Privacy.

What we collect

Only what you type into a form or send us, and only when you send it.

• Estimate requests — your name, work email, optionally a company name and a note, together with the answers you gave the estimator.
• Contact messages — your name, email and your message.
• Email you send us directly — whatever is in it.

Please do not send credentials, vulnerability details or sensitive system information through the website forms. We will set up a secure channel for that during scoping.

What we do not collect

This site has no analytics, no advertising pixels and no tracking cookies. We do not know how many people visit it, where they came from or what they looked at. A security firm that tracks its visitors without asking would be a strange thing to trust.

The chat assistant runs in your browser and answers from a fixed set of replies written in advance. Nothing you type into it is sent anywhere unless you then choose to submit a form.

What your browser stores

The assistant may keep your current conversation in your browser’s session storage so it survives a page change. It is cleared when you close the tab and is never sent to us.

Client engagement data

Information you share with us during an engagement — system details, credentials, test data, findings and reports — is governed by your signed agreement and non-disclosure terms, not by this page. In summary, we:

• store engagement data encrypted, with access limited to the people working on it;
• share reports through an access-controlled portal rather than as email attachments;
• rotate or request revocation of any credentials issued to us when testing ends;
• delete engagement data on the schedule set out in your agreement.

What we do with it

We use what you send to reply, to prepare an estimate or proposal, and to run the engagement you ask for. We do not sell it, rent it, or add you to a marketing list.

Third parties

Messages pass through our email and hosting providers, who process them on our behalf. The page loads one script from a public content delivery network for smooth scrolling. We do not use advertising or data-broker services of any kind.

How long we keep it

Enquiries that do not become engagements are deleted within twelve months. Engagement records are kept for the period your agreement specifies, and for any longer period the law requires for business records.

Your choices

You can ask to see, correct or delete what we hold about you at any time. We handle personal information in line with Canada’s PIPEDA and Alberta’s Personal Information Protection Act, and will respond within thirty days.

Changes

If this policy changes, the date at the top of this page changes with it. Material changes affecting existing clients will be notified directly.

Contact

Questions about privacy go to hello@penspycyber.com.