Updated: February 2025
This Privacy Policy explains how Graylog, Inc. and its subsidiaries ("Graylog") collect, use, and disclose information you provide to us or which we otherwise collect ("Information"), including "Personal Data" meaning Information about an identified or reasonably identifiable individual.
This Privacy Policy applies to Products (as defined in the Graylog General Terms), Graylog.com and to other websites Graylog operates that link to this Privacy Policy. This Privacy Policy does not apply to Personal Data processed by Graylog as a processor or to Graylog as an employer.
The use of our Products and our website are subject to the terms of the applicable customer agreement set forth at https://graylog.com/legal. The terms of this Privacy Policy are incorporated into and form part of that agreement.
There are two primary ways in which Graylog collects Information about you: through our Products and Interactions as set forth below.
We collect and process different types of data (described below) when you deploy our Products to fulfill our contractual and legal obligations, to operate our business, or fulfill other legitimate interests. The type of data we collect via our Products is Usage Data, which is data generated from the usage, configuration, deployment, access and performance of a Product. We summarize for you here the types of usage data collected and the purposes for which we use this data below.
Data about your operating environment and configuration, user Interactions, and sessions related to your use of our Products. This may include information and related metadata about your network and systems architecture and configurations, OS and Product versions, Product configurations, installed applications, feature utilizations and frequencies, page loads and views, number and types of searches, errors, number of active and licensed users, source, source types and formats (e.g., json, xml, and csv), web browser details, http referrer page, and app workflows.
Data that allows us to identify account entitlements, such as license entitlement consumption, license capacity, or license type in our systems through an assigned license ID.
A combination of the above two, to provide account support including features used, deployment topology, performance metrics and license ID. The Information is user/customer-identifiable so that we can help address your specific issue and personalize your experience.
If you use a device to access a Product via an application "Apps" or "App", as discussed below, that associates your device with an identifier for your App. We may also receive information that your device sends when you use our Apps, such as a device identifier or OS. Depending on a customer's configuration of our Products, location information about users may be shared with Graylog. You can disable location sharing using the location-setting features on your device.
For more information about the data collected through our Products, see the Product specific documentation at Documentation.
We use the data and Information described above to fulfill our contractual obligations in providing the Products to you and to fulfill our legitimate interest in supporting and enhancing them. For example, we may use this data and Information to:
You may elect to turn off data collection at any time within our product.
We also collect Information from you to fulfill our contractual commitments to you. For example, we collect contact Information such as name, address (email and physical) and phone number to enter you into our databases and manage your account. We also collect billing and payment Information and information about how you use our Products, including Information such as browser type, version number and operating system (OS), to administer your account, respond to customer service/support inquiries, and provide you with information about software updates via alerts or other "push" notifications. We may share this Information as described in How Graylog Shares Your Information. We do not sell this Information.
We may offer Graylog's Products as software applications commonly called "apps," "add-ons," "widgets," or "technical add-ons" that may link to this Privacy Policy. We refer to these collectively as "Apps." These Apps may have access to a broad set of web technologies that can be used to collect and use your Information. This Privacy Policy only applies to Apps built by or on behalf of Graylog. It does not apply to Apps developed by others ("App Developers"), third-party marketplaces or repositories (e.g., AWS Marketplace, Google Play Store, and GitHub), or that are otherwise interoperable with our Products. Apps developed by App Developers are subject to their privacy notices.
Graylog requires App Developers to comply with applicable privacy and data protection laws but cannot guarantee that they do so. Before you use Apps created by App Developers, you should familiarize yourself with their privacy policies and license agreements.
Graylog collects Information generated from the use and performance of Apps that interoperate with its Products, such as crash data, version, session duration, and user engagement (e.g., number of downloads, active/licensed users, and logins). We may share this data with App Developers so they can improve and enhance the performance of their Apps.
When you Connect online or offline with Graylog, we may receive your Information, including your Personal Data. For example, we receive your Information when you:
We collect Information about you from other sources such as public databases, commercial data sources, joint marketing partners, resellers, managed services providers and other partners, social media platforms, industry groups, and conference/event hosts.
We refer collectively to these contacts as "Interactions" and we explain below how we use the Information we collect through them.
We (or others acting on our behalf) may collect your Information, including your Personal Data, through Interactions. The Personal Data we collect includes such things as:
We collect Personal Data in various ways, such as when you manually key in your Personal Data to our website forms or provide it to us or others from whom we receive marketing leads. From time to time, we offer virtual private networks (VPNs) or Wifi access for attendees at Graylog events or visitors to our offices. If you access a Graylog-provided VPN or WiFi, we may collect Personal Data from you, such as IP and MAC addresses, when we monitor the VPNs and WiFi for security or performance.
IP addresses are also collected on an automated basis through your use of the website services using cookies, web beacons, and like technologies. We may infer your location from your IP address. For more on the use of cookies and like technologies, see How We Use Information Collected from Interactions (below).
We may use third-party payment processors to collect credit card or other financial data for a specific transaction only. Graylog does not store the credit card data you provide, only payment confirmation information.
Graylog uses the Information we collect from your Interactions to deliver Products to you in accordance with our terms, to fulfill our contractual and legal obligations, or to pursue legitimate business interests, as described below. Here is a summary of the purposes for which we use your Information, including Personal Data, to:
If you no longer want to receive marketing emails from Graylog on a go-forward basis, please submit your request here: Data Request Form. Alternatively, you may use the "unsubscribe" feature in our marketing email messages to opt-out of receiving marketing email messages.
We also collect Information, including Personal Data, when providing our Products. We may ask you for this Information directly, or in some cases, we may collect it as you use our Products. For example, we collect Information from or about you when you (or someone you work with):
Graylog may disclose your Information to others in the following ways:
Graylog honors Global Privacy Control (GPC) signals that you enable on your browser. If you do not have GPC enabled on your browser or device, and depending on your location, you may choose to opt-out of enabling cookies for our website. If you wish to change previously selected cookie preferences, please contact us here: Data Request Form.
Graylog takes reasonable technical and organizational measures to safeguard Personal Data against loss, theft, and unauthorized access, disclosure, alteration, misuse, or destruction. Unfortunately, no data transmission, software, or storage system is guaranteed to be 100% secure. If you have reason to believe that your Personal Data may no longer be secure (for example, if you feel that the security of an account has been compromised), please notify us immediately via the communication channels in the Contact Graylog section below. If Graylog learns of a breach of its systems, Graylog may notify you or others consistent with applicable law and/or as agreed in our contract with you. Graylog may communicate with you electronically regarding privacy and security issues affecting Information collected through your Interactions or use of our Products.
Retention Period. We retain your Information for the period necessary to fulfill the purposes outlined in this Privacy Policy unless a longer retention period is required or not prohibited by applicable law.
Information you store in Graylog cloud environments is portable by you at the end of the term of your agreement with Graylog. We retain your contract information for the duration of your agreement with us and thereafter as required or permitted by law. We keep a record of your data requests, including your requests to opt out of marketing communications, to honor them in the future.
Use of Products by Minors. Our Products, Graylog.com and other websites Graylog operates are not directed to individuals 16 and under or those not of the age of majority in your jurisdiction, and we request that these individuals, or others on their behalf, not provide us with their Information.
In certain locations, you may have rights under data protection law, such as to request access to or correction, deletion, or transfer of your Personal Data, or to object to or restrict Graylog from using it for certain purposes. If you would like to exercise these rights, please submit your request, with a description of the nature of your request and the Personal Data at issue, to Data Request Form, and we will respond as soon as reasonably practicable consistent with applicable law. We will verify your identity before we comply with your request and ask for your cooperation with our identity verification process.
We rely on a variety of legal bases to process Personal Data, including your consent, a balancing of legitimate interests, necessity to enter into and perform contracts, and compliance with a legal obligation. If we process your Personal Data based on your consent, you may withdraw your consent at any time. We will let you know if we are seeking to rely on your consent at the time of collection.
If you have any questions or concerns about Graylog's privacy practices, you can contact us here: Data Request Form.
Individuals located in the UK or European Economic Area are granted certain rights related to Personal Data, including the ability to:
If you or a designated third-party agent would like to exercise these rights, please submit the request to Data Request Form and we will respond in accordance with our legal obligations. We will verify your identity, and the identity of any third-party agent acting on your behalf, before we comply with the request and ask for your cooperation with our identity verification process.
Your Personal Data may be stored and processed in any country where Graylog, its subsidiaries, partners, sub-processors, and third-party service providers conduct business or host events. These locations may be outside of your country of residence, including in the United States, where different data protection laws may apply. When we transfer Personal Data, we implement safeguards for protection of the transferred Personal Data, such as standard contractual clauses. We put in place appropriate terms to protect your Personal Data in our agreements with our service providers, processors, and sub-processors.
Graylog has begun the process to certify to the Department of Commerce that we adhere to the Data Privacy Framework Principles ("Principles") of the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework, and Graylog complies with all its obligations under the Principles. However, Graylog does not currently rely on the frameworks for transfers of Personal Data from the EU/EEA/Switzerland and the UK to the United States in its role as a controller. Instead, we continue to rely on standard contractual clauses. To learn more about the Data Privacy Framework program, please visit https://www.dataprivacyframework.gov/.
Capitalized terms in this section are as defined in the California Civil Code.
If you are a California Consumer, California law provides you with specific rights regarding your Personal Information, subject to certain exceptions. These rights include:
If you or a designated third-party agent would like to exercise these rights, please submit the request to Data Request Form and we will respond in accordance with our legal obligations. We will verify your identity, and the identity of any third-party agent acting on your behalf, before we comply with the request, and ask for your cooperation with our identity verification process.
Graylog may collect the following categories of Personal Information from California Consumers for purposes outlined in How We Use Information Collected from Interactions and What We Collect via Our Products:
Within the scope of this Policy, Graylog does not collect or process Sensitive Personal Information about California Consumers.
Graylog did not – in the preceding 12 months – and does not Sell or Share Personal Information of California Consumers. Graylog will seek your consent for use of cookies that are not strictly necessary, and you can select which cookies to enable. If you wish to change previously selected cookie preferences, please use the unsubscribe button or fill out our Data Request Form.
The source of each of these categories of Personal Information are outlined in this Privacy Policy in the Interactions and Products sections respectively.
The categories of Third Parties to whom Personal Information may be disclosed are outlined in this Privacy Policy in the How Graylog Shares Your Information section. We may have disclosed any of the above categories of Personal Information pursuant to an individual's consent or under a written contract with a Service Provider for a Business Purpose.
The categories of Personal Data processed, the purposes of processing Personal Data, the categories of Personal Data shared with third parties and the categories of third parties with whom Graylog shares Personal Data are as outlined above.
Consumers in US states with privacy laws have privacy rights, such as to request access to or correction, deletion, or transfer of their Personal Data, or to object to or restrict Graylog from using it for certain purposes. If you, or a person you have authorized, would like to exercise these rights, please submit your request, with a description of the nature of your request and the Personal Data at issue and we will respond in accordance with our legal obligations. We will verify your identity before we comply with your request and ask for your cooperation with our identity verification process.
In the event Graylog declines to take action on your request, we will respond with the legally-required information, including where applicable, instructions for how to submit your appeal. Once an appeal is received, Graylog will respond to the appeal in compliance with applicable law.
Graylog does not sell your Personal Data. Graylog will seek your consent for use of cookies that are not strictly necessary and you can select which cookies to enable. If you wish to change previously selected cookie preferences, please use the unsubscribe button on any emails or fill out our Data Request Form.
If you have any questions or concerns about Graylog's privacy practices, you can contact us at any time via the contact options listed under Contact Graylog below.
Our Products may contain links to, or facilitate access to, other websites or online services. This Privacy Policy does not address, and Graylog is not responsible for, the privacy, information, or practices of other parties, including without limitation any app developer, social media platform provider, wireless service provider, or device manufacturer. The inclusion of a link within the Products does not imply endorsement of the linked site or service by Graylog. Graylog encourages you to review the privacy policies and learn about the privacy practices of the companies whose websites you choose to visit or apps you choose to use.
We may change this Privacy Policy from time to time and will post our updates at https://www.graylog.com/privacy.
If you have any questions or comments about this Privacy Policy or Graylog's privacy practices, you can contact us at any time at [email protected].