1. Scope

This Privacy Policy explains how DefenseLogix ("we," "us," or "our") collects, uses, and discloses personal information through the website at www.defenselogix.com, including its blog, contact form, CMMC Training walkthrough, brochure, and order forms, consultation request form, and the CUI Scope Planner and its forms (the "Website").

This policy does not govern information we process while delivering services to clients. That information is handled under the written agreement for each engagement, including any confidentiality, business associate, or data protection terms it contains.

2. Information We Collect

Information you provide

When you submit the contact form, we collect your first and last name, work email address, organization, the area of interest you select, and the message you write. When you request a CMMC Training walkthrough, we collect your name, work email address, company, and the number of people who need training. When you request the CMMC Training brochure, we collect your work email address. When you send a CMMC Training order or invoice request, we collect your company, name, work email address, billing email address if you give one, the number of people who need training, the plan, billing period, and payment method you choose, any purchase order number, and any notes you write. If you buy CMMC Training online, you pay on a secure checkout page operated by our payment processor, which collects your payment card details directly. Our payment processor shares with us the details you enter on that page, such as your name, email address, company, and billing address, along with the plan you bought and the status of your payment. We do not receive your full card number. When you request a consultation call, we collect your name, work email address, company, and the main need you select. If you arrive at one of our landing pages (for CMMC Training or vCISO services) from an online ad or campaign link, the request forms on that page also record the campaign parameters in that link (utm_source, utm_medium, utm_campaign, utm_term, and utm_content) and, for Google Ads clicks, the Google click ID (gclid). We use these to learn which campaigns lead to requests. If you book a call through our scheduling link, Google Calendar hosts the booking page, and we receive the name, email address and any notes you enter there. If you email us directly, we receive your email address and the contents of your message.

CUI Scope Planner

The CUI Scope Planner at /tools/cui-planner/ runs in your browser. Your answers to its questions are processed by your browser to build the report and are not sent to us, except as described in this section. They are kept in your browser's session storage for that tab only, so the questions and report pages can share them, and are erased when you close the tab or choose Start over. They are not put in page addresses, cookies, or analytics.

To see your full report, you enter your work email address and, if you choose, your company, and we collect them. This form carries none of your answers. We may email you once to follow up on your report. Your email address and company, and a note that your report is unlocked, are also kept in your browser's session storage until you close the tab or choose Start over, so the scoping call form can be filled in for you and the report stays open. When you request a scoping call, we collect your name, work email address, company, the need you select, and your role if you choose one. If you tick the box to attach a summary of your report to a call request, we also receive the five items shown next to that box: your pathway (for example, CUI or FCI), the number of people who handle CUI, your timeline, whether you handle export-controlled data, and the status of your self-assessment in SPRS, as you answered them. Without that box ticked, we receive none of your answers. These forms also record the planner version, the campaign parameters described above and, if you followed a partner's link, the partner reference (ref) in that link. If you tick the box to get updates, we email you when CMMC rules change, and you can unsubscribe at any time.

Information collected automatically

Like most websites, the servers that deliver the Website record technical information about each request, such as IP address, browser type, the page requested, the referring page, and the date and time. Our hosting provider uses this information to deliver the Website, maintain its security, and diagnose problems.

The Website does not load analytics scripts, advertising tags, social media tracking pixels, or similar tracking technologies. We advertise through Google Ads; if you arrive from an ad, the ad click ID in the link is captured by the request forms on our landing pages and in the CUI Scope Planner as described above.

Spam and abuse protection

The contact form, the walkthrough request form on our CMMC Training page, and the CMMC Training order form use Google reCAPTCHA, provided through our hosting provider, to distinguish people from automated submissions. reCAPTCHA collects hardware and software information, such as device and application data, and sends it to Google for analysis. Your use of reCAPTCHA is subject to the Google Privacy Policy and Google Terms of Service.

Web fonts

The Website loads typefaces from Google Fonts. To display them, your browser requests the font files from Google's servers, which receive your IP address and basic browser information as part of that request.

Browser storage

To limit repeated submissions, the contact form stores a submission count and timestamp in your browser's session storage. This information stays in your browser, is not sent to us, and is cleared when you close the browser tab. On our landing pages and in the CUI Scope Planner, campaign parameters, the ad click ID and, in the CUI Scope Planner, any partner reference (ref) from the link you followed are kept in session storage until you close the tab, and are submitted with your request. The CUI Scope Planner also keeps your answers in session storage and, after you enter your email to see your report, your email address, your company and a note that the report is unlocked, as described above.

3. Cookies

The Website does not set its own cookies. Google reCAPTCHA, which runs on some of the Website's forms, may set or read cookies as part of its security analysis. You can control cookies through your browser settings; blocking them may prevent the forms from working, so you may need to allow them on those pages to reach us.

4. How We Use Information

We use personal information to:

We do not use personal information collected through the Website for automated decision-making that produces legal or similarly significant effects.

5. How We Disclose Information

We disclose personal information only as described below:

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

6. Data Retention

We keep form submissions and related correspondence for as long as needed to respond to you, pursue or manage any resulting engagement, and maintain reasonable business records, after which we delete them. If you ask for email updates on CMMC rules, we keep your email address for that purpose until you unsubscribe. Server logs are retained according to our hosting provider's standard practices.

7. Security

The Website is served only over HTTPS and uses security headers that restrict where scripts, styles, and other content can load from. Access to form submissions is limited to DefenseLogix personnel who need it. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Please do not submit sensitive information through the Website's forms or by unencrypted email, including protected health information, controlled unclassified information, credentials, or details of an active security incident. If you need to share sensitive information, reach us first through our contact form, without including the sensitive details, and we will arrange an appropriate method.

8. Your Choices and Rights

You may ask us to access, correct, or delete the personal information we hold about you through our contact form. Depending on where you live, you may have additional rights under applicable law, and we will respond to requests as that law requires. We may need to verify your identity before acting on a request, and we will not discriminate against you for exercising your rights.

You can opt out of non-transactional email from us at any time by replying to the message or contacting us.

9. Children's Privacy

The Website is intended for business audiences and is not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

10. Location of Processing

DefenseLogix is based in the United States, and the Website is intended for users in the United States. Information you submit is processed in the United States, where data protection laws may differ from those in your jurisdiction.

The Website links to third-party websites, including the sources cited in our articles and our LinkedIn profile. Those websites are governed by their own privacy practices, and we are not responsible for their content or policies.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page. Material changes will be posted on this page before they take effect.

13. Contact Us

For questions about this Privacy Policy or to make a request, contact DefenseLogix through our contact form.