive marketing-list contacts are purged after 24 months from last engagement;
- Website server access logs are retained for 90 days, after which they are aggregated or deleted;
- Customer account and platform data is retained for the duration of the subscription and for up to 12 months afterward, unless a shorter deletion period is agreed in a customer contract;
- Contact form submissions and correspondence are retained for up to three years for support and audit purposes.
7. Security
We use administrative, technical, and physical safeguards designed to protect personal information. These include TLS encryption in transit, restricted-access databases, role-based access controls within our engineering and operations teams, and audit logging of access events. No system is perfectly secure; we cannot guarantee absolute security against all possible threats.
8. Your General Rights
Depending on your jurisdiction, you may have rights including access to, correction of, or deletion of the personal information we hold about you, and the ability to limit certain processing. To make a request, email [email protected] with a description of your request and enough detail to allow us to verify your identity. We will respond within the timeframe required by applicable law.
9. Massachusetts Residents
Massachusetts does not currently have a comprehensive consumer privacy statute. As a matter of policy, the Company extends the following baseline rights to all United States residents regardless of state of residence.
9.1 Baseline Rights
- Right to Know: request the categories of personal information we have collected about you.
- Right to Delete: request deletion of personal information you have provided.
- Right to Correct: request correction of inaccurate personal information.
- Right to Opt Out of Marketing: unsubscribe from marketing emails or opt out via the link in each marketing message.
9.2 How to Exercise
Email [email protected] with a description of your request and enough detail for us to verify your identity. We respond within 45 days.
9.3 Sector-Specific Rights
If you are protected by federal sector laws (such as GLBA, covering financial services data), those laws may give you additional rights with respect to data covered by them. Magnitude serves enterprise security and procurement teams whose organizations may themselves be subject to sector regulations; those obligations rest with the subscribing customer organization and their compliance programs.
9.4 California Visitors
If you are a California resident, you may also exercise the rights granted under the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"), including the right to know, the right to delete, the right to correct, and the right to opt out of sale or sharing. We do not sell personal information and do not "share" personal information for cross-context behavioral advertising.
To submit a CCPA or CPRA request, email [email protected] with the subject line "California Privacy Request."
10. Changes to This Policy
We may update this Policy from time to time. Material changes will be reflected by a new "Last updated" date and, where appropriate, a notice on the Service.
11. Contact
Questions, requests, or complaints can be sent to:
Magnitude, Inc.116 Huntington Avenue, Floor 8
Boston, MA 02116
Email: [email protected]
Phone: +1 (617) 226-0142