Marketing & Communications Policy

What we send

• Newsletter & product updates — periodic email digest covering new features, case studies, and security advisories. Subscribers and prospects can opt in or out at any time.
• Sales outreach — targeted, B2B emails and calls to people whose role suggests Watchful would be useful to their organization. Each message is individually reviewed before sending.
• Event invitations — invitations to webinars, trade-show meetings (e.g., ISC West), and customer roundtables.
• Transactional communications — quotes, demo confirmations, contract correspondence, and invoices. These are not marketing and do not contain promotional content beyond the transaction itself; they cannot be unsubscribed from while you are an active customer or active prospect.

SMS Alert Program (Twilio)

Watchful uses Twilio to deliver operational security incident notifications via SMS to pre-registered site contacts.

Lawful basis & sources

Watchful only sends marketing where we have a lawful basis to do so. Depending on your jurisdiction and your relationship with us, this will be one of:

• Consent. You ticked a box, filled out a demo form, downloaded a resource, attended an event we hosted, or otherwise expressed interest in hearing from us.
• Legitimate interests (B2B). Your business contact details are publicly available in a professional context (your company website, LinkedIn, an industry directory) and your role indicates a clear professional relevance to Watchful's services. We balance this against your reasonable expectations and respect opt-outs immediately.
• Existing customer relationship (soft opt-in). Where law permits, we may send relevant updates to people who have purchased — or are actively considering — a similar service.

We do not buy bulk contact lists from data brokers, and we do not scrape personal email addresses (gmail, outlook, hotmail and similar) for cold outreach.

How to stop hearing from us

You have multiple paths and any one of them is sufficient:

• Click the 'Unsubscribe' link at the bottom of any marketing email. We process the request immediately and update our suppression list within 10 business days at the latest.
• Reply to a sales email with 'unsubscribe', 'stop', 'remove', or any reasonable equivalent. The sender will action it and add you to suppression.
• Open a global unsubscribe request and we'll suppress every channel at once.
• Use the 'Manage preferences' link in any newsletter to opt out of specific topics while staying on others.

Once you are on our suppression list, we keep just enough information about you (typically a hashed email address) to make sure no future campaign contacts you. This is the only purpose of the suppression list and it is not used for marketing of any kind.

Standards we hold ourselves to

Watchful operates in the United States, New Zealand, Australia, and the United Kingdom & EU, so our marketing program is built to the strictest standard that applies — not the loosest. The list below is illustrative; we apply additional jurisdictional rules where relevant.

AI in our outreach

Watchful uses AI tools to make outreach more relevant and to remove the mass-blast tone that nobody wants. The rules below apply to every AI-assisted message we send:

• Watchful is the sender. AI never impersonates a third party. The from-line is always a real Watchful employee with a real email address.
• Human review. Outbound messages drafted with AI are reviewed by a human before sending.
• No fabricated facts. AI-assisted personalization is grounded in publicly available information about the recipient's organization and role. We do not invent details about you.
• Honest about reply automation. If an automated system handles your reply (for example, an unsubscribe), the confirmation makes that clear.
• Honest about AI voice agents. Where Quill Voice is used in any outbound capacity, the recipient is told they are speaking with an AI agent.

Subprocessors we use for marketing

We work with a small number of trusted vendors for email delivery, CRM, analytics, and event registration. The list below is representative; the full subprocessor register, with locations and purposes, is available on request and through our Oneleet trust portal.

Each subprocessor operates under a Data Processing Addendum that binds them to confidentiality, security, and use-restriction terms consistent with this policy.

Retention of marketing data

We follow the schedule in our Data Retention Policy. In short: marketing contact data is retained until you withdraw consent or 24 months of inactivity, whichever is earlier. Suppression entries are kept indefinitely so that an unsubscribe request stays honoured forever.

Concerns or complaints

If you receive a message from Watchful that you believe breaches this policy or any anti-spam law, file a marketing complaint. We will investigate within five business days, take corrective action where warranted, and confirm the outcome to you.

Contact Us

Questions, requests, or concerns about this policy? Pick the right channel and we'll route your message to the team responsible.