Privacy Policy.

1. Scope

1.1What this policy covers. This policy applies to personal information we handle as a business for our own purposes: our website, our marketing, our sales and partner conversations, free trial sign-ups, recruiting and the administration of customer accounts.

1.2What it does not cover. When our customers use the Convoy platform, they send us security telemetry and other data from their own systems (“Customer Data”). We process Customer Data on our customers’ behalf and under their instructions, as a processor or service provider, and the customer’s agreement with us governs that processing, including our Master Services Agreement. If your employer or another organization uses Convoy and you have a question about how your information is handled, please contact that organization. We will help them respond.

2. Information we collect

2.1Information you give us. When you book a briefing, start a free trial, apply to our partner program, apply for a job or contact us, we collect what you enter in the form. Depending on the form, that is your name, work email address, company, company size, role or team, the tools you use today, what you would like to discuss, information about the customers and endpoints you manage (for partners), and links or details you choose to share (for job applicants). If you call us or email us, we keep a record of the conversation.

2.2Information collected automatically. When you visit our website, we and our service providers collect information about your device and how you use the site, including your IP address, browser type and settings, operating system, referring page, the pages you view, the links you click, how you scroll and move through pages, what you type into form fields (including text you type but do not submit), and the date and time of your visit. When you submit a form, we also record the page you submitted it from and your browser’s user agent. We collect this information through cookies, pixels, local storage and similar technologies, described in Section 4.

2.3Information from other sources. Some of our website tools use your IP address to identify the organization you are visiting from, and may match it with publicly available business information about that organization. We may also receive business contact information from data providers, event organizers and our partners, and we may combine it with information we already hold.

2.4Information we do not want. Please do not send us sensitive personal information, such as health information, payment card numbers, government identifiers or passwords, through our website forms or by email.

3. How we use information

We use personal information to:

• respond to your requests, schedule and hold briefings, and provide free trials;
• set up and administer customer and partner accounts, and communicate about them;
• send you information about Convoy that we think you will find useful, including product updates, research and event invitations, where the law allows us to;
• understand how visitors use our website so that we can improve it, measure our marketing, and learn which organizations are interested in Convoy;
• evaluate job applications and communicate with candidates;
• protect our website, forms and services from spam, abuse, fraud and security threats, including by using a bot check on our forms and limiting how often a form can be submitted;
• comply with our legal obligations, enforce our agreements, and establish, exercise or defend legal claims; and
• for any other purpose we describe to you when we collect the information, or with your consent.

4. Cookies and similar technologies

4.1What we use. Our website uses the following categories of technologies:

• Strictly necessary. Technologies that the site needs to work and stay secure, including the bot check that protects our forms, and storage that remembers basic preferences, such as where you were going on a page.
• Analytics. Product analytics that help us understand how visitors use the site, such as which pages they view, how they navigate and where they run into problems. These tools record how you interact with pages, including clicks, scrolling, mouse movement and what you type into form fields, even before you submit a form, and may keep recordings of visits that we can replay.
• Visitor identification and marketing. Tools that identify the organization a visit comes from, based on the visitor’s IP address, and that help us measure and improve our marketing.

4.2Your choices. Most browsers let you block or delete cookies, and many offer settings or extensions that block analytics and marketing scripts. If you block them, the site will still work. You can also ask us to stop using these technologies for your information by contacting us as described in Section 12.

5. How we share information

We do not sell personal information for money. We share personal information only as follows:

• Service providers. With companies that work for us, such as hosting, security and bot protection, website analytics, visitor identification, customer relationship management, email, scheduling and recruiting providers. They may use personal information only to provide their services to us, or as their own privacy notices describe for the data they collect directly on our website.
• Partners. With an authorized Convoy partner, such as a managed service provider, where you have asked to be connected with one, or where the partner introduced you to us.
• Legal and safety. Where we believe disclosure is required by law, legal process or a government request, or is necessary to protect the rights, property or safety of Convoy, our customers or others, including to prevent fraud or abuse.
• Business transfers. In connection with a merger, acquisition, financing, reorganization or sale of all or part of our business, subject to customary confidentiality protections.
• With your consent. Where you ask us to share it or otherwise agree.

6. How long we keep information

We keep personal information only for as long as we need it for the purposes described in this policy, including to maintain our relationship with you, to meet legal, accounting and reporting requirements, and to resolve disputes. When we no longer need it, we delete it or de-identify it. Information from free trials that do not convert is handled as described in our Master Services Agreement.

7. How we protect information

We use administrative, technical and physical safeguards designed to protect personal information, and we hold a SOC 2 attestation and ISO/IEC 27001 certification for our platform. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you believe you have found a vulnerability in anything we run, please follow our security disclosure program at convoy.security/security.

8. Your rights and choices

8.1Marketing emails. You can unsubscribe from our marketing emails at any time by using the link in any of them, or by contacting us. We will still send you messages about your account or your relationship with us.

8.2Your rights. Depending on where you live, you may have the right to:

• know what personal information we hold about you and how we use it, and receive a copy of it;
• correct inaccurate personal information;
• delete your personal information;
• receive your personal information in a portable format;
• opt out of targeted advertising, the “sale” or “sharing” of personal information as those terms are defined by law, and profiling that produces legal or similarly significant effects;
• object to or restrict certain processing, and withdraw consent where we rely on it; and
• appeal a decision we make about your request.

8.3Making a request. To exercise a right, email privacy@convoy.security or call 866-826-6869. We will verify your request by matching information you give us with information we hold, and we may ask for more information to do so. You may use an authorized agent to make a request for you, in which case we may ask for proof of the agent’s authority and confirm your identity directly with you. We will respond within the time required by applicable law, and we will not discriminate against you for exercising your rights.

8.4Appeals. If we decline your request, you may appeal by replying to our decision or by emailing privacy@convoy.security with the subject line “Appeal.” If you are not satisfied with the outcome of your appeal, you may contact the attorney general or data protection authority where you live.

9. U.S. state privacy disclosures

In the past twelve months, we have collected the following categories of personal information described in the California Consumer Privacy Act and similar state laws: identifiers, such as name, email address and IP address; professional or employment-related information, such as company, role and job application details; internet or other electronic network activity information, such as browsing and interaction data, including what you type into forms; and inferences drawn from these, such as an organization’s likely interest in Convoy. We collect them from the sources described in Section 2, for the purposes described in Section 3, and disclose them to the categories of recipients described in Section 5. We do not collect sensitive personal information for the purpose of inferring characteristics about you. Some of the analytics and visitor identification tools described in Section 4 may be considered a “sale” or “sharing” of personal information under certain state laws, and you may opt out by contacting us as described in Section 8.3.

10. Visitors outside the United States

10.1International transfers. Convoy is based in the United States, and we process personal information in the United States and in other countries where our service providers operate. Those countries may have data protection laws different from those where you live. Where the law requires it, we use appropriate safeguards for these transfers, such as standard contractual clauses approved by the European Commission or the UK government.

10.2Legal bases. If you are in the European Economic Area, the United Kingdom or Switzerland, we process your personal information on the following legal bases: to take steps at your request before entering into a contract, or to perform a contract with you; our legitimate interests in operating, securing and improving our website and business, and in marketing to businesses, where those interests are not overridden by your rights; compliance with our legal obligations; and your consent, where we ask for it, which you may withdraw at any time.

11. Children

Our website and services are intended for businesses. They are not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, please contact us and we will delete it.

12. Contact us

If you have a question about this policy or our privacy practices, contact us at privacy@convoy.security or 866-826-6869. Convoy Security, Inc. is responsible for the personal information described in this policy.

13. Changes to this policy

We may update this policy from time to time. When we do, we will change the “Last updated” date at the top of this page, and if the changes are material, we will give additional notice, such as a notice on our website or an email to those we have contact information for.

Convoy Security, Inc., a Delaware corporation. Privacy Policy, last updated November 12, 2026.