What we collect
We collect only what you actively give us, plus minimal technical metadata.
- Compliance Readiness Calculator
- Your 10 answers, the frameworks you selected, and optional email + company name. Produces a stored score and playbook.
- Pilot application
- Name, email, job title, company name, company size, frameworks you're pursuing, optional tools and audit-deadline, and your pain statement.
- Technical metadata
- HTTP referrer, a truncated user-agent string, and country (from Cloudflare's
CF-IPCountryheader). We do not retain full IP addresses.
How we use it
- →Generate your readiness score and personalized playbook.
- →Let you share your result via a permalink (no login required).
- →Review and respond to pilot applications.
- →Understand aggregate interest in specific frameworks (e.g., how many applicants pursue PCI vs SOC 2).
- →Operate and secure the site.
What we don't do: sell your data, share it with advertisers, use it for profiling, or train AI models on it.
Third-party services
We use three infrastructure providers. Each is scoped to one job.
| Provider | What it does | Data it sees |
|---|---|---|
| Cloudflare | Hosting, DNS, edge proxy, database (D1) | All site traffic and stored records |
| Resend | Transactional email (pilot-application notifications) | Your pilot-application content, sent once to us |
| Cloudflare Web Analytics | Privacy-friendly page analytics, served from the same edge as the site | Page views, referrer, country. No cookies, no fingerprinting, data stays inside Cloudflare. |
| Cloudflare Email Obfuscation | Auto-rewrites email links to resist basic spambot harvesting | Email addresses rendered on the page (server-side rewrite, no user data) |
| Cloudflare Bot Management | Analyzes browser characteristics to block automated abuse | Browser fingerprint (user-agent, screen, canvas). Not linked to a user identity. |
Data retention
- →Calculator results — retained so you (and anyone you share the link with) can revisit the score. Ask us to delete yours anytime.
- →Pilot applications — retained while we evaluate the cohort, then for up to 24 months after to reach out if priorities change.
- →Analytics — Cloudflare Web Analytics aggregates page views; individual sessions are not linked to you.
Your rights
Regardless of where you live, you can ask us to:
- →Access the data we hold about you.
- →Correct inaccurate data.
- →Delete your data.
- →Export your data in a portable format.
- →Object to or restrict processing.
Email [email protected] with your request and we'll respond within 30 days.
Security
- →TLS on all traffic.
- →Encrypted storage at Cloudflare D1.
- →Least-privilege access to production secrets.
- →No public database access; all reads and writes go through authenticated application code.
Report a security issue to [email protected].
International users
Data is stored on Cloudflare's global edge network, which may process data in multiple regions. By using this site you consent to transfer of your data to the United States and other countries where Cloudflare operates. We rely on Cloudflare's Data Processing Addendum and Standard Contractual Clauses for cross-border transfers.
Changes to this policy
We may update this policy as the product evolves. Material changes will be posted here with a revised "Last updated" date. If the changes affect how we handle existing data, we'll reach out to pilot applicants directly.