Privacy Policy

This policy applies to:

• The Mars Slack App (everything Mars does in your workspace).
• The public marssec.ai website, including the Slack landing page and this Privacy Policy.

It does not cover the authenticated Mars platform at app.marssec.ai, which is governed by your organization's contract with Mars and its associated customer-facing privacy notice.

When your workspace installs the Mars Slack App and uses its features, Mars receives the following from Slack:

• OAuth credentials. A bot token issued by Slack during install, used to call the Slack API on behalf of your workspace. Stored encrypted at rest.
• Workspace metadata. Your Slack workspace (team) ID and human-readable workspace name, used to route slash commands and to display the workspace in the Mars admin UI.
• Channel metadata. Slack channel IDs and names for channels you select as hunt-notification destinations, and for channels you reference when configuring the integration.
• User identifiers. Slack user IDs and email addresses of users who: (a) invoke a /mars slash command, or (b) are messaged by Mars's investigation agent. Email is used solely to match a Slack user to their corresponding Mars user account.
• Messages Mars itself sends. The content of hunt-completion summaries and validation messages that Mars posts into channels or sends as direct messages. Mars retains these for operational logging and troubleshooting.

What Mars does not read. Mars never reads message history from channels or direct messages. Mars does not request channels:history, groups:history, im:history, or mpim:history scopes. The only Slack messages Mars sees are the ones Mars itself sends.

We use the information above strictly to:

• Deliver the Slack App's features (post notifications, route slash commands, send analyst-approved validation messages).
• Match a Slack user to their Mars account so commands and messages are attributed to the right person.
• Operate, secure, and troubleshoot the service, including investigating misuse or abuse.
• Respond to inquiries you submit through the Website contact form, including follow-up about your interest in Mars.
• Comply with legal obligations.

We do not use your data for advertising, profiling unrelated to security investigations, building external products, or training general-purpose AI models. We do not sell your data.

We share information only with trusted subprocessors that help us operate the service. Current categories of subprocessors include:

• Cloud infrastructure providers (e.g., Amazon Web Services) for hosting, storage, and networking.
• LLM providers (e.g., OpenAI, Anthropic, Azure OpenAI) used by Mars's investigation and hunting agents. Data is sent under contractual terms that prohibit using it to train general-purpose models.
• Operational tooling such as error monitoring and logging providers.

We do not share your data with third parties for their own marketing or advertising purposes. We may disclose information when required by law (e.g., a valid subpoena), and will challenge overbroad requests where permissible.

• Slack credentials (bot token, workspace metadata) are retained until your workspace uninstalls the Slack App, or until your contract with Mars ends, whichever comes first.
• Operational logs (including messages Mars sent) are retained for up to 90 days by default, then automatically deleted.
• Hunt and investigation outputs are retained according to your organization's contract with Mars and are governed by the in-product privacy notice.

You can request deletion at any time by emailing mars-support@marssec.ai.

Depending on where you live, you may have rights over personal data we process about you, including:

• Access: request a copy of the personal data we hold about you.
• Correction: request correction of inaccurate or incomplete data.
• Deletion: request deletion of your data, subject to legal retention obligations.
• Portability: request a copy of your data in a machine-readable format.
• Objection / restriction: object to or restrict certain processing.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what categories of personal information we collect and to opt out of any "sale" or "sharing" (Mars does not sell or share personal information for cross-context behavioral advertising).

To exercise any of these rights, contact mars-support@marssec.ai. Where Mars is acting as a processor on behalf of your employer, we will direct you to your organization's privacy contact.