Privacy Policy

Controller: CyberDefenseDesk LLC, doing business as Valley CISO (“we,” “us”).

Contact: privacy@valleyciso.com (or the email shown on /contact).

Location: Gilbert, Arizona, United States.

What this policy covers

This policy describes how we handle information collected through valleyciso.com and when we provide IT helpdesk, documentation, and advisory services.

Information we collect — website

• Contact details you submit (name, business name, email, phone)
• Domain names you submit for a scan
• Basic analytics and device data (pages viewed, approximate location, browser)
• Communications you send us

Information we collect — if you become a client

We do not want passwords sent by email. Use the method we specify after onboarding.

• Business contact and billing information
• System inventory and ticket contents
• Administrative access logs necessary to perform the services
• Evidence artifacts we generate for you (backup test results, control screenshots, scan letters)

How we use information

We do not sell personal information.

• Respond to inquiries and deliver services
• Run the optional public scan
• Bill, account, and improve the site
• Comply with law and defend claims
• Send service notices (outages, onboarding, invoices)

Service providers we use

We share information with the following processors only as needed to run the practice. This list reflects what is actually in use on this site and in our delivery tooling:

• Lovable Cloud (Supabase) — website hosting, database, sign-in, and file storage for tickets, scans, bookings, and evidence
• Stripe — payment processing and invoicing (card details go to Stripe, never to us)
• Resend — transactional and notification email sent from notify.valleyciso.com
• Google Analytics 4 — aggregate website usage measurement
• Google Calendar and Google Meet — scheduling and video links for booked calls
• Discord — internal-only staff alerts about new bookings, tickets, and security events
• Cloudflare DNS and Shodan InternetDB — public lookups performed during the external scan
• Remote monitoring, endpoint protection, backup, and identity tools used on client tenants (named in your service agreement)

We may disclose information if required by law or to protect rights and safety.

Retention

Scan input (the domain and any email you give us for the result) is kept only as long as needed to deliver the result and follow up, within the lead retention window above.

• Lead / scan data: generally up to 24 months if you do not become a client, sooner if you ask us to delete it and we have no legal duty to keep it
• Client records: for the engagement plus a period required for tax, insurance, and dispute purposes (typically several years)
• Access is removed from client systems at offboarding per the service agreement

Security

We use reasonable administrative and technical measures appropriate to a small IT practice. No method of transmission or storage is perfectly secure.

Your choices

Email privacy@valleyciso.com to access, correct, or delete website lead data. Client data is also governed by the service agreement. California residents may have additional requests under the CCPA/CPRA regarding personal information we collect in a business context; we will not discriminate against you for exercising those rights. We do not sell or share personal information as those terms are defined in California law.

Analytics and cookies

We use essential cookies and optional analytics (Google Analytics 4) to understand how the site is used. We do not install additional tracking pixels without listing them here. The Cookie Notice at /cookies lists every cookie and script by name.

You can turn analytics off for your browser at any time on our Your Privacy Choices page at /privacy-choices. The choice is stored on your own device and applies immediately.

Children

The site and services are for businesses, not children under 13.

Changes

We may update this policy. The effective date above will change. Material changes will be posted on this page.