Privacy Policy

Last updated: 21 October 2026

This Privacy Policy explains how Netos Networks, Inc. (US) and Netos Networks Ltd. (UK) (together, “Netos”, “we”, “us” or “our”) collect, use, share and protect personal information. It covers:

• visitors to our website at https://netos.io and its subdomains (the “Website”);
• people who contact us, request a demo, attend our events or otherwise correspond with us;
• prospective and existing customers, partners and suppliers, and their representatives; and
• individual users of the Netos platform (the “Platform”) in respect of account, usage and support information.

Customer data in the Platform. Network, inventory, contract and financial data that customers upload to or connect with the Platform (“Customer Data”) is processed by Netos on behalf of the customer, under the customer’s agreement with Netos and any data processing agreement (“DPA”). For Customer Data, the customer is the controller and Netos is the processor. If your organisation uses the Platform and you have questions about how your information in Customer Data is handled, please contact your organisation first. Section 9 summarises how we protect Customer Data.

1. Who we are and how to contact us

Netos is the controller of the personal information described in this policy (other than Customer Data).

For any question or request about this policy or your personal information, contact our privacy team through the contact form, selecting or mentioning “Privacy”. Our Information Security Officer and Head of Engineering are jointly responsible for our privacy program.

2. Information we collect

2.1 Information you give us

• Contact and enquiry information: name, business email address, phone number, company, job title, and the content of your message when you complete a contact or demo form, email us or speak to us.
• Account information: name, business email address, organisation and role when you are given an account on the Platform, and authentication details managed through our identity and access tools.
• Commercial information: billing contact details and records of purchases, invoices and contracts. Card payments are processed by our payment provider, Stripe. Netos does not receive or store full card numbers.
• Support and feedback: information you provide when you ask for help, report an issue or give feedback.
• Recruitment information: details you provide when applying for a role with us.

2.2 Information we collect automatically

When you visit the Website or use the Platform, we and our service providers collect:

• Device and connection data: IP address, browser type and version, operating system, device type, language and approximate location derived from your IP address.
• Usage data: pages and features viewed, links clicked, referring and exit pages, time and duration of visits, and similar interaction events.
• Security and log data: access logs, authentication events and security telemetry used to protect the Website and Platform.

This information is collected using cookies and similar technologies (see Section 6) and through server and security logs.

2.3 Information from other sources

• Your organisation: if your employer is a Netos customer or partner, they may give us your name and business contact details so we can provide you with access or support.
• Business contact sources: we may obtain business contact information (such as name, job title and company) from professional networks such as LinkedIn and other publicly available sources, to identify organisations that may benefit from Netos.
• Service providers: for example, confirmation of payment from Stripe or security signals from Cloudflare.

3. How we use your information and our legal bases

If you are in the UK or the European Economic Area (EEA), we must have a legal basis for each use of your personal information. The table below sets out our purposes and the legal bases we rely on.

Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for more detail about this balancing. You can opt out of marketing emails at any time using the unsubscribe link in any email or by contacting us.

We do not use your personal information for automated decision-making that produces legal or similarly significant effects on you.

4. How we share your information

We do not sell or rent your personal information, and we do not use it for cross-context behavioural advertising.

We share personal information only as follows:

4.1 Service providers

We use carefully selected service providers who process personal information on our behalf, under written contracts that require them to protect it and use it only on our instructions. Each provider is assessed and tracked in our vendor management program before onboarding and reviewed periodically. Our principal providers are:

We also use banking and finance providers (such as Mercury, Wise and American Express) to make and receive business payments, and contractor platforms (such as Upwork) to engage contractors. We will update this list when we make material changes to the providers that process personal information.

4.2 AI tools you connect

Netos AI Playbooks can be run from AI tools that you or your organisation choose and connect to the Platform. When you do so, the information you send to that tool is processed by its provider under your or your organisation’s agreement with that provider, not under this policy.

4.3 Other disclosures

• Within our group: between Netos Networks, Inc. and Netos Networks Ltd., and any future subsidiaries, to operate our business.
• Business transfers: to a prospective or actual buyer, investor or successor in connection with a merger, acquisition, financing or sale of assets, subject to confidentiality obligations.
• Legal requirements: where we believe in good faith that disclosure is required by law, regulation or valid legal process, including to meet national security or law enforcement requirements. Unless legally prohibited, we will notify affected customers or individuals of such requests, and we will challenge requests that we believe are overbroad or unlawful.
• Protection of rights: where necessary to establish, exercise or defend legal claims, or to protect the rights, property or safety of Netos, our customers or others.
• With your consent or at your direction.

5. International transfers

Netos operates in the United States and the United Kingdom, and some of our service providers process information in other countries. When we transfer personal information from the UK or EEA to a country that does not provide an adequate level of protection, we use appropriate safeguards, such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or a provider’s certification under the EU-US Data Privacy Framework and its UK Extension. You can request more information about the safeguards we use by contacting us.

Customer Data is hosted in the Microsoft Azure region agreed with each customer and is not moved out of that region except as described in the customer’s agreement.

6. Cookies, analytics and similar technologies

6.1 What cookies are

Cookies are small files stored by your browser. Some expire when you close your browser (session cookies) and others remain until they expire or you delete them (persistent cookies). We also use similar technologies such as local storage and tracking scripts. In this policy we call them all “cookies”.

6.2 Cookies we use

You can block or delete cookies at any time through your browser settings (see Section 6.4).

6.3 Google Analytics and Mixpanel

We use Google Analytics to measure Website traffic and engagement, and Mixpanel to understand how visitors and users interact with the Website and with features of the Platform. These tools collect device and connection data and usage events, and assign pseudonymous identifiers. When you are signed in to the Platform, Mixpanel events may be associated with your user account so we can understand feature adoption and provide support.

We use these tools only to analyse and improve our Website and products. We have not enabled Google’s advertising features, and we do not use analytics data to build advertising profiles. Google and Mixpanel process this data as our service providers. Event-level analytics data is retained for no longer than 14 months.

You can opt out of Google Analytics by installing the Google Analytics opt-out browser add-on. You can also limit analytics on the Website by blocking or deleting cookies in your browser, as described in Section 6.4.

6.4 Managing cookies in your browser

Most browsers let you refuse or delete cookies. Instructions are available for Chrome, Firefox, Safari and Edge. Blocking strictly necessary cookies may stop parts of the Website or Platform from working.

7. How long we keep information

We keep personal information only for as long as we need it for the purposes in this policy, in line with our Data Retention Policy:

When information is no longer needed, we delete it or anonymise it so it can no longer be associated with you.

8. Your rights

8.1 Everyone

You can ask us to access, correct or delete your personal information, and you can opt out of marketing at any time. We do not charge for handling requests unless they are manifestly unfounded or excessive.

8.2 UK and EEA

If you are in the UK or EEA, you have the right to:

• access your personal information and receive a copy of it;
• rectify inaccurate or incomplete information;
• erase your information in certain circumstances;
• restrict our processing in certain circumstances;
• object to processing based on our legitimate interests, and to object at any time to direct marketing;
• data portability, to receive information you provided to us in a structured, machine-readable format;
• withdraw consent at any time where we rely on consent, without affecting processing that took place before withdrawal; and
• complain to a supervisory authority. In the UK this is the Information Commissioner’s Office (ico.org.uk). In the EEA, you can contact the authority in your country of residence. We would appreciate the chance to address your concern first.

8.3 United States

Depending on your state of residence, you may have rights to know, access, correct and delete personal information, to obtain a portable copy, and to opt out of the sale or sharing of personal information, targeted advertising and certain profiling. Netos does not sell personal information, share it for cross-context behavioural advertising, or use it for targeted advertising. We will not discriminate against you for exercising your rights. You may use an authorised agent to submit a request on your behalf, and we may ask the agent to provide proof of authorisation.

California residents may also request information about disclosures of personal information to third parties for their direct marketing purposes. Netos does not make such disclosures.

8.4 How to make a request

Submit your request through our contact form, mentioning “Privacy Request”. We will verify your identity before acting on a request, and we respond within one month (UK/EEA) or 45 days (US), extended where permitted by law. If your request concerns Customer Data, we will refer it to the relevant customer and assist them in responding.

9. How we protect information

Netos maintains an information security program that has been independently audited against the AICPA SOC 2 framework. Our controls include:

• Encryption: data in transit is protected with TLS 1.2 or higher. Customer Data and backups are encrypted at rest using AES-256.
• Access control: access to the Platform and administrative systems is protected through Cloudflare Zero Trust Access, with least-privilege access and periodic access reviews. Credentials and keys are held in approved secret vaults.
• Segregation: each customer’s environment is isolated, and production networks are segmented.
• Monitoring: threat detection and security monitoring of our infrastructure, including alerting on suspicious activity.
• Resilience: daily encrypted backups and documented business continuity and disaster recovery plans.
• People and vendors: staff confidentiality obligations, security awareness training and policy acknowledgement, and risk assessment of service providers.

No method of transmission or storage is completely secure, but we work continuously to protect your information. More detail is available in our Trust Center.

Security incidents. If we become aware of a personal data breach, we will investigate it promptly. Where required by law, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours, and we will notify affected customers and individuals without undue delay. Customers will be notified of incidents affecting Customer Data in accordance with their agreement and DPA.

10. Children

The Website and Platform are intended for businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

11. Third-party websites

The Website contains links to third-party websites and services. We are not responsible for their privacy practices, and we encourage you to read their privacy policies.

12. Changes to this policy

We review this policy at least annually and when our practices or service providers change materially. We will post the updated policy on this page with a new “Last updated” date. If changes are material, we will provide additional notice, for example by email to customers or by a notice on the Website.

13. Related documents

• Terms & Conditions of Use
• Trust Center, including security documentation and our SOC 2 report (available on request)