Privacy Policy
Last updated: August 17, 2026 · Effective: August 17, 2026
The short version
- We use Google Analytics cookies to measure which pages bring people here, and would use Google Ads cookies the same way if we run advertising campaigns. They only load if you press "Accept" on the banner. Press "Reject" and no cookies are set.
- Other than that, the only personal data we receive is what you choose to send us — through the contact form or by email.
- We use it to respond to you and, if you become a client, to provide our services. We never sell it, and we do not use it to train AI models.
1. Who we are
KRYO LLC, a company registered in Florida, USA ("KRYO", "we", "us"), operates this website at kryo.solutions. For anything privacy-related, contact info@kryo.solutions.
2. What we collect
Contact form
If you submit the contact form, we receive what you enter:
- Name, work email, company name, and what's driving your request
- Optionally: your application or website URL, the plan you're interested in, and a free-text message. On the penetration-testing page you can also ask us to send a sample report
- Which page you submitted from, so your enquiry reaches the right person
If you email us, we receive your address and whatever you include in the message.
Technical logs
Our hosting provider (Netlify) records standard server logs — such as IP address, request URL, and browser user agent — for security and operations. We do not use these to identify or profile visitors.
Analytics and advertising
If — and only if — you accept cookies, Google Analytics records how you use the site: pages viewed, approximate location from a truncated IP address, device and browser type, and how you arrived.
We are not running advertising campaigns at present, and no Google Ads tag is active on this site. If that changes, Google Ads would record whether a visit that came from one of our adverts ended in a contact-form submission — again only if you accept cookies. We will update this policy before any advertising tag goes live. See section 3 for the detail and how to change your mind.
What we don't collect
No accounts, and no cookies at all unless you accept them. The contact form takes no file uploads. There is no reCAPTCHA, no chat widget, no social media pixel and no embedded third-party content — the fonts and scripts this site uses are served from our own domain rather than a third-party CDN.
We also do not use Google's Privacy Sandbox advertising APIs. Topics, Attribution Reporting and Protected Audience are all switched off in this site's Permissions-Policy header.
3. Cookies and consent
On your first visit we show a banner with two equally weighted choices, Accept and Reject. No cookies are set until you pick one.
We use Google Consent Mode. To be exact about what that means: Google's tag file is fetched from Google's servers on every page, before you choose, so Google receives that request — your IP address and browser user agent, as any server does when it serves a file. What the tag then does is gated by your choice. Until you accept, it runs in a denied state: it sets no cookies and stores no identifier on your device.
Your choice is stored in your browser's local storage under the key
kryo-consent. That is not a cookie, is never sent to us or to anyone
else, and exists only so we stop asking you on every page.
If your browser sends a Global Privacy Control signal, we treat it as Reject and do not show the banner at all. Making a choice here afterwards overrides the signal for this site.
If you accept
- _ga, _ga_<id> — Google Analytics. Tells returning visits apart from new ones and groups page views into a session. Up to 2 years.
- _gid — Google Analytics. Distinguishes visitors. 24 hours.
If we run advertising campaigns, accepting would additionally set _gcl_au — Google Ads, up to 90 days — which links a contact-form submission back to the advert that brought you here. No Google Ads tag is active on this site today, so this cookie is not currently set.
Cookie names and lifetimes are set by Google and can change without notice from us.
If you reject
No cookies are set and nothing is stored on your device. Google's tag may still send a cookieless signal that a page was viewed; it carries no identifier that we or Google can use to recognise you on a later visit or on another site. It does include the IP address your browser connects from, which Google uses to derive an approximate country and, per Google's own documentation, does not log for advertising purposes. If you would rather Google's tag never loaded at all, a content blocker or the opt-out add-on below will stop it.
Changing your mind
Use the Cookie choices link — it appears in the footer of every page and re-opens the banner. Clearing your browser storage for this site has the same effect. You can also opt out of Google Analytics across all sites with Google's browser add-on.
Legal basis. Where the GDPR or UK GDPR applies, analytics and advertising cookies are used on the basis of your consent (Art. 6(1)(a)), which you may withdraw at any time using the link above. Withdrawing consent does not affect anything done before you withdrew it.
4. How we use your information
- To respond to your inquiry and schedule a scoping call
- To prepare a quotation and, if you engage us, to deliver our services
- To keep business records we are legally required to keep
We do not sell personal information, and we do not add you to marketing lists without your consent.
We do not use what you send us — contact-form entries, email content, or the record of our correspondence — to train AI models. Our email provider, Google Workspace, is contractually restricted from using customer data to train its own models without our instruction. We do not warrant that on behalf of every provider named in section 5 indefinitely; if it stops being true of a provider we use, we will update this section.
5. Service providers
We share data only with providers who help us run this site and respond to you:
- Netlify, Inc. (United States) — website hosting and contact-form processing. Form submissions are stored in Netlify and forwarded to our inbox. Netlify screens every submission for spam through Akismet, a service of Automattic Inc., as its own sub-processor. Akismet keeps spam-screening data on servers worldwide and deletes it automatically — in most cases between two weeks and ninety days after it is received.
- Google Workspace (Google LLC) — business email.
- Google Analytics (Google LLC / Google Ireland Ltd.) — website measurement, and only after you accept cookies. Google acts as our processor for analytics.
- Google Ads (Google LLC / Google Ireland Ltd.) — advertising performance measurement. Named here because we may use it; no Google Ads tag is active on this site today. For advertising measurement Google acts as an independent controller under its own terms rather than as our processor.
Each is bound by its own security and privacy commitments and processes data on our behalf, except for Google Ads where noted above. We may also disclose information if required by law, or as part of a business transaction such as a merger or acquisition.
6. Client engagement data
Client engagements are not covered by this policy — they're governed by separate written agreements signed before work begins: a mutual NDA, our Engagement Terms, and, where applicable, a Data Processing Addendum. Security testing additionally requires a signed Rules of Engagement and Authorization to Test. Those agreements set out how your source code, system access, and business data are handled, retained, and deleted, including any third-party or AI tooling involved in delivery. Nothing described here applies until that paperwork is signed — if you're describing your systems to us before then, keep it high-level.
7. Retention
Inquiry data (form submissions and emails) is kept for as long as needed to handle your request and for a reasonable follow-up period, then deleted — no later than 24 months after our last contact, unless we are required to keep it longer or you become a client (in which case engagement records are retained per our agreement).
8. Security
The site is served exclusively over HTTPS with strict security headers. We collect the minimum data necessary, and access to inquiries is limited to the people who handle them.
9. Your rights
Whoever you are and wherever you live, you can ask us to confirm what personal information we hold about you, give you a copy of it, correct it, or delete it. Write to info@kryo.solutions. We will respond within a reasonable timeframe and in accordance with applicable law. We may need enough information from you to be satisfied the request is genuinely yours; anything you send us for that purpose is used for that purpose only.
We will not refuse to deal with you, change our prices, or give you a worse service because you exercised any of these rights.
If you are in the United States
Twenty states now have comprehensive consumer privacy statutes — California's CCPA/CPRA is the best known — each with its own applicability thresholds, usually a revenue floor, a volume of state residents handled per year, or a share of revenue derived from selling personal data. KRYO is a small consultancy and does not meet those thresholds, and most of those statutes in any case exclude people acting in a business capacity, which is what this site's contact form is for. We offer the rights below to residents of any U.S. state as a matter of practice. Doing so is not an admission that any particular statute applies to KRYO.
- Know and access — confirmation of whether we hold personal information about you, and a copy of it
- Correct — have anything inaccurate about you fixed
- Delete — have it erased, except where we are required to keep it
- Portability — receive it in a usable format
- Opt out — of any sale of your personal information, any sharing of it for cross-context behavioural advertising, and any targeted advertising
- Non-discrimination — as set out above
On that fifth point there is nothing to opt out of today: we do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it to build advertising profiles or to make automated decisions about you. If your browser sends a Global Privacy Control signal we honour it as an opt-out regardless — see section 3.
If you are in the EEA, the United Kingdom, or Switzerland
Where the GDPR or UK GDPR applies, you additionally have the rights to restriction of processing, to object to processing, and to lodge a complaint with your local supervisory authority. Where GDPR applies, we process inquiry data on the basis of our legitimate interest in responding to business inquiries and, where you request services, to take steps toward a contract — you have a right to object to processing on that basis. Analytics and advertising cookies are processed on the basis of your consent, which you can withdraw at any time — see section 3.
10. International transfers
We are based in the United States and our providers process data in the United States, with one exception: Akismet, the spam-screening service every form submission passes through, keeps its data on servers worldwide and relies on the EU Standard Contractual Clauses where it moves data out of the EEA. If you contact us from outside the U.S., your information will be transferred to and processed in the U.S. Where GDPR / UK GDPR applies, this transfer relies on the fact that you initiated it yourself, for pre-contractual steps you requested (Art. 49(1)(b) GDPR) — for example, by submitting the contact form to ask about our services. If you accept cookies, Google may also transfer analytics and advertising data to the United States; Google relies on the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework for those transfers. The Framework's adequacy decision was upheld by the EU General Court in September 2025 and is under appeal to the Court of Justice (Case C-703/25 P). If that appeal changes its status we will update this section.
11. Children
This site is a business-to-business service and is not directed at children under 16. We do not knowingly collect their data.
12. Changes to this policy
If we change this policy, we will post the new version here with an updated date. Material changes will be highlighted on this page.
13. Contact
KRYO LLC · Florida, USA · info@kryo.solutions