Privacy Policy

This policy applies to this website and its Request a Guided Assessment form. It does not cover professional assessment engagements. Any engagement requires a separate written agreement, which will set out its own data-handling terms, including for assessment reports and customer data.

When you submit the Request a Guided Assessment form, we collect:

• Full name (required)
• Business email address (required)
• Company or organization (required)
• Assessment objective (required)
• Job title (optional)
• Approximate Active Directory user count (optional)
• Additional information you choose to provide (optional)

For spam and abuse prevention, the form also creates a pseudonymous security record derived from your IP address (see section 6).

When you browse the website, our hosting provider collects visitor analytics and sets security cookies (see section 9). Web fonts are loaded from Google, which receives your IP address and browser information when the fonts are requested.

Please do not submit passwords, credentials, or sensitive system data through the form.

Form submissions are checked by a server-side handler on our hosting platform and sent by email, through the Resend email delivery service, to our business mailbox hosted on Microsoft 365. Inquiry submissions are not stored in the website's application database.

• Responding to your assessment inquiry and communicating with you about it
• Preparing a potential proposal or scope of work
• Preventing spam, abuse, and automated misuse of the form
• Maintaining the security and operation of the website
• Understanding aggregate website usage

• Lovable: website hosting and application services, including the server-side form handler, the email workflow integration that passes form emails to Resend, and visitor analytics.
• Lovable Cloud: Lovable's managed backend and database service, which stores the pseudonymous rate-limit and security records described in section 6.
• Resend: transactional email delivery of form submissions.
• Microsoft 365: business email hosting and storage of the inquiry emails we receive.
• Cloudflare: network and security infrastructure that delivers the website and sets security cookies.
• Google Fonts: delivery of web fonts used by the website.

These providers process information under their own terms and privacy policies. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

To enforce rate limits, the form converts your IP address into a hashed identifier and records the time of each submission attempt. The hash is not keyed, so it could in principle be linked back to an IP address. These records are therefore pseudonymous, not anonymous, and may count as personal information.

Records older than 24 hours are deleted the next time a submission check runs for the same identifier. Deletion is not guaranteed exactly 24 hours after creation, and some records may remain until that next check runs.

We intend to keep ordinary business inquiry emails for up to 12 months, unless a longer period is needed for an ongoing business relationship, legitimate business needs, legal requirements, or preservation obligations. Automated deletion is not yet in place for this period. Owner action: set up a 12-month retention process in Microsoft 365

This 12-month period applies only to website inquiries. It does not apply to assessment reports or other customer data, which will be governed by the relevant written services agreement.

Analytics, security cookie and email delivery data are kept by the providers above according to their own retention practices.

We use reasonable measures intended to protect information, including server-side input validation, rate limiting, spam protection, and transmission over HTTPS. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

This website does not use advertising cookies. It uses:

• Cloudflare security cookie (__cf_bm): set by our network provider to help distinguish people from automated bots. It expires after about 30 minutes.
• Lovable visitor analytics: our hosting provider's analytics script sets a randomly generated session-id cookie, which expires after about 30 minutes. It records page views, referring sites, browser language, device and browser type, approximate country, and page performance measurements. We see these as aggregate reports. Owner review: confirm Lovable's analytics data practices

Do Not Track: this website does not currently respond to browser "Do Not Track" signals. Analytics and security cookies work the same whether or not such a signal is sent.

Where applicable law gives you privacy rights, including California law, you may request access to, correction of, or deletion of your personal information, and you will not be discriminated against for making a request. Residents of other jurisdictions may have similar rights where applicable. We will consider and respond to reasonable requests even where a specific law may not apply to us.

To make a request, email admin@arcticfoxlabs.io. We may need to verify your identity before responding.

Our service providers may process information in the United States or other countries, under their own safeguards and terms. Owner review

This website is intended for business users and is not directed to children under 16. We do not knowingly collect information from children.

Questions about this policy: admin@arcticfoxlabs.io or our contact page.

We may update this policy from time to time. The "Last updated" date above reflects the latest revision.