Privacy notice

Pistos Pharos is a product of Pistos Trust Labs. In this notice, “we” means Pistos Trust Labs, operating Pistos Pharos.

When you use the contact form we collect your name, work email, company if you give it, the primary domain you name, and your message. We use it to reply to you and to set up your account. We do not sell it, and we do not send marketing email to people who only contacted us with a question.

Form submissions are stored on our servers and emailed to our team. To limit abuse we also keep your IP address and browser identifier with the submission and a short-lived rate-limit record.

This website and the Pistos Pharos app use Google Analytics 4, a service of Google, to count visits and see which pages and buttons are used, for example how many people reach the sign-up page and how many create an account. Google Analytics sets cookies in your browser (names beginning _ga) and receives your IP address, browser and device details, the pages you view and the events described here. The same measurement ID is used on pistospharos.com and app.pistospharos.com, so a visit that crosses both is counted as one visitor.

We also set one cookie of our own, pp_attr, for up to 90 days, on pistospharos.com and app.pistospharos.com. It records where you first arrived from: the Google Ads click ID (gclid) and utm_ campaign parameters in the first link you used, the first page you landed on, and the site that referred you. If you create an account, we keep that information with the account so we can see which campaigns bring in customers. It contains no name, email address or other detail about you.

You can block or delete these cookies in your browser settings, or use Google’s opt-out browser add-on at tools.google.com/dlpage/gaoptout. The site and the app work without them.

When you connect a Microsoft 365 or Google Workspace tenant to Pistos Pharos, we read configuration settings, directory role assignments, authentication method metadata, and OAuth token grant scopes using read-only OAuth permissions.

Pistos Pharos never requests permission to read email bodies, calendar appointments, chat messages, or documents stored in OneDrive, SharePoint, or Google Drive.

Form submissions are kept while we are dealing with your request and for a reasonable period afterwards. Account data and posture snapshots are kept while you have an account, and deleted when you ask us to close it, except where we must keep a record by law.

You can ask to see, correct or delete the personal data we hold about you by emailing hello@pistospharos.com. We will reply within a reasonable time.

If we change this notice in a way that matters, we will say so on this page and, for account holders, by email.