Privacy Policy

Last updated: July 11, 2026

KreweCatch (krewecatch.ai) is operated by New Orleans & Southeast IT Group ("NO & SE IT Group", "we", "us"), a Louisiana managed IT and cybersecurity provider. KreweCatch exists to help you triage suspicious links, messages, and files. This policy explains what we handle when you use it, what we deliberately do not collect, and the choices you have.

The short version: we analyze what you submit so we can give you a verdict, we don't sell anything to anyone, we use no cookies and no ad tracking, and the only times we keep your contact details are when you ask a human for help or sign up for alerts you can leave in one click.

1. What we process, and why

Threat submissions (links, domains, email text, file hashes you paste into Catch a Threat): processed to analyze the threat and return a verdict. Submissions are processed in memory and are not currently written to any database.
Uploaded files: hashed on our server the moment they arrive. The file is never executed and its contents are not retained after your request completes — only the cryptographic hash is checked against threat-intelligence sources.
Deep-analysis requests (optional): if you explicitly ask us to detonate a file, that file is shared with the sandbox provider (Hybrid Analysis) with your consent, and the email address you give us is used to send you that one report — then removed from the job record once the report is sent or the job expires.
Bouncer chat messages: processed to generate the Bouncer's replies. Not currently stored.
"Talk to a Human" requests (your name, how to reach you, urgency, and your message): used to create a support ticket in our service-management system so a real person can respond. This is the one place where we keep contact information, because you asked us to contact you.
Alert subscriptions (optional): if you sign up for threat alerts, we store the email you provide and the watch list you choose (industry, domains, vendors) so we can send exactly those alerts. Alerts start only after you confirm by email (double opt-in). Unsubscribing — one click, in every email — removes both your email and your watch list.
IP addresses: used briefly, in memory, for rate limiting and abuse prevention. They are not written to storage.

2. Service providers we share with

We use a small set of processors, each of which receives only what it needs:

Anthropic — our AI provider. Submissions and chat messages are sent to Anthropic's API to generate the analysis and responses. Under the commercial API terms we use, Anthropic does not train its models on this data.
Threat-intelligence services (such as VirusTotal, abuse.ch, Hybrid Analysis, eCrime.ch, and ransomware.live) — receive only the indicator being checked (a URL, domain, or file hash), never your identity or your message text. The one exception: a file you explicitly submit for deep analysis is shared with the sandbox provider, with your consent, at the point of upload.
Microsoft Azure — hosts the site and its backend.
Our service-management platform (Kaseya Autotask) — stores "Talk to a Human" tickets so our team can respond.

We never sell your information. We disclose it beyond the processors above only if the law requires it.

3. Cookies, analytics, and tracking

KreweCatch sets no cookies and uses no advertising, retargeting, or cross-site tracking of any kind. If we add usage analytics in the future, they will be first-party and aggregate — counts of what features get used, not profiles of who used them — and this policy will be updated first.

4. What we may store in the future

To improve detection quality, we plan to keep records of submissions and verdicts. When that feature turns on, stored copies will be scrubbed of personal information (emails, phone numbers, account numbers, credentials, and similar are redacted before writing) and IP addresses will be stored only as salted one-way hashes. Optional deep file analysis (sandbox detonation) works as described in section 1: only files you explicitly submit are shared with the sandbox provider, and we say so clearly at the point of upload.

5. Retention

Threat submissions, chats, and uploaded files: not retained today (see section 4 for what changes if storage is enabled; scrubbed records would be kept for up to 12 months).
"Talk to a Human" tickets: retained in our service-management system as business records for as long as we need them to support you and meet our obligations.
Alert subscriptions: kept while your subscription is active; removed when you unsubscribe.

6. Security

Traffic is encrypted in transit (TLS). Backend credentials are stored in managed secret stores, access is scoped to least privilege, and inputs are screened for prompt-injection attacks before they reach the AI. No system is perfectly secure, but this one is built by people who do security for a living.

7. Your choices and rights

Don't submit what we don't need. Never paste passwords, full account numbers, or other sensitive personal details into the analyzer or chat — redact first. The verdict will be just as good.
You can ask us to access, correct, or delete the information in a "Talk to a Human" ticket you submitted — contact us below.
Depending on where you live, you may have additional privacy rights (for example under the GDPR or state privacy laws). We will honor valid requests.

8. Children

KreweCatch is not directed to children under 13, and we do not knowingly collect personal information from them.

9. Changes to this policy

If we change what we collect or how we use it, we will update this page and the date at the top before the change takes effect.

10. Contact

Questions or requests: privacy@noitgroup.com, or reach us through noitgroup.com.