Privacy Policy

#

Equatorium Corporation is a Delaware corporation. Equatorium is responsible for the personal data described in this Policy (it is the “controller” or “business” for that data under most privacy laws), except where Section 2 says otherwise. Requests and notices to Equatorium are made by email.

Different people interact with us in different ways, so this Policy is organised around three contexts:

• Data Services. Our “Data Services” are the detection, location and evidence services we provide to our customers through the Platform. To provide them, we license device and location data from third-party data suppliers (“Data Partners”). If you use a mobile device, information about that device may reach us from a Data Partner even though you have never visited our website or heard of us. Sections 3 to 8 explain this processing.
• Platform. Our “Platform” is the secure web application used by our customers, which are government bodies we call “Agencies,” and by Equatorium staff. If you are an employee or contractor of an Agency who holds a Platform account (a “User”), Sections 9 and 10 explain how we handle your information.
• Website. Our “Website” is equatorium.com and its public pages, including the briefing request form, sign-up, public support, Privacy & Legal and “Check a release.” If you visit the Website, request a briefing, apply for an account, or contact our support team, Sections 9 and 10 also apply to you.

Separate notices cover job applicants (Applicant Privacy Notice) and requests made to us by governments and other third parties outside the disclosure process (Requests from Authorities & Third Parties).

#

This Policy does not describe how others handle data, including:

• Agencies’ own use of information. When an Agency views terminal information on the Platform, exports it, or receives a release through our Disclosure Policy, the Agency uses that information for its own regulatory, licensing or legal purposes. Each Agency is an independent controller of the information it receives and is responsible for its own compliance with the laws that apply to it, including its own retention, onward-sharing and individual-rights obligations. Our Terms of Use, Responsible Use & Platform Enforcement Policy and Customer Data Processing Agreement restrict what Agencies may do, but this Policy does not govern an Agency’s activities after information leaves the Platform.
• Data Partners and the apps they work with. Data Partners and the mobile applications and software providers they obtain data from have their own privacy policies and are responsible for the notices and consents they provide to you. We require them to meet our Data Partner Requirements.
• Third-party websites and services. Links from our Website or Platform to other websites, or services you reach through them, are governed by those third parties’ policies.
• Starlink. Equatorium is not affiliated with, endorsed by, or acting on behalf of Starlink or its operator. We do not receive subscriber records from Starlink.

#

Data Partners collect information from mobile devices, typically through mobile applications and the technologies built into them, and make it available to us. We do not collect it directly from your device, and we do not operate consumer apps.

Depending on the Data Partner and the record, we may receive the following categories of information:

We do not ask Data Partners for, and do not seek to receive, names, readable phone numbers, government identifiers, financial account details, health information, biometric data, the content of communications, or information about racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, or sex life or sexual orientation. If we receive any such information by mistake, we delete it. Our Data Partner Requirements prohibit Data Partners from sending it.

Some of the information above can identify you, alone or in combination. Precise geolocation is treated as “sensitive” personal data under many privacy laws. Section 7 explains how this is treated as a “sale” under certain U.S. state laws.

#

Our Data Services are designed to find terminals: Starlink satellite dishes and similar equipment operating in a country, so that the Agency responsible can check them against its licensing records. The object of our analysis is the terminal, not a person. A “terminal record” represents one terminal as we observe it over time.

We identify terminals by automated analysis of the information described in Section 3. Detection is automated: the results reach the Agency without a person at Equatorium reviewing each one, and the Agency decides what, if anything, to do about them.

From that analysis we create and maintain:

• Terminal records, each with a terminal number.
• Location information: an estimated position of the terminal, the area it falls in, and the nearest street address. The nearest address is derived, not verified, and may be wrong.
• History: the places a terminal has been and when it was active there.
• Classification: an assessment of whether the record is likely to be a Starlink terminal, with plain-language reasons.
• Device lists: the devices seen connected through a terminal, with their advertising ID and device information.
• Device places: for some devices, an estimate of the device’s home and work places.

We may combine information from more than one Data Partner, and with reference information such as maps and administrative boundaries, to improve accuracy.

#

We use the information we receive and derive in our Data Services to:

• Provide the Data Services: detect and locate terminals, maintain terminal records, run the scans and alerts that Agencies schedule, answer Agency searches, and prepare releases approved under our Disclosure Policy.
• Maintain quality: measure and improve the accuracy of detection and location, and correct errors.
• Protect people and the service: apply our policies to disclosure requests, including denying requests that concern conflict areas, journalists or other protected activity; detect misuse of the Platform; and secure our systems.
• Honour your choices: keep a record of devices whose users have opted out so that their information is not used again.
• Comply with law: meet legal obligations, respond to lawful requests as described in our Requests from Authorities & Third Parties page, and establish, exercise or defend legal claims.

We do not use the information we receive for our Data Services to market to you, and we do not use information collected through our Website to provide our Data Services.

#

Agencies

We provide Data Services only to Agencies that pass our vetting process and agree to our Terms of Use and Responsible Use & Platform Enforcement Policy. Agencies receive information at two levels:

• Terminal information, available to Agency Users without a disclosure request. This includes a terminal’s estimated location, area and nearest address; when it was active; the reasons for its classification; and the devices seen connected through it, with their advertising IDs and device information. Equatorium does not treat advertising IDs as identity-linked information for the purposes of the Disclosure Policy, but they are personal data and are covered by this Policy.
• Identity-linked information, available only through an approved disclosure. Hashed contact identifiers, consent information, network prefixes, Wi-Fi access point identifiers, device details released as evidence, and device home and work places are made available to an Agency only through our Disclosure Policy, which requires a stated legal basis and review by Equatorium.

Agencies may use information they receive for spectrum licensing, enforcement of licensing requirements and other purposes within their mandate as approved by Equatorium, in each case as permitted by our terms and the law that applies to them. Agencies may combine what they receive with other information they hold, including information that identifies individuals.

Service providers

We disclose information to service providers that host, store, process or secure data for us under contracts that limit their use of it to providing services to us. The current list of our sub-processors and Data Partners is available on request from legal@equatorium.com.

Legal, safety and protection

We may disclose information where we believe in good faith it is required by law, regulation or valid legal process, or necessary to protect the life, safety or rights of any person, to detect and prevent fraud or security incidents, or to establish, exercise or defend legal claims. Requests from governments that are not Agencies using the Platform are handled under our Requests from Authorities & Third Parties page.

Business transfers

If we are involved in a merger, acquisition, financing, reorganisation, sale of assets, or insolvency or similar proceeding, information may be disclosed or transferred as part of that transaction, subject to this Policy or protections at least as strong.

Affiliates

We may share information with companies under common control with Equatorium, who must handle it in line with this Policy.

#

Notice: We sell personal data, including sensitive personal data (precise geolocation).

Agencies pay us for access to our Data Services. Because the information Agencies receive includes device identifiers, network information and precise geolocation linked to devices, our provision of the Data Services is a “sale” of personal data, and of sensitive personal data, as those terms are defined under several U.S. state privacy laws, and may be treated similarly under other laws. In the preceding twelve months, the categories of personal data we have sold or made available in this way are:

• identifiers (advertising IDs, network information, and, through approved disclosures, hashed contact identifiers);
• precise geolocation (terminal locations and, through approved disclosures, device home and work places);
• internet or network activity (including, through approved disclosures, Wi-Fi access point identifiers);
• device information; and
• inferences (classifications and estimated places).

The categories of third parties to whom we sell this information are government Agencies that subscribe to the Platform. We do not sell personal data about Platform Users, Website visitors, briefing requesters or support contacts.

You can opt out of the sale of your device’s information, and request deletion, as described in Section 11 and on our Your Privacy Choices page.

#

• We do not include names in releases, and we do not resolve hashed contact identifiers or other identifiers to names on behalf of Agencies.
• We do not use Data Services information to make or support decisions about credit, employment, housing, insurance, education, healthcare or eligibility for benefits, or to set prices.
• We do not use Data Services information to market to individuals, to build advertising audiences or to target advertising.
• We do not sell or license Data Services information to data brokers, advertisers, marketers or other commercial resellers.
• We do not allow Agencies to use the Platform to monitor journalists, human rights defenders, political activity, religious practice or other protected activity, and requests concerning conflict areas are denied. See our Responsible Use & Platform Enforcement Policy.
• We do not approve a disclosure request automatically because time has run out.
• We do not knowingly process information about children (see Section 15).

#

This section applies to Agency Users, Equatorium staff using the Platform, Website visitors, people who request a briefing or apply for an account, and people who contact our support team.

If you provide information about another person, for example by inviting a colleague, naming an assignee or uploading a court order, you confirm that you are entitled to do so.

#

How we use it

• To vet briefing requests and sign-ups, confirm that applicants act for a genuine public authority, and create and manage accounts.
• To provide the Platform: run searches, scans, alerts, tasks, disclosures, exports and Quant, and show each User only what their role permits.
• To bill Agencies, process payments, manage credits and subscriptions, and keep financial records.
• To provide support, including calling you back when you ask us to.
• To send service messages, such as sign-up and security emails, task and alert notifications, billing notices and policy changes, at the frequency you choose where a choice is offered.
• To keep audit logs so that Agencies and Equatorium can see who did what and when.
• To secure the Platform, prevent fraud and abuse, enforce our terms, and investigate misuse.
• To understand how the Platform is used and improve it.
• To comply with law and establish, exercise or defend legal claims.

Who we share it with

• Your Agency. Administrators at your Agency can see your account details, role and activity in the audit log. They cannot see your Quant conversations.
• Service providers that host, authenticate, process payments, send email, provide maps and power Quant for us. The current list is available on request from legal@equatorium.com.
• Legal and safety recipients as described in Section 6.
• Business transfer recipients as described in Section 6.
• Others with your consent or at your direction.

We do not sell Platform or Website information, and we do not share it for cross-context behavioural advertising.

Marketing

We may send business contacts information about our services where the law allows. You can unsubscribe at any time using the link in the email or by writing to privacy@equatorium.com. We will still send service messages that are needed to run your account.

Quant, the AI assistant

When you ask Quant a question, your question, the organisation data Quant reads to answer it and Quant’s reply are processed by an AI model provider acting as our sub-processor. Only you can see your conversations, and you can delete them at any time. About Quant, the AI Assistant explains what is sent and how long it is kept.

Cookies

We use only cookies and similar technologies that are needed to sign you in, keep the Platform secure, process payments and remember your preferences. We do not use advertising or analytics cookies. See our Cookie & Similar Technologies Notice.

#

If information about your device may be in our Data Services

• Opt out and delete. Email privacy@equatorium.com with your device’s advertising ID. We will stop using and selling information linked to that advertising ID, delete the records we hold for it, and keep a record of the opt-out so the information is not used again.
• Opt-outs are device-specific. An opt-out applies to the advertising ID you give us. If you use more than one device, send a request for each. If you reset your advertising ID, the new ID is not covered and you will need to send a new request.
• Device settings. You can limit the information available to Data Partners by turning off location services for apps you do not trust, deleting or resetting your advertising ID or limiting ad tracking in your device settings, and reviewing the privacy settings of the apps you use.
• Access. You may ask us to confirm whether we hold information associated with your advertising ID and to provide a copy.

Records already released to an Agency before your request are held by that Agency as an independent controller. We cannot delete them, but our deletion stops any further disclosure by us.

If you are a Platform User, Website visitor or support contact

You may ask to access, correct, delete or receive a copy of your information, or object to or restrict certain uses, by emailing privacy@equatorium.com. Agency Users can update much of their information in their account settings; some requests, such as deleting a User, are handled through your Agency’s administrator.

How we handle requests

We will verify requests in a way appropriate to the information involved, respond within the time required by applicable law, and not discriminate against you for exercising your rights. You may use an authorised agent where the law allows. If we decline a request, we will explain why and how to appeal. Details are on our Your Privacy Choices page and in the regional notices.

#

Sensitive data

Precise geolocation, and estimates of where a device is at home or at work, are sensitive. We limit their use to the purposes in this Policy, restrict access by role, and make device places available only through our Disclosure Policy. We do not seek to collect any other category of sensitive data, and we do not infer characteristics such as health, religion, ethnicity, political views or sexual orientation from location data. Where location may reveal attendance at a sensitive place, we do not label or report it as such.

Automated processing

Our automated analysis produces classifications and reasons. These are information for the Agency, not decisions. Equatorium does not make any decision that produces legal or similarly significant effects for an individual. Every disclosure is reviewed by people under our Disclosure Policy, and any enforcement or licensing action is decided by the Agency under its own legal authority and procedures.

#

Equatorium and many of our service providers are located in, or host data in, the United States. Data Partners may provide information about devices located in many countries, and Agencies are located in many countries. As a result, personal data is transferred to and processed in countries other than the one where it was collected, which may not provide the same level of protection.

Where the law requires, we protect transfers with appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent mechanisms recognised in the relevant country. Equatorium is not certified under the EU-U.S. Data Privacy Framework. You may request a copy of the relevant safeguards by contacting us.

We do not sell, provide access to or otherwise transfer Data Services information to countries of concern or covered persons as defined in 28 CFR Part 202, and our Terms of Use prohibit Agencies from doing so.

#

We use administrative, technical and physical safeguards designed to protect personal data against loss, misuse and unauthorised access, disclosure, alteration and destruction, taking into account the sensitivity of location data. They include:

• encryption of data in transit;
• role-based access, so each User sees only what their role and Agency permit, and data of one Agency is never visible to another;
• two-step verification for Platform accounts;
• an audit log of changes made on the Platform;
• release of identity-linked data only under our Disclosure Policy;
• limited access for Equatorium staff, based on their role;
• vetting of Agencies before accounts are activated; and
• confidentiality obligations for staff.

No security measure is perfect, and we cannot guarantee that information will never be accessed, disclosed or altered without authorisation. We maintain procedures for responding to suspected incidents, and we will notify affected Agencies, individuals and regulators where the law requires. Please report security concerns to security@equatorium.com.

#

Retention

We keep personal data only as long as needed for the purposes described in this Policy, unless a longer period is required by law or to resolve disputes. For example, release contents are deleted when the release window shown on the release ends; Quant conversations are kept for 90 days after their last message; and account information is kept for the life of the account plus 2 years. Other periods are set in our retention settings, within the limits or using the criteria given for each kind of record in our Data Retention Schedule.

Children

Our Website and Platform are intended for officials of government Agencies and are not directed to children. We do not knowingly collect or process personal data about children. Our Data Partner Requirements require Data Partners to exclude data about users under 16 (or any higher age set by local law) and data from apps directed to children. If we learn that we hold information about a child, we delete it. If you believe we may hold such information, contact privacy@equatorium.com.

#

Additional information and rights apply depending on where you live:

• United States. Residents of U.S. states with comprehensive privacy laws should read our U.S. State Privacy Notice.
• European Economic Area, United Kingdom and Switzerland. See our EEA, UK & Swiss Privacy Notice for our lawful bases, your rights and how to complain to a supervisory authority.
• Other countries. Local law may give you more rights. See Country-Specific Privacy Information for how to ask us about the law where you live.

Where a regional notice conflicts with this Policy for residents of that region, the regional notice prevails.

#

We may update this Policy to reflect changes in our practices, legal requirements or services. We will post the updated Policy here and change the “Last updated” date. If we make material changes, we will give notice before they take effect, for example by email to Agency Users, by a notice on the Platform, or by a prominent notice on the Website. Where the law requires your consent to a change, we will ask for it.

#

If you have questions or complaints about this Policy or our privacy practices, or wish to exercise your rights, contact our privacy team at privacy@equatorium.com.

Details of our representatives in the EU and the UK, where one is required, are available on request to legal@equatorium.com. Requests and notices to Equatorium are made by email. Agency Users with account or Platform questions should use in-app Support; others can reach our support team at /support/public.