Privacy policy | Gain Security

Who we are

Gain Security Ltd. ("Gain Security", "we", "us") is a company registered in Israel. We operate gain.security and are responsible, as the data controller, for the personal information described in this policy.

You can reach us at hello@gain.security, or by post at HaArba'a 28, Tel Aviv-Jaffa, Israel.

What this policy covers

This policy covers personal information we collect through our website and when you contact us, request a demo, or book a meeting with us.

It does not cover data our customers process using the Gain platform. That data is handled under the agreement with each customer, including any data processing agreement, where we act as a processor on the customer's behalf.

Information we collect

Information you give us

Demo requests: your name, work email, company, and, if you choose, your role and what you would like to cover.
Meeting bookings: the time you choose and your time zone.
Messages: anything you send us by email, along with your contact details.

Information collected automatically

Server logs: when you visit the website, our hosting provider records technical information such as your IP address, browser type, the pages you request, the referring page, and the date and time. These logs are used to operate and secure the website.
Referral details: when you request a demo, we record the page you came from and any campaign tags in the link (for example, "utm" parameters), so we know how you found us.
Website analytics: we use Vercel Web Analytics to count page views and understand, in aggregate, which pages are visited, how visitors arrive and from which country and type of device. It does not use cookies and does not identify you or follow you across websites.

We do not use the website to collect sensitive personal information, and we ask you not to send it to us.

How we use it

To respond to your enquiry and arrange, prepare for and hold a demo.
To follow up about Gain, including relevant product and company news. You can ask us to stop at any time.
To operate, maintain and protect the website, including preventing spam and abuse.
To understand which channels bring people to our website.
To comply with our legal obligations and to establish, exercise or defend legal claims.

We do not sell your personal information, and we do not use it for automated decisions that have legal or similarly significant effects on you.

Legal bases

Where the GDPR or similar laws apply, we rely on these legal bases:

Legitimate interests: responding to business enquiries, following up with prospective customers, and keeping our website secure. We balance these interests against your rights.
Steps before a contract: when you ask us for a demo or information about our services.
Consent: where the law requires it. You can withdraw consent at any time.
Legal obligation: where we must keep or disclose information by law.

We share personal information only with service providers who help us run our business, under contracts that require them to protect it and use it only on our instructions:

Vercel, which hosts the website, processes server logs and provides our website analytics.
Attio, our customer relationship management system, where demo requests are recorded.
Cal.com, which schedules meetings and sends calendar invitations.
Slack, which notifies our team of new requests.
Google, which serves the website's fonts. Your browser sends your IP address to Google when loading them.

We may also share information with our professional advisers; with authorities when required by law or to protect our rights, users or the public; and with a buyer or successor if our business is reorganised, merged or sold.

Cookies

Our website does not use cookies for advertising or analytics, and it does not track you across other websites. Our analytics tool, Vercel Web Analytics, works without cookies: it counts visits using aggregated, anonymised data. If we add tools that use cookies in the future, we will update this policy and ask for your consent where the law requires it.

International transfers

We are based in Israel, which the European Commission recognises as providing an adequate level of data protection. Some of our service providers process information in other countries, including the United States. Where required, we protect these transfers with appropriate safeguards, such as the European Commission's standard contractual clauses.

How long we keep it

We keep demo requests and related correspondence for as long as needed to pursue and manage our relationship with you, and afterwards for a limited period to meet legal requirements or resolve disputes. When information is no longer needed, we delete or anonymise it. Server logs are kept for a short period by our hosting provider.

Security

We protect personal information with technical and organisational measures appropriate to the risk, including access controls and encryption in transit. Our security program is audited under SOC 2 Type II. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly to any incident.

Your rights

Depending on where you live, you may have the right to:

access the personal information we hold about you;
correct inaccurate information;
ask us to delete it;
object to, or ask us to restrict, how we use it, including for marketing;
receive it in a portable format;
withdraw consent where we rely on it.

Residents of US states with privacy laws, such as California, may also have the right to know what we collect and how we use it, and to opt out of sales or sharing for targeted advertising. We do not sell personal information or share it for targeted advertising.

To make a request, email hello@gain.security. We may need to verify your identity before responding, and we will respond within the time required by law. We will not treat you differently for exercising your rights.

You can also complain to a data protection authority: in Israel, the Privacy Protection Authority; in the EU or UK, the authority where you live or work.

Children

Our website and services are intended for businesses and are not directed to children under 16. We do not knowingly collect personal information from children.

Changes to this policy

We may update this policy from time to time. We will post the new version on this page and change the "Last updated" date above. If the changes are significant, we will take reasonable steps to let you know.

Contact us

For questions about this policy or your personal information, contact Gain Security Ltd. at hello@gain.security or HaArba'a 28, Tel Aviv-Jaffa, Israel.