Privacy Policy

LureSight LLC · Effective October 14, 2026

1. Overview and our approach

This Privacy Policy explains how LureSight LLC (“we,” “us,” “our”) handles information in connection with the LureSight software — the Outlook add-in, the web-based email and text-message scanner, the forward-in scanning inbox, and the community service and public dashboard (together, the “Software”). It applies to information processed through the Software and should be read with the End User License Agreement.

LureSight is designed to be privacy-protective by default. It analyzes email where you already read it, keeps message content on your device wherever possible, collects no account or identity information to operate, and shares data with us only when you actively choose to submit a community report.

2. The short version

3. Information processed on your device (not sent to us)

When you scan a message — in the Outlook add-in or the web scanner — the Software reads the message's content and headers and, for image-only messages, may run optical character recognition (OCR) to read text inside an image. This processing happens locally, in the add-in or in your browser. The message and any file you scan are not transmitted to us as part of the scan. Results are shown to you and are not retained by us.

Report to security. If you use the “Report to security” feature, the Software helps you send the message to a reporting address that you or your organization configure. That message goes to the address you choose — typically your own security team — and is not sent to us, unless your organization has chosen delivery to its own security tools (Section 4).

4. Organization settings and our processing position

Our position. The add-in and the web scanner analyze messages on your device, and nothing about a message reaches us unless you choose to submit a community report or use the forward-in inbox. For an organization that deploys the add-in with community sharing switched off, that means we receive no message content from its people at all — not the body, not the subject, not the headers. In that configuration LureSight is software running on the organization’s own devices; we do not process that organization’s mail and do not act as its processor for it.

Tenant settings. An organization can set, for its mail domains: whether community sharing is available to its people (off, limited to findings only, or on); a fixed address for Report to security; whether the scanning inbox refuses forwards from its domains; whether its reports are kept private; and whether reports are also delivered to its own security tools. The add-in asks our server for these settings when it opens, sending only the domain part of the signed-in mailbox address (for example “example.org”), which identifies the organization and not the person.

Findings-only sharing. Where an organization limits sharing to findings only, a community report carries the sender’s domain, the link destinations, the detection findings and the authentication results, and no subject or message text.

Private reports. Where an organization keeps its reports private, each report is stored with an opaque code that marks it as that organization’s — not its name or domain — so it can be left out of the public dashboard and statistics. Private reports still train the community model and are deleted on the same schedule as all others (Section 10).

Delivery to your organization’s security tools. Where an organization configures it, Report to security also sends a report to the organization’s own security system (for example a SIEM or ticketing tool) by way of our server. That report contains the reporting mailbox’s address, the message’s identifier, the sender and link domains, the detection findings, the verdict and the authentication results. It contains no message body and no subject: our server rebuilds every report from a fixed list of fields that has no place for them. We relay the report and keep no copy of it. This is the one feature in which an email address of yours passes through our server, and it goes only to your own organization’s system; the destination and its credentials are configured by the organization and are never sent to the add-in.

What this means for sensitive environments. An organization that switches community sharing off and has the scanning inbox refuse its forwards can rely on this: no message content from its mailboxes reaches us. The web scanner is a public page we cannot restrict per organization; an organization that wants it blocked does so at its own network.

5. The forward-in scanning inbox

The forward-in inbox works differently: the message you forward does reach our server. When you forward an email to the scanning address, the full message you choose to forward — including its headers, and the original message when you forward as an attachment — is transmitted to and processed on our infrastructure. Forwarding is entirely optional, and the act of forwarding is itself the submission.

What happens to a forwarded message. The server analyzes it in memory and emails a single automated analysis back to the forwarding address. The forwarded message is not stored: no copy of the message, its attachments, or its content is retained once the analysis completes. What we keep is one scrubbed log line per message — a timestamp, an irreversible short hash of the forwarding address (the address cannot be recovered from it), the first 40 characters of the subject line, the score and verdict, and whether the reply was delivered. If a reply cannot be delivered immediately, the reply text — our analysis, not your forwarded message — is retained for delivery troubleshooting and deleted within 30 days.

Our mail processor. Mail to and from the scanning address is handled by Postmark, an email delivery service operated by ActiveCampaign, LLC, acting as our processor: Postmark receives what you forward, hands it to our server over an authenticated, encrypted connection, and delivers our reply. Postmark processes mail under its own privacy terms and, like any mail provider, retains transient delivery metadata.

Abuse limits. Automated replies are rate-limited per forwarding address and in total per day, using in-memory counters that are discarded when the service restarts.

Please don’t forward especially sensitive messages. The address exists for suspicious email. Unlike the add-in and the web scanner, a forwarded message does transit our server and our mail processor — so if a message’s contents are especially sensitive, don’t forward it. A forwarded message may also contain personal data about people other than you (typically the suspected attacker); we retain none of it beyond the scrubbed log line described above.

6. Information you choose to submit to the community service

Community submission is optional and off by default. It requires a one-time consent, and each submission asks you to label the message (“phishing,” “spam — unwanted, not dangerous,” or “false alarm”). When you submit, the Software first removes personal information on your device, and our server removes it again on receipt (“scrub twice”). A submission includes:

• the suspected sender's domain (for example, “paypa1-secure.com”);

• the destination web addresses (URLs) of links in the message, including the true destination behind any security-gateway rewrapping, with any email address embedded in a link replaced by “[email]”;

• the detection findings — the categories, severities, and plain-language reasons the Software generated;

• the message subject and a short body excerpt, with email addresses replaced by “[email]”, phone numbers by “[number]”, and personal names by “[name]”;

• the authentication results (SPF, DKIM, DMARC outcomes); and

• the risk score, verdict, and the label you selected.

A submission does not include your name or email address, the recipients, attachments, embedded files, your organization's identity (except the opaque code described in Section 4 for organizations that choose private reporting), or any identifier that could link the submission to you.

What scrubbing can and cannot promise. Removal is automatic and runs twice — once on your device and again on our server — and it reliably catches email addresses, telephone numbers, and personal names in greetings and sign-offs. It is pattern-based, so we cannot guarantee that every personal detail buried in a message body is caught. We therefore describe submissions as scrubbed and non-identifying rather than anonymous: we hold no identifier linking a report to you, but residual personal data may survive in message text. Please do not submit a message whose contents are especially sensitive.

Information about other people. A reported phishing message may contain personal data about people other than you — typically the sender, or someone named in the message. We keep this only to the extent it is part of the threat itself, apply the same scrubbing to it, never use it to contact or profile anyone, and delete it on the retention schedule in Section 10. Our lawful basis for this limited processing is described in Section 9.

Purpose. We use submissions to improve detection accuracy (including training the community model) and to produce aggregate threat statistics shown on the public dashboard; reports an organization keeps private (Section 4) are left out of those statistics.

7. Public dashboard

The public dashboard shows aggregate statistics only — counts and trends such as common attack methods, frequently reported sender and link domains, authentication-failure rates, and volumes over time. It does not publish message content, and the domains it lists are report counts, not accusations. Aggregated information cannot reasonably be used to identify you.

8. Operational data and security logging

To operate the community service reliably and protect it from abuse, our servers may process limited technical data such as timestamps and error logs. For rate-limiting we hold only a salted, irreversible hash of the network address, kept in memory and discarded when the service restarts; we do not write visitor IP addresses to disk. This data is used for security, abuse-prevention, and reliability, is kept to the minimum necessary, and is not used to build profiles of individuals. We apply reasonable technical and organizational measures to protect the information we hold; however, no method of transmission or storage is completely secure.

9. Legal bases for processing (EEA / UK)

Where the EU or UK General Data Protection Regulation applies, and to the extent any information we process is personal data, we rely on: your consent for community submissions, which you may decline; your request when you forward a message to the scanning inbox (performing the analysis you asked for and replying to you); and our legitimate interests in operating, securing, and improving the Software and protecting users from phishing, balanced against your rights, for limited operational and security data and for any personal data of third parties contained in a reported message. Processing personal data to the extent strictly necessary for network and information security is expressly recognised as a legitimate interest (GDPR Recital 49), and a reported phishing message is precisely such a security record. Where we rely on consent, you may withdraw it at any time by ceasing to submit; because submissions carry no identifier linking them to you, withdrawal cannot retroactively single out reports you already sent.

10. Data retention

We retain community submissions for 24 months. Deletion is automatic rather than discretionary: the service removes expired submissions, and their associated findings and links, when it starts and once every day thereafter. Aggregate statistics and trained models are derived from submissions but contain no message content and do not identify individuals; these may be kept indefinitely, so deleting the underlying reports does not degrade detection. Encrypted backups are rotated weekly, so a deleted submission may persist in a backup copy for up to seven further days. Operational logs are kept only as long as needed for their purpose.

11. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to the processing of your personal data, to portability, and to lodge a complaint with a supervisory authority. To exercise rights, contact us at legal@luresight.com.

12. Children

The Software is intended for use by adults in a workplace or personal email context and is not directed to children. We do not knowingly collect personal data from children under the age of 16 (or the age set by local law). If you believe a child has provided personal data, contact us and we will take appropriate steps.

13. International transfers

The community service is operated from the United States, so information you choose to submit is processed there. Where required, we use appropriate safeguards (such as standard contractual clauses) for cross-border transfers of personal data.

14. Third-party components and services

The Software uses third-party open-source components (for example, DOMPurify, Tesseract.js, and Chart.js). Some may be delivered to your browser from a content-delivery network when you use the web features; that request is handled by the delivery provider under its own terms. These components run in your browser and do not receive your message content from us. If you deploy the Software yourself, you are responsible for the components and infrastructure you choose.

15. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a new effective date and, where required, provide additional notice. Your continued use after an update takes effect constitutes acceptance to the extent permitted by law.

16. Contact us

For privacy questions or to exercise your rights: LureSight LLC, 502 W 7th St, Ste 100, Erie, PA 16502, legal@luresight.com, https://luresight.com. LureSight LLC is the data controller for information processed through the community service.