Privacy Policy & GDPR Compliance | SpiralBig

SpiralBig privacy policy, data protection terms, and GDPR privacy adherence standards.

Privacy Policy

Effective Date: January 1, 2026 | Last Revised: September 15, 2026

SpiralBig ("we", "our", "us", or the "Company") is committed to safeguarding your personal data while providing authoritative global WHOIS domain intelligence databases, newly registered domain feeds, and forensic cybersecurity archives. This Privacy Policy details the categories of personal information we collect, how it is processed and protected, our legal basis under GDPR and CCPA/CPRA, and your statutory rights regarding your information.

1. Scope and Distinctions in Data Processing

To understand how SpiralBig processes information, a fundamental distinction must be drawn between two separate categories of data handled by our infrastructure:

A. Customer & Account Data

Personal data directly provided by registered users, paying subscribers, API key holders, and website visitors when creating an account, authenticating, purchasing access, contacting technical support, or subscribing to intelligence feeds. SpiralBig acts as the Data Controller for Customer Data.

B. Public WHOIS & DNS Intelligence Data

Publicly accessible domain registration records, zone file changes, RDAP query results, and DNS telemetry aggregated from top-level domain registries, accredited ICANN registrars, and authoritative nameservers. SpiralBig aggregates and indexes this public record data for cybersecurity threat hunting, cybercrime investigation, brand protection, and legal dispute analysis.

2. Information We Collect from Customers

When you interact with our platform, we collect the following categories of information:

Identity & Contact Information: Your full name, corporate email address, telephone number, billing entity name, country of residence, and tax identifier (e.g. GSTIN or VAT number where applicable).
Authentication Credentials: Passwords stored strictly using salted Argon2id/Bcrypt cryptographic hashing algorithms, session authentication tokens, and API secret keys.
Billing & Payment Information: Payment transactions are handled directly via PCI-DSS Level 1 certified payment processors (Razorpay and PayPal). SpiralBig does not store complete credit card numbers, CVVs, or bank account authentication credentials on its servers. We retain transaction IDs, subscription expiry dates, and billing receipts.
Telemetry & Usage Logs: IP address, browser user-agent, operating system, API endpoints queried, timestamps, download logs, and HTTP request metrics collected for security monitoring, fraud prevention, and rate-limiting enforcement.

3. Legal Basis for Processing Under GDPR

For individuals residing within the European Economic Area (EEA), United Kingdom, or Switzerland, our processing of personal data is governed by the following legal bases pursuant to Article 6 of the General Data Protection Regulation (GDPR):

Processing Purpose	Data Categories	Legal Basis (GDPR Art. 6)
Provision of WHOIS Data Feeds & Downloads	Account info, email, subscription status	Performance of a Contract (Art. 6(1)(b))
Security Monitoring & DDoS Defense	IP address, request headers, query frequency	Legitimate Interests (Art. 6(1)(f))
Invoicing, Tax Compliance & Accounting	Billing address, transaction amounts, tax IDs	Legal Obligation (Art. 6(1)(c))
Threat Intel Research & Public Aggregation	Publicly registered domain metadata	Legitimate Interests (Recital 49 GDPR)

4. Public WHOIS Records & GDPR Privacy Proxy Handling

In compliance with the ICANN Temporary Specification and the Registration Data Access Protocol (RDAP), SpiralBig respects privacy redactions implemented by accredited domain registrars. When a domain registrant utilizes an accredited WHOIS privacy proxy service or when European registry data is redacted under GDPR, SpiralBig stores and displays the record in its standardized redacted format (e.g. REDACTED FOR PRIVACY). We do not attempt to de-anonymize legitimately redacted individual registrant details.

5. Third-Party Service Providers & Sub-Processors

We partner with trusted third-party cloud infrastructure and payment processors who adhere to strict data security standards:

Payment Gateways: Razorpay Software Private Limited (for INR transactions and UPI/cards) and PayPal Holdings Inc. (for USD/international transactions).
Infrastructure & Hosting: High-availability European and North American cloud servers equipped with automated DDoS mitigation, TLS 1.3 encryption, and enterprise firewalling.
Transactional Email: Enterprise SMTP relays for delivery of password resets, invoice receipts, and critical security alerts.

6. Data Retention Policy

We retain customer account details for as long as your account remains active or as required to fulfill our contractual obligations. If you close your account, non-financial data is purged within 90 days. Financial transactions, invoices, and payment receipts are retained for a minimum statutory period of seven (7) years to comply with tax, auditing, and corporate accounting regulations.

7. Your Data Protection Rights

Under applicable privacy statutes (including GDPR, UK Data Protection Act, and CCPA/CPRA), you possess the following enforceable rights:

Right of Access: You may request a machine-readable copy of your personal data held in our systems.
Right to Rectification: You may update or correct inaccurate profile details at any time via your user dashboard.
Right to Erasure ("Right to be Forgotten"): You may request permanent deletion of your account and personal identifiers.
Right to Restriction & Objection: You may object to data processing carried out under legitimate interest grounds.
Right to Non-Discrimination: We do not alter service availability or charge discriminatory pricing when you exercise privacy rights.

To exercise any of these statutory rights, please submit a signed written request to our Data Protection Officer at privacy@spiralbig.com. We respond to all verified requests within thirty (30) days.

8. Contact Information

SpiralBig Cyber Intelligence Systems

Attn: Data Protection Officer & Legal Compliance

Email: privacy@spiralbig.com | General Support: support@spiralbig.com

Direct Inquiries & WhatsApp Verification: +91 96037 81602