Citadel Cyber Privacy Policy

Effective date: [EFFECTIVE DATE]

This policy explains how Citadel Cyber LLC, a Utah limited liability company, doing business as Citadel Cyber ("we," "us"), collects, uses, and protects information when you use our website at citadelcyber.dev, the Free Scan, and our paid audits and subscriptions (the "Services"). It should be read together with our Terms of Service.

1. Information we collect

Information you give us

• Scan intake: your email address, the target URL, the tech stack (optional, for example Lovable, Bolt, or Cursor), and your consent to our Terms. We record the time of your consent and which version of the Terms you agreed to.
• Ownership verification: the method you used (DNS TXT record or HTML meta tag), when the domain was verified, and a hashed copy of your verification token.
• Paid onboarding: your company's legal name, the signer's name and title, contact and emergency-contact details (name, email, phone), in-scope URLs, domains, and repositories, the testing window, which testing methods you've approved, and whether health or card data is involved. If applicable, this also includes test-account access details, repository access, Agency branding assets, and your signed Scope Authorization.
• Messages you send us by email. Mail to our @citadelcyber.dev addresses is received by Cloudflare Email Routing and forwarded to our mailbox.

Information collected automatically

• Abuse-prevention data: a hash of your IP address (we don't store the raw IP with your scan record), rate-limit counters, and the CAPTCHA result. CAPTCHA checks are run by Cloudflare Turnstile. The Turnstile widget on our scan form gives us a one-time token, which our server checks with Cloudflare; we keep only the pass/fail result.
• Email events: delivery, bounce, and complaint notices from our email provider (Resend), so we stop emailing addresses that bounce or complain. Scan emails don't include tracking pixels.
• Basic server logs that our hosting providers (Cloudflare for the website) keep for security and reliability. We scrub secrets from these logs.

Information produced by scanning your site

• Scan results: the checks that were run, findings, severity, a "Confirmed" or "Likely" label, your score and grade, the detected tech stack, and the generated reports.
• Secrets found during scans are not stored. If a scan finds an exposed secret (for example an API key in your JavaScript or a readable /.env file), we record only the HTTP status code and the pattern that matched (for example, "the file contains KEY= lines"). We throw away the response body right away, don't keep the secret, and never send it to any AI model.
• Free Scans don't read data from your database. Checks that read data through your APIs (for example, checks on Row-Level Security) happen only during paid testing under a signed Scope Authorization, use test accounts you provide, and access only the minimum needed to prove a finding.

Payment information
Payments are processed by Lemon Squeezy, which acts as the merchant of record. Lemon Squeezy collects your payment details, billing address, and tax information under its own privacy policy. We never see or store your full card number. Lemon Squeezy sends us order and subscription records (for example the product, plan, amount, status, and the email and name on the order) and any details you enter at checkout, such as your app URL, repository URL, and authorization confirmation.

2. How we use information

• To verify that you own the domain, run the scans and audits you asked for, and deliver your reports.
• To deliver your subscription: monitoring, alerts, and access to the features your plan includes.
• To send transactional emails, such as email confirmation, reports, receipts, and alerts.
• To prevent abuse. That includes enforcing rate limits, blocking scans of sites the requester doesn't control, and keeping an audit log for disputes.
• To keep our accounts and meet our legal, tax, and accounting obligations.
• To improve the Services using aggregated, de-identified statistics.

We don't sell your personal information, and we don't share it for cross-context behavioral advertising. We don't send marketing email without [CONSENT / OPT-OUT APPROACH FOR MARKETING EMAIL, e.g. the planned newsletter].

3. Who we share it with (service providers)

We may also disclose information when the law requires it, to protect people from harm or abuse (including telling a site owner that someone tried to scan their site without authorization), or as part of a merger or sale of the business, in which case the commitments in this policy still apply.

4. How long we keep it

Backups: when data is deleted on the schedules above (for example, after 30 days), copies may persist in our encrypted backups for up to 5 more days, until those backups expire.

You can ask us to delete your data earlier (see Section 6). We may keep records we're legally required to keep, or that we need to show a scan was authorized.

5. Security

• Ownership verification is required before any scan, and paid testing always requires a signed Scope Authorization.
• Data is encrypted in transit and, for paid engagement data, encrypted at rest. [CONFIRM ENCRYPTION AT REST FOR ALL DATA]
• Verification tokens are stored hashed, and IP addresses are stored hashed.
• Secrets are redacted before storage and before anything goes to the model. API keys and signing secrets are kept out of logs, error messages, and the database.
• Access to client data is limited to the people and systems that deliver the Services.
• Test-account credentials are shared through [SECURE CREDENTIAL HANDOFF METHOD], never by email.
• We send scan email from a domain with SPF, DKIM, and DMARC set up.

No system is perfectly secure. If a breach affects your personal information, we'll notify you as the law requires.

6. Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you, and get a copy in a portable format;
• correct inaccurate information;
• delete your information;
• object to or restrict some processing, or withdraw consent where processing is based on consent;
• opt out of any sale or sharing of your information (we don't sell or share it); and
• not be treated differently for using these rights.

California (CCPA/CPRA): California residents have the rights listed above. In the past 12 months we've collected the categories of information described in Section 1, for the purposes in Section 2, and disclosed them only to the service providers in Section 3. We don't sell personal information or share it for cross-context behavioral advertising.

EEA, UK, and Switzerland (GDPR): We process personal information to perform our contract with you (scans, audits, subscriptions), for our legitimate interests (abuse prevention, security, and improving the Services), to meet legal obligations (tax and accounting), and with your consent where it's required. Some of our providers process data in the United States. Where the law requires it, we rely on appropriate safeguards such as Standard Contractual Clauses. You can complain to your local data protection authority. [CONFIRM WHETHER AN EU/UK REPRESENTATIVE IS NEEDED]

To use any of these rights, email hello@citadelcyber.dev. We'll verify your identity and respond within the time the law requires. You can use an authorized agent where the law allows.

7. Health information

We don't currently accept apps that handle health data, including protected health information (PHI), and we don't collect health information through any of our Services. Intake asks whether your app handles health data, and we decline the engagement if it does. If we come across health data anyway, we stop, access nothing further, delete what we saw, and never send it to the model API.

8. Cookies and analytics

• Our website sets no cookies of its own and doesn't use advertising or cross-site tracking cookies. Our own code doesn't save anything in your browser's storage (no cookies, localStorage, or sessionStorage): what you type into the scan form is sent only to our scan API, and the verification code is shown on the page and not saved. (Checked against the site-v3 build of Oct 18, 2026.)
• Campaign tags: we don't read or store UTM tags (such as utm_source) from the link you followed. They may still appear in our hosting provider's basic server logs as part of the page address.
• Analytics: [ANALYTICS TOOL, OR "WE DON'T USE ANALYTICS"]. If we add analytics, we'll update this section and use cookie consent where the law requires it.
• CAPTCHA: the Cloudflare Turnstile widget loads from challenges.cloudflare.com on the page with our scan form. Cloudflare may use browser storage or collect device signals strictly to tell people from bots.
• Fonts: our website serves its fonts itself. It doesn't load Google Fonts or other third-party font services.
• Email: our scan emails don't contain tracking pixels.

9. Children

The Services are for businesses and aren't directed at children under 16. We don't knowingly collect children's personal information.

10. Scanner opt-out for site owners

If our scanner (User-Agent CitadelCyberScanner/1.0) visited your site and you didn't ask for a scan, see citadelcyber.dev/scanner or email security@citadelcyber.dev. We'll add your domain to our denylist.

11. Changes

We may update this policy. The effective date at the top shows the current version. We'll give notice of material changes by email or on our site.

12. Contact

Citadel Cyber LLC, a Utah limited liability company
1141 W 650 N, Provo, UT 84601
Privacy requests: hello@citadelcyber.dev
General: hello@citadelcyber.dev