Product and Services Privacy Notices

Security Data may include:

• Emails reported as potential threats (1 year)
• Malware Detections chosen to be reported (up to 3 years)
• File backups as selected by User (if purchasing/using Norton Online Backup) (encrypted)

Location Data may include:

• IP Address (36 months)
• Approximate Location derived from IP address (50 months)

Device Data may include:

• Product Serial Number (while active or 36 months)
• Internal installation identifiers (50 months)
• Operating system version and settings (50 months)
• Device manufacturer and model (50 months)
• Device names and/or assigned names (50 months)
• Device identifiers including MAC address (while active or 50 months)
• Internal Device identifiers - Norton Machine ID (36 months)
• Other security software and apps running on the device, including our apps (36 months)
• Browsers installed and default browser (50 months)

Security Data may include:

• URLs/Websites visited and associated metadata (36 months)
• Files identified as potential or known malware (36 months)
• Application names and versions (36 months)
• File metadata including file paths (36 months)

Service Data may include:

• Network data and connection activity (36 months)
• User interactions with Norton websites and Norton extensions download pages (26 months)
• Emails if Norton Safe Email is enabled (not stored)
• Events and product usage such as number and result of scans, error logs and screen flows (50 months)
• Failure diagnostics including crash dumps and system logs (36 months)

Location Data: This data is used to determine appropriate language settings for communicating with you and for determining country of origin for threats detected.

Device Data: This data is used and generated internally at Gen for the purpose of tracking account activity between internal company systems, applications, and architecture. It is also used to deliver the product in accordance with your device(s) as well as tracking and determining trends in threats detected and communicating about potential solutions to detected threats.

Security Data: This data is used to deliver the product by informing you about site safety and blocking browsing to unsafe websites, improving the detection of malware and cyber-threats (e.g., through file sample analysis), and pursuing general cybersecurity research.

Service Data: This data is used to understand product usage and to further develop and improve the product performance, communicating about potential solutions to detected threats as well as telemetry.

• Failure diagnostics including crash dumps and system logs (36 months)

If purchasing the Norton 360 App through the eStore, please see the Norton Enrollment Process for additional information. If purchasing through the Apple AppStore or Google PlayStore, please see the below information.

Account Data may include:

• Email (while active or 36 months)
• Norton account password (while active or 36 months)
• Country (while active or 36 months)

Device Data may include:

• IP Address (36 months)
• Mobile device identifiers (while active or 36 months)
• Internal identifiers including installation ID (50 months)
• Device name and type (while active or 36 months)
• Operating system platform and version (while active or 36 months)
• Approximate Location derived from IP Address (50 months)

Security Data may include:

• Files identified as potential or known malware (36 months)
• File metadata including file paths (36 months)
• Applications including characteristics such as permissions, signing certs, package and library info, app versions (36 months)
• File and application data (limited to App store data, applications downloaded, and browsing data. iOS devices will also collect malicious links from calendar invites) (36 months)
• Web-browsing and URLs accessed (36 months)
• If the SMS security is enabled, text messages with malicious URLs or sent by senders not in your contact list are collected and analyzed for threats. The text messages are deidentified, meaning we do not connect them to our customers. These texts may include data such as: phone numbers, emails, crypto, or other identifiers associated with the text message. Includes identifiers offered to user as target for user’s requested response. (URLs and other sender identifiers are stored up to 5 years since the last sighting for suspected malicious data or 1 year since sighting for unknown data, text messages are kept for 30 days and then personal information is removed and the result is kept for 1 year)

Service Data may include:

• Events and product usage such as number and result of scans, network service information, download and use frequency, log data) (36 months)
• Error reports/crash dumps (36 months)
• Device/phone settings (including but not limited to device model and manufacturers) (50 months)

Service Data may include:

• Reporting data based on metadata collected by product (limited to number of Users by general geolocations/regions, and operating systems) (25 months)

Account Data may include:

• Norton AntiTrack does not require you to provide any data outside of the enrollment and billing processes.
  
• If you choose to use the Private Email feature, you may provide additional email addresses (36 months)

Service Data may include:

• Browser activity (not stored)
• Cookie origin domain (not actual content of cookies) (not stored)
• Reported URL problems (36 months)
• Domain with trackers and fingerprints that user reviewed, added or removed from exclusion for detection through the app (36 months)
• Emails, if Private Email is enabled (not stored)
• Crash/hang dumps and Error reports (90 days)
• Reporting data based on metadata collected by product (36 months)
• Usage data to assist with debugging a problem with the service (36 months)
• Usage information (36 months)
• Aggregated statistics about trackers and fingerprints blocked (36 months)
• License identifier (36 months)

Device Data may include:

• Operating system version and language (36 months)
• Web browser name, version, language (36 months)

• Reporting data based on metadata collected by product (e.g., number of Users by browser types, general geolocations/regions, and operating systems) (36 months)

Account Data may include:

• Username(s) (while active or 6 months)
• Password(s) (while active or 6 months)
• Phone number (while active or 6 months)
• Physical address(es) (including city, state, and postal code) (while active or 6 months)
• Additional payment information (Credit/Debit Card Information, specifically account numbers, card type, and expiration dates; bank account number and name of bank) (while active or 6 months)
• Gender (including title) (while active or 6 months
• Additional email(s) (while active or 6 months)
• Date of birth (while active or 6 months)
• Freeform notes / text (while active or 36 months)

Location Data may include:

• IP address (not stored) 
• Geolocation (26 months)

Device Data may include:

• Web browser type/version (26 months)
• Product version and preferred language (26 months)
• Operating system (Including version or platform) (26 months)
• Website domains for stored logins (while active or 36 months)
• Free form text (as provided by User) (while active or 36 months)

Service Data may include:

• Metadata (including number of accounts stored with products and number of websites visited, number of product features used) (26 months)

Location Data: This data is processed for the purposes of determining appropriate language settings for communicating with the User and for reporting about product usage based on general location.

Device Data: This data is processed for the purpose of delivering the product in accordance with your device(s) and by providing login services and analyzing product usage.

Service Data: This data is for the purpose of understanding product usage to further develop and improve the product performance as well as telemetry.

Security Data may include:

• Potentially compromised passwords (specific usernames/passwords are never known to Gen services nor to third parties) (while active or 36 months)

Account Data may include:

• Norton VPN does not require Users to provide any data outside of the enrollment and billing processes

Account Data: Norton Secure VPN does not require Users to provide any data outside of the enrollment and billing processes, so no additional personal data is processed.

Device Data may include:

• Install and device identifier (while active or 36 months)
• Device name and type (while active or 36 months)
• OS version (while active or 36 months)
• Language (while active or 36 months)

Security Data may include:

• Aggregate bandwidth usage (limited to the number of bytes transferred using the service) (while active or 36 months)

Diagnostic Data may include:

• Error state in installation/usage of app (Install Identifier from app to give error status) (while active or 36 months)
• Data to assist with debugging connectivity problems (device identifier from app) (7 days)
• Crash reports (24 months)
• Connection and application events (24 months)
• Timestamps (35 days)

VPN Service Data may include:

• Data to monitor compliance with the terms of use (if suspicious patterns are detected or blocked: device identifier from app, frequency of abuse of services) (7 days)

Application Data may include:

• License identifier (while active or 36 months)
• IP address (not stored)

Device Data: This data is processed for the purpose of delivering the product and content in accordance to your device(s).

Security Data: This data is used for billing the account for the product used as well as network operations and support.

Diagnostic Data: This data is used for research and development to improve products and services and to better protect your network, devices, data, and identity.

VPN Service Data: This data is used to prevent abuse of services, to protect our network, and ensure compliance with the terms of use.

Application Data: This data is used for the purpose of (a) delivering the product by selecting the most appropriate server to connect to, and (b) to prevent abuse of services to protect our network and ensure compliance with the terms of use.

Service Data may include:

• Reporting metadata on product and application usage (while active or 36 months)

Service Data: This data is used to help us understand product usage and to further develop and improve product performance as well as telemetry.

Account Data may include:

• Norton Utilities does not require Users to provide any information outside of enrollment and billing processes

Location Data may include:

• IP address (not stored)

Device Data may include:

• Activation data (limited to status of installation of product on device) (not stored)
• Device ID (not stored)

Service Data may include:

• File meta data - checksum, archive_state, created_date, modified_date, folder_path, file_name, file_size, file_type, file_id and thumbnail_link (24 hours)
• User reviews/feedback (not stored)

Location Data: This data is processed for the purposes of determining appropriate language settings for communicating with you.

Device Data: This data is used for the purpose of providing the service and delivering the product in accordance with your device(s).

Service Data: This data is used for the purpose of providing the service and understanding product usage to further develop and improve the product performance as well as telemetry.

Service Data may include:

• Metadata based on User reviews/feedback (not stored)

Account Data may include:

• Child name (while active or 60 days)
• Restriction level (child’s age range) (while active or 60 days)
• Picture (for avatar, if chosen) (while active or 60 days)
• Restriction settings as determined by parent (while active or 60 days)
• Emergency contact information (such as parent’s phone) (while active or 60 days)
• Location identifying labels (such as “home” or “school,” as defined by parent) (while active or 60 days)

Location Data may include:

• Parent’s time zone (while active or 60 days)
• Child’s geolocation (as permitted by region, and if enabled by parent) collected in the background (while active or 60 days)

Device Data may include:

• Child’s operating system platform and version (36 months) 
• Installation status of the Norton Family client software on subscriber or protected User’s device (36 months) 
• Child policy configurations as determined by parent (36 months) 
• Device name (while active or 60 days)
• Device name, type, language, hardware, software, and application inventory (only applicable to Android mobile devices) (36 months)
• Browser type and version (36 months)
• Device identifiers such as IDFA (only applicable to iOS mobile devices (36 months)

Security Data may include:

• Setting configurations deviations performed by child (while active or 60 days)
• Application exception and workflow failure logs (12 months)
• URLs visited by child and search terms (while active or 60 days)
• Device usage time (while active or 60 days)
• Application usage time (while active or 60 days)

Service Data may include:

• Crash logs for PC (36 months)
• Product usage telemetry (limited to pages visited with Product) (12 months)
• License ID, status, and entitlement information (while active or 60 days)

Location Data: This data is processed to determine appropriate language settings for communicating with you and delivering the product by helping you to supervise the location of your protected device.

Device Data: This data is processed for the purposes of delivering the product in accordance with your device(s), helping you to supervise the online activities on your protected device(s), and helping to enforce your defined rules for the online activities on your protected device(s). Device identifiers are used to track information about app usage such as which in-app events a user triggers.

Security Data: This data is processed for the purposes of delivering the product in accordance with your device(s) as well as improving the product’s installation success rate by providing input for research and development to improve products and services to better protect your network, devices, data, and identity.

Service Data: This data is processed for the purpose of understanding product usage to further develop and improve the product performance as well as telemetry.

Service Data may include:

• Crash logs for mobile devices (90 days)
• Metadata reports on product usage (12 months)

Security Data may include:

• Screenshots and images of suspected scams which could be photos, emails, social posts, web sites, text messages and all information contained in them (30 days)
• Original text, email or image submissions and any personal information contained in the submission including metadata (e.g. email headers) (30 days)
• Text submissions and text extracted from image and text submissions with personal data removed from the submission (1 year)
• Phone numbers from submissions (30 days)
• Apple ID, for beta testers only (3 years)

Service Data may include:

• User conversations. Questions or anything you submit to the app (36 months)
• Email addresses from which you send the submissions (30 days)

Security Data: This data is processed for the purposes of detecting scams, evaluating potential security risks, and helping to assess risks involved in the submitted information. Additionally, submissions provided by Users help in improving the product’s scam detection rate.

Apple ID is used to assist with testing and development of the product.

Service Data: This data is processed for effective functioning of the product and for the purpose of responding to the questions or other inputs and for improving the quality of future conversations.

Location Data may include:

• IP Address (not stored) 

Device Data may include:

• Internal installation identifier (while active or 36 months)
• Device operating system (while active or 36 months)

Security Data may include:

• Submission Timestamps
• Extracted submission content including malicious URLs
• Extracts of submissions determined to be unknown or suspected to be malicious. These include data that may identify the malicious sender: phone numbers, emails, crypto, or other sender identifier types. Includes identifiers offered to user as target for user’s requested response. (up to 5 years since the last sighting for suspected malicious data and false-positive data, or 1 year since sighting for unclassified data, forever if the number is also publicly available and classified)

Service Data may include:

• Failure diagnostics including crash dumps and system logs (36 months)

Location Data: This data is processed for the purposes of determining the country, and city of the user and to identify scam locations to improve scam detection rates.

Device Data: This data is used for the purposes of delivering the product in accordance with your device(s) as well as tracking and determining trends in threats detected.

Security Data: This data is processed for the purposes of delivering the product by alerting you to potentially malicious submissions and for improving the detection of scams (e.g., through file sample analysis), and pursuing general cybersecurity research.

Service Data: This data is processed for the purposes of understanding product usage to further develop and improve the product performance as well as telemetry.

Security Data may include:

• Submissions of other users of the product (30 days)
• Phone numbers from publicly available sources (as long as necessary for the service)

Service Data may include:

• Failure diagnostics including crash dumps and system logs (36 months)
• Reporting data based on metadata collected by product (limited to number of Users by general geolocations/regions, and operating systems) (25 months)

Account Data, if chosen may include:

• Issue description and details

Device Data may include:

• Operating system and settings
• Security settings (e.g., active firewall, antivirus software)
• System configurations (e.g., active ports, hosts file, installed programs, active processes, open memory, log file, and registry data)

Service Data may include:

• Scan statistics (e.g., number of scanned files, number of threats found, fixed, or remaining and date and time of scan)

Device Data: This data is processed for the purposes of delivering the product in accordance with your device(s) and identifying the root causes of the issues posed.

Service Data: This data is processed for the purpose of understanding product usage to further develop and improve the product performance as well as telemetry.

Account Data if chosen may include:

• Issue description and details

Device Data may include:

• Operating system and settings
• Security settings (e.g., active firewall, antivirus software)
• System configurations (e.g., active ports, hosts file, installed programs, active processes, open memory and CPU utilization, log file and registry data)

Service Data may include:

• Scan statistics (e.g., number of scanned files, number of threats found, fixed, or remaining, and date and time of scan)

Device Data: This data is processed for the purposes of delivering the product in accordance with your device(s) and identifying the root causes of the issues posed.

Service Data: This data is processed for the purpose of understanding product usage to further develop and improve the product performance as well as telemetry.

No personal data provided directly except for what is required for enrollment and payment.

Device Data may include:

• Device information such as type, vendor, model, manufacturer, version (12 months)
• Device identifiers (12 months)
• Driver information such as versions, updated dates, names, matching device id, driver rank, driver flags (12 months)

Service Data may include:

• Events and product usage information (12 months)
• Scan statistics (12 months)

Location Data may include:

• IP address (not stored)

Data You Provide:

If purchasing the Norton Mobile Security through the eStore, please see the Norton Enrollment Process for additional information. If purchasing through the Apple AppStore or Google PlayStore, please see the below information.

Account Data may include:

• Email (while active or 36 months)
• Norton account password (while active or 36 months)
• Country (while active or 36 months)

Device Data may include:

• Mobile device IDs (UDID, IMEI, and IDFA) (while active or 36 months)
• Device name and type (including Wi-Fi MAC Address) (while active or 36 months)
• Operating system platform and version (while active or 36 months)

Security Data may include:

• File and application data (limited to app store data, applications downloaded, and browsing data. Android devices will also collect calendar and SD contents) (3 years)
• Web-browsing and URLs accessed (3 years)
• User interface and screen activity (limited to keyword tags and actions) (25 months)

Service Data may include:

• Usage information (e.g., network service information, download and use frequency, log data) (12 months)
• Error reports/crash dumps (90 days)
• Device/phone settings (including but not limited to device model and manufacturers) (90 days)

Device Data: This data is processed for the purposes of delivering the product in accordance with your device(s) and determining appropriate language settings for communicating with you.

Security Data: This data is processed for the purposes of delivering the product by alerting you to potentially malicious applications, malware, and links (including links in emails or data downloaded to SD cards) as well as improving the app security feature (malicious malware and applications blocking feature and SD card are only available on the Android OS).

Service Data: This data is processed for the purpose of understanding product usage to further develop and improve the product performance as well as telemetry.

Service Data may include:

• Reporting data based on metadata collected by product (limited to number of Users by general geolocations/regions, and operating systems) (25 months)

Account Data if chosen may include:

• Issue description and details

Device Data may include:

• Application names and versions
• Norton machine ID (anonymized)
• Operating system information
• Security settings (e.g., active firewall, antivirus software)
• System configurations (e.g., active ports, hosts file, installed programs, active processes, open memory, log file, and registry data)

Service Data may include:

• Crash dump information (specifically related to Norton product crash)
• Scan statistics (e.g., number of scanned files, number of threats found, fixed, or remaining, and date and time of scan)

Device Data: This data is processed for the purposes of delivering the product in accordance with your device(s) and identifying the root causes of the issues posed.

Service Data: This data is processed for the purpose of understanding product usage to further develop and improve the product performance as well as telemetry.

Norton Safe Web does not require Users to provide any data outside of enrollment and billing processes. Norton Safe Web can be used as a free extension tool. If used as such, no User Data is required to be provided.

Data We Collect/Access:

Location Data may include:

• IP address

Device Data may include:

• Web browser type/version
• Product version and preferred language
• Operating system (including version or platform)
• Browser application and settings

Security Data may include:

• Browsing activity

Service Data if enabled by User may include:

• Metadata (limited to number of blocked websites and number of unsafe websites clicked)

Location Data: This data is processed for the purposes of delivering the product in accordance with your device(s), determining appropriate language settings for communicating with you, and reporting about product usage based on general location.

Device Data: This data is processed for the purpose of product functionality in delivering the product in accordance with your device(s).

Security Data: This data is processed for the purposes of delivering the product functionality by informing you about site safety information and/or blocking unsafe websites.

Service Data: This data is processed for the purpose of understanding product usage to further develop and improve the product performance as well as measure usage trends.

Service Data may include:

• Reporting data based on metadata collected by product (e.g., number of Users by browser types, general geolocations/regions, and operating systems)

Norton Safe Search does not require Users to provide any data outside of enrollment and billing processes. Norton Safe Search can be used as a free extension tool or website. If used as such, no User Data is collected.

Location Data may include:

• IP address

Device Data may include:

• Product version and preferred Language
• Operating system (including version or platform)
• Browser type, version, and settings

Security Data may include:

• Browsing activity
• Search terms

Service Data may include (if User permission is given to enable product telemetry):

• URL of blocked websites
• Metadata (e.g., number of blocked websites and number of unsafe websites clicked)

Location Data: This data is processed for the purposes of delivering the product in accordance with your device(s), determining appropriate language settings for communicating with you, and reporting about product usage based on general location.

Device Data: This data is processed for the purpose of delivering the product in accordance with your device(s).

Security Data: This data is processed for the purposes of delivering the product by informing you about site safety and/or blocking unsafe websites, and tailoring ads to your interests.

Service Data: This data is processed for the purpose of understanding product usage to further develop and improve the product performance as well as telemetry.

Service Data may include:

• Reporting data based on metadata collected by product (e.g., number of Users by browser types, general geolocations/regions, and operating systems)

This product does not require Users to provide any data to use the product.

Device Data may include:

• Account, Device, and or Installation Identifiers (36 months)
• Google Client ID, Android ID, Firebase Analytics ID (36 months)
• Location (36 months)
• Information concerning the computer or device (36 months)
• Applications on the device (36 months)
• Network connection type, number of devices in network (36 months)

Security Data may include:

• Subset of URLs and referrers (36 months)
• Malware samples, suspicious files (3 years)
• IP Address (not stored)

Service Data may include:

• IP Address (not stored) 
• Browsers (installed, default) (36 months)
• Other products/licenses on the device and their status (36 months)
• Extensions installed in the browser (36 months)
• Event logs, crash logs and error logs (36 months)
• In-Product messaging parameters (36 months)

By default, Private Browser for Desktop processes locally on your system the following data:

• Browsing history information; for example, Private Browser for Desktop may store the URLs of pages that you visit, a cache of text, images, and other resources from those pages. If the pre-rendering feature is turned on, a list of IP addresses linked to those pages may also be stored for some period of time
• Name, surname, email, or passwords to help you fill out forms or signs into sites you visit
• Permission that you have granted to websites
• Cookies or data from websites that you visit
• Data saved by add-ons
• Record of what you downloaded from websites
• IP addresses are not stored, only used for product localization and analytics purposes based on approximate location (city/country level)

Device Data: This data is used and generated internally at Gen for the purpose of tracking account activity between internal company systems, applications, and architecture. It is also processed for the purposes of delivering the product in accordance with your device(s), and to introduce new features or products based on previous experience. Location is used to set up proper product language version for Windows

Security Data: This data is processed for the purposes of delivering the product by informing you about site safety and blocking browsing to unsafe websites, improving the detection of malware and cyber-threats (e.g., through file sample analysis), and pursuing general cybersecurity research.

Service Data: This data is processed for the purposes of recognizing what features should be enabled or disabled, what product should be installed or uninstalled, to better understand user’s behavior, to provide import functionality, to improve user onboarding and product experience, and for understanding product usage to further develop and improve the product performance as well as telemetry.

No data is collected from Third Parties

No data is collected from Third Parties

Norton Home Page does not require Users to provide any User Data.

Location Data may include:

• IP address (not stored)

Device Data may include:

• Product version and preferred language
• Operating system (including version or platform)
• Browser type and version and settings

Security Data may include:

• Search terms

Service Data may include (if User has provided permission to access):

• Feature usage telemetry

Location Data: This data is processed for the purposes of delivering the product in accordance with your device(s), determining appropriate language settings for communicating with you, and reporting about product usage based on general location.

Device Data: This data is processed for the purpose of delivering the product in accordance with your device(s).

Security Data: This data is processed for the purposes of delivering the product by informing you about site safety information and/or blocking unsafe websites, and tailoring ads to your interests.

Service Data: This data is processed for the purpose of understanding product usage to further develop and improve the product performance as well as telemetry.

Service Data may include:

• Reporting data based on telemetry collected by product (e.g., number of Users by browser types, general geolocations/regions, and operating systems).

Norton Password Generator does not require Users to provide any data outside of enrollment and billing processes.

Location Data may include:

• IP address (not stored)
• Geolocation (26 months)
  

Device Data may include:

• Web browser name (26 months)
  
• Version and preferred language (26 months)
  
• Operating system (including version or platform) (26 months)
  

Location Data: This data is processed for the purposes of delivering the product in accordance with your device(s), determining appropriate language settings for communicating with you, and reporting about product usage based on general location.

Device Data: This data is processed for the purpose of delivering the product in accordance with your device(s).

Account Data may include:

• First name (while active or 36 months)
• Middle name (while active or 36 months)
• Last name (while active or 36 months)
• City (while active or 36 months)
• State (while active or 36 months)

Identity Data may include:

• Date of Birth (while active or 36 months)
• Driver’s license (optional) (while active or 90 days)
• Authorized Agent appointment (optional) (while active or 30 days)
  • Date of birth
  • Email
  • Phone number
  • Address
  • First and last name
  • Digital signature

Account Data: This data is processed to establish and authenticate your account and to communicate with you. Your data is also used to deliver the services and features that you have selected.

Identity Data: This data is used to deliver the services and features that you have selected.

Device Data may include:

• Member ID (while active or 36 months)
• LifeLock ID (while active or 36 months)

Service Data may include:

• Usage data to assist with debugging a problem with the service (12 months)

• In order to check your email, we download it whole, together with metadata. We keep it in our systems only during the processing, we don't store it. (seconds)
• Subject of emails (28 days)
• When an email is detected to be a commercial email, the following data is collected:
  • hash of the userID
  • email subject
  • sender email address
  • domain address of sender
  • Unsubscribe links within the email

Device Data: This data is used for the purpose of delivering services.

Service Data: This data is processed to deliver product services and functionality, and to allow understanding of product usage and telemetry, to further develop and improve product performance.

Identity Data may include:

• First name (12 months)
• Middle name (12 months)
• Last name (12 months)
• City (12 months)
• State (12 months)
• Date of birth (12 months)
• Driver’s license (optional) (90 days)
• Relatives’ names (12 months)

Service Data Collected from your email provider, if you enable this:

• In order to check your email, we download it whole, together with metadata. We keep it in our systems only during the processing, we don't store it. (seconds)
• Subject of emails (28 days)
• When an email is detected to be a commercial email, the following data is collected:
  • hash of the userID
  • email subject
  • sender email address
  • domain address of sender
  • Unsubscribe links within the email

Identity Data: This data is collected for the purpose of determining and displaying what User Data is contained on certain third-party websites. 

Service Data Collected from your email provider: This data is processed for the purpose of delivering product services and functionality. This data is not shared with third-parties. 

Account Data may include:

• Name (while active or 36 months)
• Email (while active or 36 months)
• LifeLock account password (while active or 36 months)
• Phone number (while active or 36 months)
• Social Security Number or other National Personal Identifier (while active or 6 months)
• Physical address (while active or 36 months)
• Date of birth (while active or 6 months)
• Billing address (while active or 36 months)
• Payment information (depending on method can include Credit/Debit Card Information or PayPal account) (while active or 6 months)
• Power of attorney (if purchasing LifeLock Senior) (while active or 36 months)

• Name (while active or 36 months)
• Email (while active or 36 months)
• Phone Number (while active or 36 months)
• Social Security Number or other National Personal Identifier (while active or 6 months)
• Physical address (while active or 36 months)
• Date of birth (while active or 6 months)
• Alternate physical address (while active or 36 months)
• Alternate phone address (while active or 36 months)
• Bank account information (while active or 6 months)
• Driver’s license number (while active or 6 months)
• Alternate Credit/Debit Card information (while active or 6 months)
• Mother’s maiden name (while active or 6 months)
• Verbal passcode (while active or 6 months)
• Insurance number/information (while active or 6 months)
• Social account information (while active or 6 months)
• Child’s name (if purchasing LifeLock Junior) (while active or 36 months)
• Child’s Social Security Number (if purchasing LifeLock Junior) (while active or 6 months)
• Child’s date of birth (if purchasing LifeLock Junior) (while active or 6 months)
• Child’s address (if purchasing LifeLock Junior) (while active or 36 months)
• Child’s email address (if purchasing LifeLock Junior) (while active or 36 months)
• Childs phone number (if purchasing LifeLock Junior) (while active or 36 months)

Service Data:

• Texts – for Scam Verification Specialist feature (screenshots of suspicious texts or emails) (while active plus 24 months) 

Account Data: This data is processed for the purpose of establishing and authenticating your account, as well as communicating with us. Your data is also used to deliver the services and features that you have selected.

Identity Data. Your data is also used to deliver the services and features that you have selected.

Service Data. This data is used to deliver the services and features that you have selected.

Location Data may include:

• IP address (not stored)
• Geolocation (26 months)

Device Data may include:

• Member ID (while active or 36 months)
• Device ID (26 months)
• Operating system version and settings (26 months)
• Device manufacturer and model (26 months)
• Device names and/or assigned names (26 months)
• Web browser name and version (12 months)
• Preferred language (while active or 36 months)

Security Data may include:

• Credit scores (while active or 36 months)
• Credit reports (while active or 36 months)
• Bank transactions (while active or 36 months)
• Alert information (limited to data elements selected for monitoring by the User) (while active or 36 months)
• Photos – for ID Vault features (documents such as photos of identity documents, credit cards, driver’s license and passports) (while active plus 180 days)

Service Data may include:

• Restorations case number (for filed Restorations cases only) (while active or 36 months)
• Complaint case number (for lodged complaints only) (while active or 36 months)
• Parent case number (for disputed alerts only) (while active or 36 months)
• Applications error reports (12 months)
• Crash dumps logs (12 months)
• App-related usage data (while active or 36 months)

Location Data: This data is processed for the purpose of establishing and authenticating your account, as well as communicating with you. This data is also used to deliver the services and features that you have selected.

Device Data: This data is processed for the purposes of delivering the product in accordance with your device(s) and determining appropriate language settings for communicating with you. It is also processed for the purposes of delivering product services as well as communications about potential solutions to detected threats.

Security Data: This data is used to monitor your identity by providing the alerts you have set up on your account which can help protect you when potentially fraudulent activity is detected or for other services that you have selected. It is also processed for the purposes of delivering product services as well as communications about potential solutions to detected threats.

Service Data: This data is processed for the purpose of understanding product usage to further develop and improve the product performance, communicating about potential solutions to detected threats as well as telemetry.

Identity Data may include:

• Verified name (not stored)
• Verified Social Security Number (not stored)
• Verified physical address (not stored)
• Verified date of birth (not stored)

Security Data may include:

• Credit scores (not stored)
• Credit reports (not stored)
• Bank transactions (not stored)
• Alert information (limited to data elements selected for monitoring by the User) (not stored)

Service Data may include:

• Reporting metadata on product and application usage (not stored)

Account Data may include:

• Name (only if previously purchased through a LifeLock product offering) (while active or 36 months)
• Email (while active or 36 months)
• Preferred language (while active or 36 months)

• Email (while active or 36 months)
• First phone number (while active or 36 months)
• First physical address (while active or 36 months)
• Alternative email address (while active or 36 months)
• Alternate phone number(s) (while active or 36 months)
• Alternate physical address(es) (while active or 36 months)
• Bank account information (while active or 6 months)
• Credit/debit card information (while active or 6 months)
• Mother’s maiden name (while active or 36 months)
• Insurance information (while active or 36 months)
• Loyalty Card information (while active or 36 months)
• Driver’s license number (while active or 6 months)
• Passport number (while active or 6 months)
• Social Security Number or other National Personal Identifie (only if previously purchased through a LifeLock product offering) (while active or 6 months)
• Date of birth (only if previously purchased through a LifeLock product offering) (while active or 6 months)
• Gamertag (while active or 36 months)

Account Data: This data is processed for the purpose of establishing and authenticating your account, as well as communicating with you. Your data is also used to deliver the services and features that you have selected, including the search criteria for the product within the dark web.

Identity Data: This data is processed for the purpose of delivering the services and features that you have selected, including the search criteria for the product within the dark web.

Location Data may include:

• IP address (not stored)
• Geolocation (26 months)

Device Data may include:

• LifeLock member ID (if previously purchased through a LifeLock product) (while active or 36 months)
• Norton GUID (if previously purchased through a Norton product) (while active or 36 months)
• Member GUID (while active or 36 months)
• Web browser name and version (12 months)
• Device ID (26 months)
• Operating system version and settings (26 months)

Service Data may include:

• Applications error report (12 months)
• Crash dumps logs (12 months)
• App-related usage data (12 months)

Location Data: This data is processed to determine the appropriate language setting to communicate with you.

Device Data: This data is used for the purpose of delivering services. It is also processed for the purposes of delivering product services as well as communications about potential solutions to detected threats. 

Service Data: This data is used for the purpose of helping us to further understand the usage and develop and improve the performance of our products. It is also processed for the purposes of delivering product services as well as communications about potential solutions to detected threats.

Security Data may include:

• Alert information (limited to dark web monitoring) (while active or 36 months)
• Analytics reports (while active or 36 months)

User Data may include:

• SurfEasy VPN does not require Users to provide any data outside of the enrollment and billing processes

User Data may include:

• IP address (not stored)
• Install identifier (while active or 36 months)
• License identifier (while active or 36 months)

Administrative Data may include:

• Device name and type (while active or 36 months)
• OS version (for mobile devices only) (while active or 36 months)
• Language (while active or 36 months)

Security Data may include:

• Aggregate bandwidth usage (limited to the number of bytes transferred using the service) (while active or 36 months)

Diagnostic Data may include:

• Data to assist with debugging connectivity problems (device identifier from app) (7 days)

VPN Service Data may include:

• Data to monitor compliance with the terms of use (if suspicious behavior is detected or blocked: device identifier from app, frequency of abuse of services) (7 days)

Application Data may include:

• IP address (not stored)

User Data: This data is processed for the purposes of delivering the content in accordance with your device(s) and determining the appropriate language settings for communicating with you.

Administrative Data: This data is processed for the purpose of delivering the product to your device(s).

Security Data: This data is used for the purposes of billing the account of the product used as well as network operations and support.

Diagnostic Data: This data is used for research and development to improve products and services and to better protect your network, devices, data, and identity.

VPN Service Data: This data is used for the purpose of prevent abuse of services, to protect our network, and ensure compliance with the terms of use.

Application Data: This data is used for the purpose of (a) delivering the product by selecting the most appropriate server to connect to, and (b) to prevent abuse of services to protect our network and ensure compliance with the terms of use.

Diagnostic Data may include:

• Reporting metadata on product and application usage (while active or 36 months)

Connection to the email account you wish to monitor.

Security Data may include:

• Malicious URLs and referrers (36 months)
• Malware samples, suspicious files (36 months)

Service Data may include:

• IP Address of SMTP mail servers (36 months)
• In order to check your email, we download it whole, together with metadata and attachments. By default, we keep it in our systems only during the processing, and we don't store it. If you consent, we can store suspicious email messages for in-depth analysis and to keep our detection models up to date (30 days in raw form, then de-identified)
• Subject of emails (28 days)
• Malicious identifiers (URL, phone, email, crypto, or other identifier types that may be identified as significant for threat detection) (60 months) 
• When an email is detected to be malicious, the following data is collected (36 months):
  • hash of the userID
  • email subject
  • hash of sender email address
  • domain address of sender
  • detection type and name
  • name of the attachments and their hashes
  • country of the user

Security Data: This data is processed for the purposes of delivering the product by informing you about the safety of an email, improving the detection of malware and cyber-threats (e.g., through file sample analysis), and pursuing general cybersecurity research.

Service Data: This data is processed for the purposes of the functionality of malware scanning and evaluation of sender reputation. This data is also used to ensure proper functionality and fix bugs. This data is also used to collect threat statistics and perform internal analysis and research.