Sentinel
Sign in

Legal

Privacy Notice

Effective date: 2025-09-01 · Last updated: 2026-04-21 · Version 1.0

This Privacy Notice describes how Artorias, Inc. ("Artorias," "we," "us," "our"), a Delaware corporation with principal offices at 169 Madison Avenue, STE 11590, New York, NY 10016, collects, uses, discloses, and protects personal information in connection with Artorias Sentinel ("Sentinel," "Platform"). It incorporates the Artorias master Privacy Notice published at artorias.com/privacy and supplements it with Sentinel-specific disclosures required for operation as a Department of War (DoW) Publicly Available Information (PAI) Alerting Service.

Summary. Sentinel is a U.S. Government Information System. Operators have no expectation of privacy when using it. The Platform processes only unclassified, publicly available information. Information retained about Operators is the minimum necessary to operate the service. We do not sell, lease, or share personal information with unaffiliated third parties for marketing or unrelated commercial purposes.

1. Scope

This Notice applies to the collection and use of personal information through the Sentinel Platform (the web application at app.sentinel.artorias.com, the mobile applications, and the supporting APIs), and to the public pages at sentinel.artorias.com. For information about the Artorias corporate website, consult the master Artorias Privacy Notice.

2. Information we collect

2.1 Information you provide directly

  • Identity & contact — name, username, government email address, phone number (where provided), job title, sponsoring command or agency, professional background.
  • Account configuration — watchlists, mission profiles, geofences, appearance settings, notification preferences, saved items.
  • Support communications — the content of any support ticket, email, or feedback you submit.

2.2 Information collected automatically

  • Authentication & session — access and refresh tokens, device identifier, session start/end timestamps, IP address, user-agent string.
  • Audit events — sign-in events, authorization decisions, administrative actions, and material user actions taken inside the Platform.
  • Telemetry — aggregate performance, latency, and error metrics. Crash reports are retained for defect analysis and pruned on a short cadence.
  • Push-notification tokens — the opaque device token issued by Apple or Google, required to route CRITICAL alerts to your device.

2.3 PAI content surfaced through the Platform

Sentinel ingests, enriches, and distributes publicly available information from open channels (RSS, public social-media endpoints, public Telegram channels, publicly posted darknet content, and similar). Operators are prohibited from uploading, pasting, or otherwise submitting classified information, Controlled Unclassified Information (CUI), or personally identifiable information beyond what is required to configure their account. See the Terms of Service §6.

2.4 Categories we do not collect

We do not knowingly collect biometric data, geolocation derived from the device beyond coarse IP-level information, audio or sensory recordings, student records, protected-classification characteristics (race, religion, etc.), commercial transaction history, or inferences used for consumer profiling.

3. How we use information

We process information to:

  • Provision, authenticate, and route access to the Platform.
  • Deliver the alerting capability (near-real-time push notifications, WebSocket streams, tailored feeds based on Operator watchlists and geofences).
  • Enforce access controls, acceptable-use rules, and the annual DoWD 3115.18 acknowledgement regime.
  • Operate audit and monitoring required for federal security compliance (FAR 52.239-1, DFARS 252.204-7012, DFARS 252.239-7010).
  • Provide 24/7/365 operational support and respond to inquiries.
  • Defend the Platform against abuse, fraud, and security incidents.
  • Comply with legal obligations, court orders, and contractual obligations to the Sponsor.

4. Legal bases for processing (GDPR/UK)

Where GDPR or UK GDPR applies, we rely on one or more of: performance of a contract with the Sponsor or Operator, legitimate interests in securing and operating the Platform, compliance with legal obligations, consent where required, and protection of vital interests.

5. Disclosures

We do not sell, lease, or share personal information with unaffiliated third parties for marketing or unrelated commercial purposes. We may disclose personal information:

  • To the Sponsor — your sponsoring command, agency, or contracting officer, as needed for identity vetting, audit, and access management.
  • To service providers — cloud infrastructure (AWS GovCloud), identity providers (Sponsor-controlled SAML IdPs), and narrowly scoped enrichment providers, under written confidentiality and security obligations.
  • For legal process — in response to a subpoena, court order, or other lawful demand, or to establish, exercise, or defend legal claims.
  • In a business transfer — in connection with a corporate merger, acquisition, reorganization, or similar transaction, subject to the surviving entity honoring this Notice.
  • With Operator consent — for any other purpose disclosed at the point of collection and with affirmative consent.

6. AI and automated processing

The Platform uses artificial-intelligence and machine-learning models (including large language models, classification models, and translation models) to enrich, categorize, translate, and score PAI items. These models operate on source content and do not make decisions with legal or similarly significant effects on Operators. Model outputs are advisory; Operators are responsible for validating any inference before acting on it.

7. Data retention

We retain personal information for as long as it is necessary to fulfill the purposes described in this Notice or as required by law, contract, or audit obligation. Specifically:

  • Operator configuration (watchlists, profiles, geofences) is retained while the account is active and deleted within 90 days of account deactivation, subject to contracting-officer holds.
  • Audit logs are retained for a period sufficient for security and compliance review and in accordance with the underlying contract.
  • Crash and telemetry data are aggregated or purged on a short cadence.
  • Incidentally-surfaced U.S. person information is handled under DoWM 5240.01 minimization procedures and purged within the shortest retention window authorized by policy.

8. International transfers

Sentinel is hosted in the United States (AWS GovCloud, us-gov-west-1). If we process personal information from outside the United States, we apply appropriate safeguards (such as Standard Contractual Clauses) to any transfer out of the country of origin. Operators accessing the Platform from outside the United States do so at their own risk and consent to transfer to the United States.

9. Security

Artorias implements appropriate and reasonable technical and organizational safeguards to protect personal information, including NIST SP 800-171 controls, TLS 1.2+ in transit, customer-managed KMS keys at rest, network segmentation, and a 24/7/365 security response posture. No electronic transmission or storage is 100% secure. Operators should use Platform credentials only from sanctioned devices and networks consistent with their Sponsor's guidance.

10. Your rights

Depending on the laws applicable to you, you may have the right to:

  • Request access to personal information we hold about you.
  • Request correction of inaccurate or incomplete personal information.
  • Request deletion of personal information, subject to contracting-officer holds and statutory-retention obligations.
  • Request data portability in a structured, commonly used format.
  • Object to or restrict certain processing, including automated decision-making (where applicable).
  • Withdraw previously given consent, where consent is the legal basis for processing.
  • Lodge a complaint with a supervisory authority — for EU/UK residents, your national data-protection authority.
  • Non-discrimination — we will not discriminate against you for exercising a right under applicable privacy law.

To exercise any of these rights, email privacy@artorias.com from the account associated with your request. We will respond within the timeline required by applicable law.

11. State-specific disclosures (US)

California, Virginia, Colorado, Connecticut, Utah, and other U.S. state residents. You may exercise the access, deletion, correction, and portability rights described in Section 10, in addition to the right to opt out of the "sale" or "share" of personal information as those terms are defined by applicable state law. We do not sell personal information and do not share it for cross-context behavioral advertising.

"Do Not Track" signals. We do not currently respond to DNT browser signals or any other mechanism that automatically communicates a choice not to be tracked online.

12. Children's information (COPPA)

Sentinel is not directed to children. We do not knowingly collect, solicit, or market to children under 18 years of age.

13. Third-party sites

The Platform may contain references to third-party websites or services whose privacy practices are governed by their own policies. We are not responsible for those policies. Per Terms §4, Sentinel does not directly hyperlink to external sources — URLs are rendered as text only.

14. Changes to this Notice

We may update this Notice from time to time. Material changes will be notified via the Platform, via the Sponsor, or via prominent posting at sentinel.artorias.com/privacy.html. Continued use after a change constitutes acceptance of the revised Notice.

15. Contact

Canonical versions of Artorias corporate-level privacy terms are published at artorias.com/privacy. Where this Sentinel-specific Notice differs from the master Notice, this Notice controls for access to and use of the Platform.