Privacy

1 Who is responsible

Phoenix Security LLC, a company registered in the United States, decides how this data is used. For any question about your data, write to hello@phoenix-sec.com.

2 What we collect and why

We collect data when you send one of our forms, when you pay for the quick test through Stripe, and when your browser loads this site.

Source	Data	Why	Legal basis	Kept for
Request form	Name, work email, company, phone if you give it, the services you pick, your message, the page language.	To reply to your request and prepare an offer.	Your consent, given with the checkbox. You can withdraw it at any time.	3 years after your last contact with us, then deleted.
Giveaway entry (only if you enter)	Name, email, role, product name and address, what it does, its stage and size, when it was last tested, your answer about security, the page language.	To run the giveaway, pick an entry and contact the selected company.	Your consent, given with the checkbox, and the giveaway rules you accepted.	6 months after you send it, then deleted.
TikTok quick test request	Name, email, company if you give it, product name and address, the tests you pick, your message, the page language.	To reply to your request, arrange the test and run it.	Your consent, given with the checkbox. If you order the test, our contract with you.	3 years after your last contact with us, then deleted.
Stripe payment (only if you pay)	Billing contact details, amount and payment status. You enter payment details on Stripe's site, not ours.	To take payment, match it to your request and keep accounting records.	Our contract with you and our accounting duties.	For the periods required by tax and accounting law.
Spam check (Cloudflare Turnstile)	IP address and browser details, such as the user agent.	To stop automated abuse of the form.	Our legitimate interest in keeping the form usable.	Set by the Turnstile privacy policy.
Hosting (Cloudflare)	IP address, the page requested and browser details.	To deliver the pages and protect the site from attacks.	Our legitimate interest in running a secure site.	Set by the Cloudflare privacy policy.
Visit statistics (Cloudflare Web Analytics)	The page viewed, the page or site you came from, your country, browser, operating system and device type, and how fast the page loaded. A visit is counted from the page you came from, not from an identifier about you.	To see which pages are read and how fast they load.	Our legitimate interest in knowing how the site is used. We only see totals, never one visitor.	Set by the Cloudflare privacy policy.

If you become a client, contract and billing records are kept for as long as the law requires.

3 What we do not do

• This site sets no cookies of its own.
• No tracking pixels, no advertising, and no tracking of you across other sites. The visit statistics above count pages, not people.
• Fonts and scripts are served from this site, with two exceptions, both from Cloudflare: the spam check on the forms and the visit statistics.
• We do not sell your data or use it for marketing. We do not add you to a mailing list.

4 Who receives it

Only the providers needed to run the site and answer you:

• Cloudflare, which hosts the site, runs the spam check, counts visits, and holds each form request until it reaches our spreadsheet, then deletes it.
• Google Workspace, which stores form requests in our spreadsheet, hosts our mailbox and carries our reply to you.
• Stripe, which hosts the payment page and processes a payment if you choose to pay. We do not send your form answers to Stripe.

Nobody else, unless a law or a court order requires it.

5 Transfers outside the European Union

Cloudflare and Google may process data in the United States. Both are certified under the EU-U.S. Data Privacy Framework, which the European Commission recognizes as giving adequate protection.

Stripe may also process payment data outside the European Union. Its privacy policy describes how it handles that data: stripe.com/privacy.

6 Your rights

You can:

• Get the data we hold about you, and a copy of it.
• Have it corrected.
• Have it deleted.
• Have its use limited.
• Receive it in a common format, or have it sent to another company.
• Object to a use based on our legitimate interest.
• Withdraw your consent. This does not affect what we did with the data before.

Write to hello@phoenix-sec.com. We answer within one month. We may ask you to prove who you are before we act.

If you think we mishandled your data, you can complain to the data protection authority in your country. In France, that is the CNIL: www.cnil.fr.

7 Security

The site is served over HTTPS. Form requests can only be read by the people who answer them. The spam check keeps automated submissions out.

Found a flaw in this site? Tell us at hello@phoenix-sec.com.

8 Changes to this page

If we change how we handle your data, we update this page and the date at the top.