Privacy Policy

Information you give us: When you submit the contact form, the readiness assessment, or email us, we collect what you provide: name, organization, business email, phone number (optional), website URL, organization size, area of interest, your assessment answers, and any notes you include.

Information collected automatically: Our servers log standard technical data: IP address, browser type, device type, pages requested, referring URL, and timestamps. Our anti-bot protection (Cloudflare Turnstile) processes limited browser signals to distinguish humans from automated traffic. We use this data for security, abuse prevention, and keeping the site running.

Information from clients during engagements: When we perform services under contract, we may process personal data contained in client systems or documents (for example, user directories or access logs). We process that data only on the client's instructions and under the applicable agreement; the client remains responsible for it.

We do not knowingly collect information from anyone under 18, and this site is not directed to them.

To respond to your inquiry and, if you request one, deliver your readiness score and follow up on it.

To scope, contract, and deliver services you engage us for.

To operate, secure, and improve the site, including detecting and blocking abuse.

To comply with legal obligations and enforce our agreements.

With your consent, to send occasional updates about CySLex services (you can withdraw consent at any time).

We do not use your personal information to train AI models, and we do not submit it to public AI services.

Where data-protection law requires a legal basis, we rely on: performance of a contract or steps at your request before entering one; our legitimate interests in operating a secure business and responding to inquiries; compliance with legal obligations; and your consent, where we ask for it.

Service providers that host our infrastructure, email, productivity tools, and anti-bot protection, under contracts that restrict their use of the data to providing services to us.

Professional advisors (legal, accounting, insurance) when reasonably necessary.

Authorities when required by law, subpoena, or to protect rights, safety, or property.

A successor in the event of a merger, acquisition, or sale of assets, subject to this policy.

We do not sell or rent personal information and we do not share it with third parties for their own marketing.

The site uses only strictly necessary cookies and local storage for functions such as remembering your language and theme preference and supporting anti-bot verification.

We do not use advertising or cross-site tracking cookies.

If we add privacy-respecting analytics in the future, we will update this section and honor browser signals such as Global Privacy Control.

Inquiry and assessment submissions: up to 24 months after our last contact with you, then deleted, unless the inquiry becomes an engagement.

Engagement records and contracts: for the term of the engagement and the period required by law, tax, and professional obligations (typically 7 years).

Server and security logs: at least 12 months for security purposes, then deleted or anonymized.

Marketing consent records: until you withdraw consent, plus a record of the withdrawal.

We protect personal information with the same controls described on our Security Practices page, including encryption in transit and at rest, multi-factor authentication, least-privilege access, and monitoring.

No method of transmission or storage is completely secure, but we work to reduce that risk.

We are based in Puerto Rico (United States). Our service providers may process data in the United States and other jurisdictions. Where we transfer data from a jurisdiction that restricts international transfers, we use appropriate safeguards such as standard contractual clauses.

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to restrict or object to certain processing, and to withdraw consent. Regardless of location, we will honor reasonable requests to access, correct, or delete the information we hold about you.

To exercise these rights, email privacy@cyslex.com (or security@cyslex.com). We may verify your identity before responding. We will not discriminate against you for exercising your rights.

If you are in the EU/EEA, UK, or another jurisdiction with a supervisory authority, you also have the right to lodge a complaint with that authority.

Our site may link to external sites. This policy does not cover them; review their policies separately.

We may update this policy from time to time. The effective date at the top reflects the latest version. For material changes we will post a notice on the site and, where we have your email, notify you directly.

CySLex LLC — Puerto Rico, USA

Privacy requests: privacy@cyslex.com

Security inquiries: security@cyslex.com