Privacy Policy
This Privacy Policy explains how Byteshark LLC ("Byteshark," "we," "us," or "our"), an Oahu-based cybersecurity company, collects, uses, and protects information when you visit byteshark.tech, contact us, join a waitlist, or use our tools and services, including the Whitetip phishing checker.
1. Who we are
Byteshark LLC is the controller responsible for your information. You can reach us at contact@byteshark.tech for any privacy question or request.
2. Information we collect
- Information you send us. When you email us, submit a form on this site, request a quote, or join a waitlist, we receive your email address, your name and message if you provide them, and anything else you choose to include. Forms on this site are delivered to us by Formspree, a third-party form provider, which processes and stores the submission in order to pass it on to us.
- Whitetip submissions. When you use Whitetip, we receive the email or text message you forward or submit for analysis, including its headers, body, links, and attachments, and the email address you send it from. These messages may contain personal information about you and about third parties (senders, recipients, and people mentioned in the message). This applies whether you submit by forwarding the message to us directly or through the Whitetip Gmail add-on, which sends the same message content to our systems via Google's API rather than by forwarding an email.
- Engagement information. For paid services (security testing, malware analysis, insurance readiness, research briefs), we receive the information you and your organization provide so we can perform the work, governed by our engagement agreement.
- Technical information. Like most websites and services, our hosting and infrastructure providers may automatically log technical data such as IP address, browser type, and timestamps for security and reliability.
3. Whitetip and Blacktip — how we use forwarded messages
When you submit a message to Whitetip, we analyze its contents to produce a phishing verdict and explanation and return that result to you. Analysis is automated; a message is only reviewed by a person if our system escalates it for manual review, which happens whenever our tools cannot confidently clear it as malicious — we do not have a "safe" auto-result, so a meaningful share of submissions get at least a human look.
To perform this analysis, we may send limited signals derived from a message — such as a link's domain, a URL, or a file's hash — to third-party services (for example, domain/IP reputation lookups) to help evaluate them. We do not send those services the full message, its attachments, or its body text.
We also use an AI language model (currently Anthropic's Claude) to help write the plain-language explanation included in a verdict. The model only receives the structured technical findings our own analysis already produced (e.g. "sender domain registered 3 days ago") — never your raw message, its attachments, or personal information within it — and it cannot change or override the verdict itself.
The raw message you submit (including attachments) is retained only as long as needed to produce and support your verdict, and is deleted within 7–14 days after a verdict is issued. After that, we may retain de-identified, non-identifying signals derived from the message — such as attack techniques and patterns — for longer, to improve our detection and to develop and train Blacktip, our forthcoming phishing-simulation and training product. Before any submission is used for these purposes, we take steps to strip personal information (such as names, email addresses, and other identifying details) so that what we retain reflects the techniques and patterns of an attack rather than the identity of any individual.
We do not sell the contents of your messages, and we do not use them to contact the senders or recipients. If you do not want your submissions used to improve detection or train Blacktip, contact us at contact@byteshark.tech and we will honor that request.
4. How we use information
- To provide, operate, and improve our tools and services.
- To respond to your inquiries and deliver work you've engaged us for.
- To develop new products, including Blacktip, using de-identified data as described above.
- To secure our systems, prevent abuse, and comply with legal obligations.
5. How we share information
We do not sell your personal information. We share it only with:
- Service providers who host our infrastructure and help us operate, under confidentiality obligations. This currently includes Amazon Web Services (AWS) (email receipt, hosting, storage, and database infrastructure), Formspree (delivery of contact and waitlist forms submitted on this website), and Anthropic (the AI model used to help write verdict explanations, which receives only structured findings, never raw messages, as described in Section 3).
- Legal and safety recipients, when required by law or to protect our rights, users, or the public.
- A successor in the event of a merger, acquisition, or sale of assets.
6. Data retention
Raw messages you submit to Whitetip (including attachments) are retained only as long as needed to produce and support your verdict, and are deleted within 7–14 days after a verdict is issued. We keep other information only as long as needed for the purposes above or as required by law. De-identified detection data derived from Whitetip may be retained longer because it no longer identifies you.
7. Security
We use technical and organizational measures appropriate to our size to protect information, including isolating analysis environments and limiting access. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.
8. Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, or restrict use of your personal information, and to opt out of certain processing. To make a request, email contact@byteshark.tech. We will respond as required by applicable law.
9. Cookies and analytics
This website sets no advertising or analytics cookies. It loads fonts from Google Fonts, and when you submit a form, your submission is sent to Formspree for delivery to us; both providers may log technical data such as your IP address as part of serving that request.
10. Children
Our services are intended for businesses and adults. We do not knowingly collect personal information from children under 13 (or the age defined by your local law).
11. Changes to this policy
We may update this policy from time to time. We will revise the "last updated" date above, and material changes will be reflected on this page.
12. Contact us
Questions or requests? Email contact@byteshark.tech.