PrivacyNotice.

1. Who we are

This notice covers aftrdrk.com, operated by AFTRDRK, LLC ("AFTRDRK", "we", "us"). AFTRDRK is the controller of the personal data described here. Data we process for clients while delivering our services is governed by the Terms of Service and the client's agreement, not by this notice.

2. What we collect

We collect only what you send us through a form on this site, and a few technical details about the submission.

• Contact and request forms: your name, organization, email address and anything you write to us.
• Urgent intake ("Engage the desk"): the same, plus a phone number if you give one and what happened. What you tell us about an incident may concern other people, such as the attacker or the people affected.
• Security reports: your name or handle, an email address for our reply, and your report.
• Checkout: your name, organization, work email, the domain to be monitored, the plan you choose, the referral code of the partner who sent you if there is one, and a record of your acceptance of the Terms of Service: the version, the time, your network address and your browser. Your card details and billing address are entered on Stripe's payment page and never reach our servers.
• With every submission: the time, the page it came from, your network (IP) address and your browser's identification string.
• Server logs: like any website, our servers and our network provider record requests, including network addresses, for security and to keep the site running.

3. How we use it

• To reply to you and provide what you asked for: a brief, a demo, terms, a response to an incident. (Legal basis under the GDPR: steps at your request before a contract, and our legitimate interest in answering inquiries.)
• To sell and provide subscriptions: to set up your account in the DRK Web Surveillance application, verify that you control the domain you asked us to monitor, take payment and keep a record that you accepted the Terms of Service. (Contract, and our legal obligations.)
• To screen organizations against sanctions lists before we provide service. (Legal obligation, and our legitimate interest in complying with sanctions law.)
• To protect the site and the people who use it: to limit abuse of our forms and investigate attacks. (Legitimate interest.)

We do not sell your personal data, share it for advertising, or use it to build a profile of you.

4. Who processes it for us

We use a small number of service providers. Each processes personal data only on our behalf and only to provide its service.

• HubSpot holds form submissions in our customer relationship system. Your network address and browser details are not sent to HubSpot.
• Stripe processes payments for subscriptions. Stripe receives your email address and order details from us, collects your payment details and billing address directly, and tells us whether payment succeeded. Stripe's handling of payment data is described in Stripe's privacy policy.
• Our on-call alerting system receives urgent intake submissions, so that a person can respond at any hour. The text message or call that alerts our team carries only your organization's name and what happened. Your contact details are visible only inside the alerting system.
• Cloudflare delivers this website and protects it from attacks. It processes every visitor's network address and request details to do so.
• Our hosting provider runs the servers on which the site and our form records are stored.
• PartnerStack runs our referral partner program. If you join it, PartnerStack processes your information under the Partner Program Terms. If you subscribe after following a partner's link, PartnerStack receives your email address and the payments on your subscription from our Stripe account, so that the partner can be credited.

We may also disclose personal data when the law requires it, to protect our rights or the safety of others, or as part of a merger or sale of the business.

5. Cookies and tracking

This site sets no advertising or analytics cookies and loads no third-party tracking scripts. Fonts and other assets are served from this domain. Cloudflare may set a strictly necessary cookie to tell people from automated traffic. If you arrive through a partner's referral link, we keep the partner's referral code in a cookie on this site for 90 days, so the partner can be credited if you subscribe; it is used for nothing else. The referral link itself is run by PartnerStack and may set cookies of its own. Stripe's payment page, which you reach only if you buy a subscription, is governed by Stripe.

6. How long we keep it

• Inquiries and requests: for as long as we are in contact with you and for our business records, unless you ask us to delete them and we have no legal reason to keep them.
• Subscriptions: account, order and Terms of Service acceptance records for the life of the subscription and afterward for as long as needed to meet legal, tax and accounting obligations and to establish or defend legal claims.
• Engagements: records relating to an engagement are held under the terms of that engagement and to a seven-year retention floor, with litigation hold overriding any disposal schedule.
• Server logs: retained for security purposes and rotated.

7. Your rights

Depending on where you live, you may have the right to ask us what personal data we hold about you, to receive a copy, to have it corrected or deleted, to restrict or object to how we use it, and to withdraw consent where we rely on it. We will not treat you differently for exercising these rights.

If you are in the European Economic Area or the United Kingdom, you may also complain to your data protection authority. If you are a California resident, you have the rights to know, delete and correct personal information. We do not sell or share personal information as California law defines those terms.

To make a request, use the contact form and choose "Privacy request". We may need to confirm your identity before acting on it, and we will answer within the time the law allows.

8. Where it is processed

We are based in the United States, and personal data is processed in the United States and wherever our service providers operate. Where the law requires it, transfers from the European Economic Area or the United Kingdom rely on appropriate safeguards, such as standard contractual clauses.

9. Security

We protect personal data with technical and organizational measures appropriate to its sensitivity, including encrypted connections, restricted access and minimal collection. No system is perfectly secure. If you find a weakness in this site, please tell us.

10. Children

This site is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16.

11. Changes

We may update this notice. The effective date at the top shows when it last changed. If a change materially affects how we use personal data you have already given us, we will tell you before it takes effect.

12. Contact

For questions about this notice or how we handle personal data, use the contact form.