Last Updated: April 21, 2026
GreyIP Technologies Inc. d/b/a Beacon Technology Group ("Beacon," "we," "us," or "our") is committed to protecting your privacy and ensuring the security of your information. This Privacy Policy explains how we collect, use, disclose, and safeguard information in connection with our websites, platforms (including CYFAX, PREVENT, and ARETE), and services.
Beacon Technology Group is a cybersecurity company providing predictive threat intelligence, endpoint security validation, and cyber risk analytics platforms.
Legal Entity: GreyIP Technologies Inc. d/b/a Beacon Technology Group
Address: 4900 S. University Drive, Suite 200B, Davie, FL 33328, United States
Contact: privacy@gobeacon.ai
This Privacy Policy applies to:
This policy does not apply to third-party websites, services, or applications that may be linked from our platforms.
When you interact with our websites, we may collect information you voluntarily provide, including:
We automatically collect certain information when you visit our websites:
We use cookies and similar tracking technologies to enhance your experience, analyze website traffic, and understand visitor behavior. You can control cookie preferences through your browser settings. See our Cookie Policy for details.
The PREVENT endpoint security platform collects telemetry data from deployed agents to provide breach and attack simulation, network detection, and asset lifecycle management services. This includes:
Privacy by Design. PREVENT is architected to minimize personal data collection. The platform is not designed to collect, store, or process payment card information (PCI) or protected health information (PHI) from endpoints. Telemetry may incidentally include limited personal identifiers (such as hostnames or usernames) that are inherent to endpoint security operations; such data is processed only for the security purposes described in this policy.
The CYFAX threat intelligence platform provides external attack surface management and dark web monitoring. Customer-provided data includes:
See Section 5 for information about how we collect threat intelligence data, and Section 6 for VIP monitoring specifically.
Public Source Intelligence. Beacon Technology Group collects threat intelligence data from publicly accessible sources and from infrastructure we operate, for the purpose of protecting our customers and the broader internet community from cyber threats. This data collection is conducted in full compliance with applicable laws.
Our threat intelligence is derived from:
Beacon employs proprietary deception technology and collection methodologies to gather threat intelligence from sources where criminal actors trade stolen data. This includes:
Threat intelligence data is processed to identify potential risks to our customers and the broader internet community. When compromised credentials or sensitive information are detected:
Beacon's threat intelligence methodology and findings are the subject of documented research, including the publication: Vazquez, H. B. (2025). Underground Economy Signals as Temporal Predictors of Cybersecurity Breaches: A Retrospective Multi-Case Assessment Across Critical Infrastructure Sectors. Zenodo. https://doi.org/10.5281/zenodo.19600291. Processing of threat intelligence data is conducted for both operational security purposes and scientific research purposes within the meaning of GDPR Article 89 and Recital 159.
For customers utilizing our VIP or executive monitoring services, the following data practices apply:
Customers provide identity information (such as email addresses) for individuals they wish to monitor for credential exposure. This data is provided under the terms of our End User License Agreement, which includes mutual hold harmless provisions.
Consistent with privacy by design principles, output displayed to users is masked to show only enough information to enable identification and remediation, while minimizing exposure of the full compromised credential.
Beacon Technology Group is NOT a Consumer Reporting Agency as defined by the Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq.
Our services are designed exclusively for cybersecurity, fraud prevention, and threat intelligence purposes. Our platforms and the information we provide:
All users — including customers, paid subscribers, channel partners, and users of the free-tier scan — agree, as a condition of service, not to use any information obtained from Beacon platforms for FCRA-regulated purposes. Unauthorized use for any FCRA-regulated purpose is a material breach of these terms and the user's End User License Agreement (if applicable), and will result in immediate termination of access and may expose the user to legal liability.
Beacon Technology Group has invested significant resources in obtaining and maintaining internationally recognized security certifications:
Certifications are independently assessed and issued by ASIB (Europe). Certification documentation is available upon request.
We implement comprehensive technical and organizational security measures, including:
Our platforms are architected with privacy guardrails at the foundation. This architectural choice enhances security and simplifies compliance with regulatory frameworks including PCI DSS, GDPR, and HIPAA.
We retain data only as long as necessary for the purposes described in this policy:
| Data Type | Retention Period |
|---|---|
| Website analytics | 26 months |
| Contact form submissions | Duration of business relationship + 3 years |
| Customer account data | Duration of subscription + 30 days |
| VIP monitoring identities | Duration of subscription |
| PREVENT endpoint telemetry | Rolling 90-day window (configurable) |
| Free-tier scan requests (requester email, IP, target) | 24 months for audit and abuse-prevention purposes |
| Threat intelligence data | Subject to periodic review; retained for the period operationally necessary to provide early warning and attribution services, with documented legitimate-interest assessment |
Upon termination of services, customer data is deleted or returned in accordance with contractual agreements, typically within 30 days unless legal retention requirements apply.
For individuals in the European Economic Area (EEA), United Kingdom, or Switzerland, we process personal data in compliance with the General Data Protection Regulation (GDPR) and UK GDPR.
We rely on the following lawful bases depending on the specific processing activity:
Under GDPR and UK GDPR, you have the right to:
To exercise any of the rights above, contact us at privacy@gobeacon.ai. We will respond to verified data subject requests within 30 days of receipt, as required by Article 12(3). In complex cases, this period may be extended by a further two months, in which case we will notify you of the extension and the reasons for it within the initial 30-day period.
We may share personal data with the following categories of recipients:
Beacon acts in different capacities depending on the processing activity:
Data may be transferred to and processed in the United States and other jurisdictions. For transfers from the EEA, UK, or Switzerland to the United States, we rely on the EU-U.S. Data Privacy Framework, the UK Extension to the Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework where applicable, as well as Standard Contractual Clauses (SCCs) with supplementary measures where required. Copies of applicable safeguards are available on request.
Our ARETE predictive analytics engine produces organization-level risk scoring and threat forecasting. ARETE does not make automated decisions producing legal or similarly significant effects on individual data subjects within the meaning of GDPR Article 22. Risk scoring is applied at the organization level; any action taken on the basis of ARETE output is made by human security decision-makers at the customer organization.
California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
We do not sell personal information. We do not share personal information for cross-context behavioral advertising. Because we do not engage in such sales or sharing, no opt-out process is required; however, California residents may confirm this and exercise any other CCPA/CPRA right by contacting privacy@gobeacon.ai.
We use select third-party services to operate our business:
All third-party service providers are contractually bound to protect data and use it only for specified purposes.
Our services are directed exclusively to businesses and are not intended for individuals under the age of digital consent in their jurisdiction (16 in most EEA member states; 13 in the United States under COPPA). We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete such information promptly. If you believe a child has provided us with personal information, contact privacy@gobeacon.ai.
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will post the updated policy on this page with a revised "Last Updated" date. Material changes will be communicated via email or prominent notice on our website. Your continued use of our services after changes become effective constitutes acceptance of the revised policy.
For questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Beacon Technology Group
Attn: Privacy Officer
4900 S. University Drive, Suite 200B
Davie, FL 33328, United States
Beacon Technology Group is proud to share any of our compliance certifications and detailed audit documentation under NDA. Contact us to learn more about our security posture and compliance program.
Access to the Beacon free-tier external risk assessment ("Free-Tier Scan") is governed by the following additional terms. By submitting a scan request, the requester ("Requester") agrees to the following conditions in addition to the general terms of this Privacy Policy:
The Free-Tier Scan is limited to the organizational domain associated with the Requester's corporate email address. The service is provided solely for the Requester's own organization and is not intended as a means of assessing third-party organizations without authorization. Requests submitted with personal, consumer, or anonymous email addresses may be refused.
By submitting a scan request, the Requester represents and warrants that:
Beacon relies on this representation in providing the Free-Tier Scan. Beacon does not independently verify authorization and assumes no responsibility for disputes arising from a Requester's lack of authority.
Free-Tier Scan results are derived from publicly available sources and Beacon's threat intelligence collection as described in Section 5. Results are provided on an "as is" and "as available" basis, without warranty of any kind, and may contain false positives, false negatives, or outdated information. Free-Tier Scan results are not a "consumer report" within the meaning of the Fair Credit Reporting Act and may not be used for any FCRA-regulated purpose (see Section 7).
Free-Tier Scan results are licensed solely for the Requester's internal use within the organization whose domain was scanned. The Requester may not:
Results are delivered via a unique, time-limited, single-use link. It is the Requester's responsibility to access and, where desired, save the results within the validity window. Beacon is not obligated to re-issue expired links.
Beacon maintains audit logs of all Free-Tier Scan requests, including the Requester's email, IP address, target domain, and timestamp, for the retention period stated in Section 9. These logs are used for abuse prevention, security, and legal compliance purposes.
The Requester agrees to indemnify, defend, and hold harmless Beacon Technology Group, GreyIP Technologies Inc., and their respective officers, directors, employees, and agents from and against any third-party claims, losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to: (a) the Requester's breach of these Free-Tier Scan terms; (b) the Requester's misrepresentation of authorization; (c) the Requester's unauthorized or unlawful use of Free-Tier Scan results; or (d) any third-party claim that the Requester's use of the results infringed or harmed such third party.
Beacon may suspend, restrict, or terminate access to the Free-Tier Scan at any time, with or without notice, including for suspected abuse, suspected misrepresentation of authorization, or any violation of these terms.
These Free-Tier Scan terms are governed by the laws of the State of Florida, without regard to conflict-of-laws principles. Exclusive jurisdiction and venue for any dispute lie in the state and federal courts located in Broward County, Florida.