Your privacy,in plain words.
What we collect, why we collect it, and how we look after it. Including the access you trust us with during security work.
This is a draft for review. Have a qualified professional review it before publishing.
01Who we are
Isolora is a small studio based in the United States. We help people with websites, cybersecurity audits and authorized vulnerability scanning, older systems that need care, AI security, AI governance, and AI guidance and automation.
In this policy, "Isolora", "we" and "us" mean Isolora LLC. "You" means anyone who visits our website, contacts us, or works with us.
This policy explains what personal information we collect, why, and what choices you have. If something here is unclear, please ask. We would rather explain than have you guess.
02What we collect
We try to collect only what we need. Here is everything, grouped by where it comes from.
When you use our contact form
- Your name and email address
- The service you are interested in
- Your note to us
- How you heard about us, if you choose to tell us
When you email us
Your email address, your name, and whatever you choose to include in your message and any attachments.
When you become a client
To do the work you ask for, we may receive information about your business, such as contact details for you and your team, billing details, and information inside the systems or accounts you give us access to. This can include personal information about your customers or staff that lives in those systems. Section 4 explains how we treat it.
Basic technical data
Like most websites, our hosting provider keeps standard server logs, which can include your IP address, browser type, the pages you visited and the time of your visit. Our site also loads fonts from Google Fonts, which means your browser connects to Google's servers and shares your IP address with them.
Analytics: We use Cloudflare Web Analytics, a privacy-friendly tool, to see overall visit counts and which pages are useful. It does not use cookies. If we use analytics, it will not build a profile of you or follow you across other websites.
Cookies
We do not use analytics, advertising or cross-site tracking cookies. Our hosting and spam-protection provider, Cloudflare, may set strictly necessary security cookies that protect the site from bots and attacks.
03How we use it
We use your information to:
- Reply to your message and answer your questions
- Understand what you need and suggest the right service
- Plan, carry out and report on the work you hire us for
- Send invoices and keep the business records the law requires
- Keep our website and systems working and secure
- Learn, in general terms, how people find us, so we can improve
We do not add you to a marketing list just because you contacted us. If we ever start a newsletter, we will ask first, and you can leave at any time.
04Your data during security work
Security audits, authorized scanning and fixes to older systems sometimes mean we need access to your website, apps, accounts or servers. We take that trust seriously. Here is how we handle it:
- Only within the written scope. We access only the systems, accounts and data listed in our signed agreement or statement of work, and only for the purpose described there.
- Least access needed. We ask for the lowest level of access that lets us do the job. Where possible, we prefer a separate, temporary account for us over your own login.
- Not kept longer than needed. We do not copy personal data out of your systems unless the work requires it. Anything we do collect, such as evidence for a finding, is stored securely and deleted or returned when the engagement ends, unless you ask us to keep it or the law requires otherwise.
- Credentials handled safely. Passwords, keys and other access details are shared through a secure method we agree on together, such as a secure password manager share (for example, 1Password or Bitwarden Send). We do not store them in plain email or chat, and we ask you to remove or change our access when the work is done.
- Never through the contact form. Please do not send passwords, keys or other secrets through our contact form or in a first email. We will never ask you to.
If we find something sensitive during the work, such as exposed customer data, we tell you promptly and privately.
05AI tools
Because we work in AI security and automation, you may wonder whether your information ever goes into an AI tool. Here is our approach:
- We do not put client data, system access details, or the contents of your systems into AI tools unless you have agreed to it in writing.
- If you agree, we tell you which tools we would use, what information would go into them, and why. We choose settings that stop your data from being used to train the provider's models, where the tool offers that choice.
- We may use AI tools for our own internal work that does not involve your personal information, such as drafting general content.
When AI tools help with client work, we use reputable providers, such as Anthropic, OpenAI and Google, on business terms that do not use your information to train their models. We will tell you which tools we plan to use, and ask for your consent, before using them with your information.
06Who we share it with
We do not sell your personal information, and we do not share it for advertising.
We share information only with the service providers that help us run the business, and only what they need to do their part. These include:
- Website hosting, security and spam protection: Cloudflare
- Contact form handling: Cloudflare, with messages delivered to our Google Workspace email
- Email: Google Workspace
- Fonts: Google Fonts
- Analytics: Cloudflare Web Analytics
- Payments and accounting: Stripe and QuickBooks
We may also share information if the law requires it, to protect someone's safety, or as part of a sale or merger of our business, in which case this policy would continue to apply to your information.
07How long we keep it
- Contact form messages and emails: for up to 1 year after our last conversation, unless you become a client.
- Client project records: for 3 years after the engagement ends, so we can answer follow-up questions and meet our legal and tax duties.
- Data from inside your systems: deleted or returned when the engagement ends, as described in section 4, unless our agreement says otherwise.
- Server logs and analytics: for 90 days.
When we no longer need information, we delete it or make it anonymous.
08How we protect it
Protecting information is our work, so we hold ourselves to the advice we give. Our measures include:
- Strong, unique passwords and multi-factor authentication on our accounts
- Encrypted connections (HTTPS) for this website
- Encrypted storage for client files and credentials
- Limiting access to the people who need it for the work
- Keeping our devices and software up to date
No system is perfectly secure, so we cannot promise that information will never be exposed. If a breach affects your personal information, we will tell you as the law requires, and as quickly as we reasonably can.
09Your rights and choices
You can ask us to:
- See the personal information we hold about you
- Correct anything that is wrong or out of date
- Delete your information, unless we need to keep it for a legal reason
- Opt out of any emails we send, and of analytics where that applies
To make a request, email us at legal@isolora.com. We may need to confirm your identity before we act, to protect your information from someone pretending to be you. We will reply within 30 days.
Depending on where you live, state privacy laws, such as California's, may give you additional rights, for example to know the categories of information we collect and to appoint someone to make a request for you. We will honor those rights where they apply, and we will never treat you differently for using them.
10Children's privacy
Our website is meant for adults and businesses. We do not knowingly collect personal information from children under 13. If you think a child has sent us their information, please contact us and we will delete it.
We sometimes work with students under 18. We only do so with written consent from a parent or guardian, and we share their information only with that parent or guardian and the people who need it for the work.
11Visitors outside the United States
We are based in the United States, and the providers we use may store information in the United States or other countries. If you contact us from elsewhere, your information will be handled in the United States under this policy. Privacy laws where you live may give you additional rights. Contact us and we will do our best to help.
12Changes to this policy
We may update this policy as our services or the law change. When we do, we will change the "Last updated" date at the top. If a change is significant, we will make it clear on this page, and tell current clients directly.
13Contact us
Questions, requests or worries about your privacy are always welcome.
- Email: legal@isolora.com