Effective date: October 19, 2026 · Last updated: October 19, 2026

1. Who we are

This Privacy Policy explains how Global Spectrum Consultants LLC, doing business as GSC Identity (“GSC Identity,” “we,” “us,” or “our”), collects, uses, shares, and protects personal data in connection with the GSC Identity suite — including Mission Control, IDENTA, Aurelium, and Identity Vault — our websites, our Microsoft commercial marketplace offers, and related services (together, the “Services”). Our address is 2500 Wilcrest Dr, Ste 300, Houston, TX 77042, United States.

2. Our roles: controller and processor

As a processor / service provider. When business customers use our enterprise products, they connect their own directories and systems. We process that customer data (for example, employee names, user principal names, group memberships, entitlements, and activity logs) only on the customer’s documented instructions and under our agreement with them. The customer is the controller of that data; individuals should direct requests about it to their employer or organization.

As a controller. We are the controller for personal data we collect directly — for example from website visitors, prospective customers, business contacts, account administrators, and consumers who use Identity Vault.

3. Personal data we collect

We collect the categories of personal data below, grouped by where they come from.

From our website

Contact details you submit (name, work email, company, phone) and technical data such as IP address, browser and device type, pages viewed, and referral source.

From account creation and subscription activation

Account identifiers and credentials, administrator contact details, organization name, and sign-in identifiers, including Microsoft Entra ID tenant and object identifiers used to authenticate and provision your account.

From the SaaS platform (Mission Control, IDENTA, Aurelium)

Customer content that you connect or that the Services process on your behalf: directory and identity records, group and role memberships, entitlements, policies, and access events across connected providers such as Okta, Microsoft Entra, and SailPoint.

From identity workflows

Records of identity lifecycle actions — access requests, approvals, provisioning and deprovisioning, certifications, and remediation — including who requested, approved, and performed each action, and when.

From agents, connectors, and integrations

Configuration data, service-account and API credentials (stored encrypted), connection metadata, and the data returned by connected systems that you authorize an agent, connector, or integration to read or write.

From analytics, logs, and telemetry

Application and security logs, usage and feature metrics, performance and diagnostic telemetry, and error reports used to operate, secure, and improve the Services.

From Microsoft commercial marketplace fulfillment

Subscription, plan, purchaser, and tenant details that Microsoft provides to fulfill a marketplace transaction. Payment card data is handled by Microsoft, not by us.

From Identity Vault (consumer product)

Email addresses and sign-in services you choose to connect, the account inventory we build from them, breach-match results, and your preferences.

From communications

Support requests, feedback, and other correspondence you send us.

4. How we use personal data

• Operational use — to provide, operate, maintain, and secure the Services.
• Identity lifecycle processing — to execute the access requests, approvals, provisioning, certifications, and remediation you configure.
• Authentication and authorization — to verify users and control access, including through Microsoft Entra ID sign-in.
• Customer support — to respond to requests and troubleshoot issues.
• Compliance and auditing — to maintain audit trails, generate evidence, and meet legal and regulatory obligations.
• Service improvement — to analyze usage and improve the Services, using aggregated or de-identified data where practical.
• Marketplace fulfillment — to activate, manage, and bill subscriptions purchased through the Microsoft commercial marketplace.
• Security and fraud prevention — to detect, investigate, and prevent abuse, fraud, and security incidents.
• Communications — to send service and administrative notices and, where permitted, marketing you can opt out of at any time.

5. AI processing

Some features use AI models to analyze identity data and generate recommendations. We apply data minimization and PII redaction before data is sent to a model, and recommended actions are presented for human approval rather than applied automatically. Customers can restrict which models are used, including limiting processing to self-hosted models. We do not use customer content or Identity Vault data to train third-party AI models.

6. How we share personal data

We do not sell personal data, and we do not share it for cross-context behavioral advertising. We share personal data only with:

• Third-party processors / subprocessors that host or support the Services, under written agreements requiring appropriate protection;
• Cloud hosting providers, principally Microsoft Azure, which provides our infrastructure;
• Microsoft, as required to fulfill commercial marketplace transactions;
• Security and compliance partners that help us monitor, test, and audit the Services, under confidentiality obligations;
• Professional advisers (legal, accounting, insurance), under confidentiality obligations;
• Authorities, when required by law or to protect rights, safety, and security; and
• A successor entity in a merger, acquisition, or asset sale, subject to this Policy.

A current list of subprocessors is available on request at info@globalspectrumconsultants.com.

7. Cookies and tracking technologies

We and our service providers use cookies and similar technologies on our websites and in the Services.

• Essential cookies — required to operate the site and keep you signed in; these cannot be switched off.
• Functional cookies — remember preferences and settings.
• Analytics and performance cookies — help us understand page views, feature usage, and performance so we can improve the Services.

Session management. We use secure session cookies and tokens to authenticate users, maintain sessions, and protect against cross-site request forgery.

Analytics tools. We use first-party and privacy-respecting analytics to measure usage. We do not use cookies for cross-context behavioral advertising.

Your controls. You can accept or reject non-essential cookies through our cookie banner, and manage or delete cookies in your browser settings. Where required, we honor recognized opt-out preference signals such as Global Privacy Control (GPC).

8. Data retention

We keep personal data only as long as needed for the purposes described in this Policy, to comply with legal obligations, resolve disputes, and enforce agreements. Customer content is deleted or returned within 30 days after a subscription ends unless the customer requests otherwise or law requires longer retention. Identity Vault users can delete their data at any time. Security and audit logs may be retained longer where required for security and legal obligations.

9. Security protections

We maintain administrative, technical, and organizational safeguards designed to protect personal data, including:

• Encryption of data in transit (TLS) and at rest;
• Access controls — least-privilege access, role-based permissions, tenant isolation, managed identities, and secrets stored in a managed key vault;
• Monitoring — logging, anomaly detection, and tamper-evident audit trails; and
• Data retention limits as described in Section 8.

Breach procedures. We maintain an incident response program. If a personal-data breach occurs, we will notify affected customers and, where required, individuals and regulators without undue delay and consistent with applicable law and our customer agreements. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. International data transfers

We are based in the United States and primarily host data in U.S. Azure regions. Where we transfer personal data from other regions, we use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses.

11. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or port your personal data, to object to or restrict certain processing, to withdraw consent, and to opt out of marketing and of any “sale” or “sharing” of personal data (we do neither). California residents have rights under the CCPA/CPRA, and individuals in the EEA and UK have rights under the GDPR. We will not discriminate against you for exercising these rights.

To make a request, email info@globalspectrumconsultants.com with the subject “Privacy Request.” We may need to verify your identity. If your data was provided by your employer through our business products, we will refer your request to that organization (the controller).

12. Children’s privacy

The Services are intended for businesses and are not directed to children under 13, and we do not knowingly collect their personal data. Minors may be added to an Identity Vault Family plan only by a parent or legal guardian, who controls that data.

13. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here and update the “Last updated” date, and for material changes we will provide additional notice by email or in the product.

14. Contact us

Global Spectrum Consultants LLC — GSC Identity, Attn: Privacy
2500 Wilcrest Dr, Ste 300, Houston, TX 77042, United States
Email: info@globalspectrumconsultants.com
Support: globalspectrumconsultants.com/identity/support
Phone: 1-888-923-1083