Privacy Notice

Hack Security Partners, LLC (“Hack Security Partners,” “we,” “us”) is a cybersecurity, data privacy, and AI governance consultancy based in Riverside, California, United States. This notice applies to hacksecuritypartners.com and to inquiries you send us through it.

For the purposes of the EU and UK General Data Protection Regulation, we act as the controller of the personal information described here. Where we deliver consulting services under a client agreement, that agreement — not this notice — governs how we handle client data, and we typically act as a processor on the client's instructions.

Information you give us

When you submit the contact form, we collect your name and email address (both required), and optionally your company, the service you're interested in, and the message you write. Please don't put sensitive details — findings, credentials, incident specifics — in that box; it is an introduction channel, not a secure reporting channel. We will arrange a secure method before you share anything of that kind.

Information collected automatically

To stop automated abuse of the contact form, we count recent submissions per visitor. We do this using a one-way cryptographic hash of your IP address combined with a secret value. We do not store your IP address itself, and the hash cannot be reversed back into one. These counters expire on a rolling one-hour window.

Like any website, our hosting provider processes standard server request data (including IP address and browser user agent) to deliver pages and maintain security. We do not build profiles from it.

What we deliberately do not do

We do not run analytics, advertising pixels, session recording, fingerprinting, or A/B testing tools. We do not buy or enrich contact data from third-party brokers. We do not sell or share personal information, and we do not use it to train AI models.

We will only use your information for a materially different purpose after telling you and, where the law requires it, asking your permission.

We keep the list of third parties deliberately short. Each one acts on our instructions, or as an independent controller where noted, and each publishes its own privacy notice.

We may also disclose information where we are legally required to, or to establish or defend legal claims. If the business is ever sold or reorganized, information may transfer as part of that transaction; we would tell you first.

We are a United States business and our providers store data in the United States. If you are in the United Kingdom, the European Economic Area, or another region with data transfer restrictions, sending us an inquiry means your information will be transferred to and processed in the U.S.

Where those transfers require a safeguard, we rely on the protections our providers make available — including Standard Contractual Clauses and, where applicable, certification under the EU–U.S. Data Privacy Framework. You can ask us for details of the mechanism relied on for a specific transfer.

Inquiries that do not become engagements: we keep the correspondence for up to 24 months from our last exchange, so we recognize the context if you come back to us, then delete it.

Inquiries that become engagements: we keep records for the life of the relationship and then for as long as we need them for legal, tax, and professional-record purposes — generally seven years.

Abuse-prevention counters: rolling one-hour windows; nothing personal survives them, since we only ever hold an irreversible hash.

You can ask us to delete your information sooner. See below.

The site is served exclusively over HTTPS with HTTP Strict Transport Security, so browsers refuse to load it over an unencrypted connection. Form submissions travel over TLS and are stored in a database that is not publicly readable — the site can write new inquiries but cannot read existing ones back out. Visitor IP addresses used for abuse prevention are hashed before storage, never written down in the clear.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal information and the law requires notice, you will hear it from us promptly and plainly. If you believe you have found a security issue with this site, tell us through the contact form and we will respond.

Privacy rights normally depend on where you live. We have chosen not to make that distinction: we will honor the requests below from anyone, wherever you are, whether or not a particular statute technically applies to us.

• Know / access — what personal information we hold about you and what we have done with it
• Correct — information that is wrong or out of date
• Delete — information we hold about you
• Port — a copy of what you gave us, in a portable format
• Object or restrict — our use of your information where we rely on legitimate interests
• Withdraw consent — at any time, where we relied on consent — without affecting what came before

We do not sell or share personal information as those terms are defined under California law, and we do not process it for cross-context behavioral advertising — so there is nothing to opt out of. We honor Global Privacy Control signals as a matter of course. We will never treat you differently for exercising a privacy right.

To make a request, use our contact form and say what you would like. We will confirm receipt and respond within 45 days (California) or one month (UK/EU), and will tell you if we need longer. We may need to verify your identity — usually by confirming you control the email address in question — and an authorized agent may act for you with written permission.

If you are in the UK or EEA and we have not resolved your concern, you may complain to your national supervisory authority (in the UK, the Information Commissioner's Office). We would rather you came to us first.

We set no cookies on this site, and we store nothing in your browser's local storage. That is why you have not been shown a cookie banner: there is nothing to consent to.

One exception is worth stating plainly. Our Contact page embeds a booking calendar from Cal.com. When that page loads, your browser contacts Cal.com to display it, which means Cal.com receives your IP address and may set its own cookies under its own privacy notice. Every other page on this site contacts no third party except our own image delivery network.

This is a business-to-business site and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has sent us information, tell us and we will delete it.

If we change how we handle personal information, we will update this page and move the effective date at the top. Material changes will be summarized here so you can see what moved, rather than being asked to re-read the whole document and guess.

Questions about this notice, or about how we handle your information, go to Hack Security Partners, LLC, Riverside, California, United States — reachable through our contact form. A named privacy contact will answer; inquiries are not routed to a ticket queue.