Legal
Privacy Policy
This notice explains what personal information Praeven Security LLC collects through praevensecurity.com, why it is collected, who it is shared with, and how long it is kept.
Effective July 31, 2026 · Last updated October 25, 2026
Scope. This notice covers the website, online purchases and policy-kit intake, and pre-engagement business communications. Information processed during another paid engagement, including training delivery and briefings, is governed by the applicable engagement agreement, statement of work, rules of engagement, and any separate data processing terms.
1. What we collect
1.1 Information you submit
The website provides a general contact form for service and product inquiries. A reviewed policy purchase also uses an organization intake form. Depending on which you use, a submission may include:
- Name, business email address, and organization
- Service or product interest and the objective described in your message
- Any free text you enter in a message field
Please do not submit credentials, exploit detail, Controlled Unclassified Information, or confidential system information through these forms.
1.2 Purchase and delivery information
When you start or complete checkout, Praeven records an order identifier, product, price, currency, purchase status, the email supplied through Stripe, the accepted purchase-terms version and time, and delivery or download status. Stripe processes the payment credentials; Praeven does not receive your full payment-card number.
1.3 Information collected automatically
When a form is submitted, the following is recorded alongside it:
- IP address and country, as reported by the content delivery network
- A timestamp
- Limited referral information used only to understand which business-listing, search, service-page, or campaign path resulted in a submitted inquiry. This may include a campaign source, medium, and name when supplied; an initial landing-page path; a referrer domain; and the on-site page that led to the contact form.
Limited referral information is recorded with your inquiry only when you submit a consented contact form. Form security, checkout, and delivery use the operational records described in this notice.
1.4 Website analytics
The public website uses Cloudflare Web Analytics to measure page views and page performance. Its browser script reports information such as the page address, referring site, browser and device characteristics, and page-loading measurements. This measurement operates when you visit a page, independently of the contact form.
Cloudflare states that Web Analytics does not use cookies, local storage, or browser fingerprinting to identify visitors, and does not track individuals across websites. We use the measurements to understand which pages people visit and where the site needs improvement. We do not use advertising technology or build advertising profiles. See Cloudflare's Web Analytics description.
2. Why we collect it
- To respond to your inquiry and scope potential work
- To prevent automated abuse of the forms
- To understand page usage and improve website performance
- To maintain a record of pre-engagement correspondence
- To process purchases, deliver products, provide purchase support, and administer refunds
- To document the terms accepted for an order and prevent unauthorized downloads
- To comply with legal obligations
This information is not used for automated decision-making, and it is not used to build advertising or marketing profiles.
3. Who it is shared with
We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act and comparable state laws.
Three service providers process information on our behalf:
| Provider | Role | What it processes |
|---|---|---|
| Cloudflare, Inc. | Hosting, content delivery, form and order processing, storage, bot prevention, and website analytics | Form submissions, order and delivery records, IP address, technical request data, purchased files, and the page-usage and performance measurements described in Section 1.4 |
| Google LLC | Business email, form and purchase notifications, and reviewed-kit intake | Form and intake submissions, purchaser email, order identifier, and delivery link |
| Stripe, Inc. | Hosted checkout, payment processing, receipts, refunds, and payment-risk controls | Purchaser and billing information, payment credentials, order details, accepted-terms record, and transaction status |
Beyond these, information is disclosed only where required to comply with law or lawful process, to protect rights, property, or safety, or in connection with a merger, acquisition, or sale of assets, subject to the protections in this notice.
4. Cookies and similar technologies
Cloudflare Web Analytics loads a browser script on the public site. Its measurements do not depend on accepting the contact form's consent checkbox. Cloudflare describes this analytics service as operating without cookies or local storage. The separate form-attribution record below is created by Praeven's website code.
On first visit, the website may keep a compact, non-identifying attribution record in browser local storage for up to 90 days. It contains the first campaign source, medium, and name when supplied, the initial landing-page path, and referrer domain. The record is read and transmitted only if you submit a contact form after giving the consent described on that form. It is not used for advertising, visitor profiling, or page-view tracking.
When you start checkout, Praeven sets a strictly necessary, HTTP-only order cookie for up to seven days. It connects the returning browser to the order without exposing the internal access value to page scripts. A successful Starter Kit flow may temporarily keep the private download token in the browser's session storage so the link survives navigation within that browser session.
Stripe's hosted checkout may use cookies or similar technologies needed for payment, fraud prevention, and service operation. Stripe describes its practices in its privacy policy and cookie policy.
Pages containing forms load Cloudflare Turnstile, which verifies that a submission comes from a person rather than an automated script. In its default configuration Turnstile sets no cookie. If a visitor is presented with an interactive challenge, Cloudflare may set a short-lived cookie, approximately one hour, recording that the challenge was passed, and the widget stores a transient value in session storage for the life of the page.
These are strictly necessary for the security of the forms. They are not used for tracking, profiling, or advertising. Cloudflare's practices are described in its privacy policy at cloudflare.com/privacypolicy.
5. How long it is kept
Form submissions are retained for 24 months from the date of submission. New records expire automatically at that point, and a daily retention sweep deletes any pre-existing form record once it reaches the same age. Order, payment, accepted-terms, delivery, refund, and related support records are retained as reasonably necessary to administer the purchase and meet legal, accounting, tax, fraud-prevention, and dispute-handling obligations. Correspondence that leads to another engagement is retained under the terms of the applicable agreement.
6. Security
Submissions are transmitted over TLS, stored in access-controlled infrastructure, and reachable only through an authenticated interface. Access is limited to personnel who need it to respond to an inquiry. No system is completely secure. Where a breach affecting personal information occurs, affected individuals and regulators will be notified as required by law.
7. Confidentiality of scoping information
Information describing your systems, networks, or environment, submitted when requesting an assessment, is treated as confidential business information. It is used only to evaluate and respond to your request, is not published or shared for any other purpose, and is subject to the retention period in Section 5. Any testing that follows is conducted only under a separate written agreement and defined rules of engagement.
8. Your rights
Depending on where you live, you may have the right to:
- Know what personal information is held about you and how it is used
- Access a copy of it
- Correct inaccurate information
- Request deletion, subject to legal exceptions
- Opt out of sale or sharing. We do neither.
- Not be discriminated against for exercising these rights
To make a request, email privacy@praevensecurity.com. We will confirm identity using information reasonably necessary to do so, and respond within the period required by applicable law. An authorized agent may submit a request on your behalf, subject to verification.
Recognized opt-out preference signals, including Global Privacy Control, are honored. Because we neither sell nor share personal information, no further action is required, but the signal is respected as a matter of practice.
9. Children
The website is intended for businesses and professionals. We do not knowingly collect personal information from anyone under 18. If we learn that we have, it will be deleted.
10. Links to other sites
The website links to third-party resources, including standards bodies and framework publishers. We are not responsible for their privacy practices.
11. Changes
This notice may be updated. The date above will change and material revisions will be identified.
12. Contact
Praeven Security LLC
Washington, United States
privacy@praevensecurity.com
Prepare. Anticipate. Protect.