Privacy policy.

Anzaa Enterprises, Inc., a California corporation doing business as Kapacyber ("Kapacyber", "we", "us", or "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, request a security assessment, or interact with our marketing materials. Please read this policy carefully. If you disagree with its terms, please discontinue use of our site.

Client data we process on your behalf under a managed services agreement (MSA) or data processing agreement (DPA) is governed by that agreement, not by this Privacy Policy.

This policy is in two parts, because we handle two different kinds of data in two different roles:

• Part A — Website Visitors and Prospective Clients. Data we collect as the controller: site visits, cookies, forms, lead capture, and marketing email.
• Part B — Client Data Processed on Our Clients' Behalf. Data we access while delivering our services to a client, which is governed by that client's contract with us rather than by this policy.

Sections 13 to 15 apply to both parts.

Part A — Website Visitors and Prospective Clients

This Part describes information we collect and use as the controller of that information, in our own right.

1. Information We Collect

We may collect the following types of information:

Information You Provide Directly

• Name, email address, phone number, and company name when you contact us, request an assessment, or download a resource
• Information submitted through our contact form, free assessment form, or any gated content (such as e-books, checklists, or templates)
• Communications you send us by email or through our website

Information Collected Automatically

• Log data including your IP address, browser type, pages visited, and time spent on those pages
• Cookies and similar tracking technologies to improve your experience on our site
• Device information such as hardware model and operating system

Any technical data, network configurations, vulnerability findings, or other confidential corporate information you share with us during a security assessment or related sales conversation is treated as strictly confidential and used solely to conduct the requested assessment.

2. How We Use Your Information

We use the information we collect to:

• Respond to your enquiries and provide the services you request
• Send you information about our services, security alerts, and updates where you have opted in
• Improve our website and services
• Comply with legal obligations
• Detect, prevent, and address technical issues or security incidents

We do not sell, trade, or rent your personal information to third parties.

3. Cookies

Our website uses cookies to enhance your browsing experience. Cookies are small data files stored on your device. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, some parts of our site may not function properly without cookies.

We use the following types of cookies:

• Essential cookies: Required for the website to function correctly
• Analytics cookies: Help us understand how visitors interact with our website
• Preference cookies: Remember your settings and preferences

You can review and change your cookie choices at any time using the Cookie Preferences link in our website footer. Analytics cookies are set only if you opt in; if you decline, or make no choice, the analytics providers named in Section 4 are not loaded and set no cookies.

Alongside cookies, we use your browser's local storage, which keeps small values on your device rather than sending them to us. We use it for three things: your cookie-consent choice, a record of which gated downloads you have unlocked so you are not asked for your email again, and the domain and score from a free tool you have run, so a later run can show you whether the score changed. Clearing your browser's site data removes all of it.

4. Third-Party Services

We use the third-party services named below. Each has its own privacy policy governing how it handles information. The three analytics providers that set cookies or identify your browser — Google Analytics, Ahrefs and Microsoft Clarity — are loaded only if you opt in to analytics in our cookie banner. If you decline, or make no choice, none of those three is loaded at all.

Cloudflare (hosting).Our website is hosted on Cloudflare Pages, so every request to the site passes through Cloudflare's network. Cloudflare processes technical data including your IP address, user agent, and the page requested, in order to serve the site and protect it from attack. This happens for every visitor and is not optional, as the site cannot be delivered without it.

When you submit our contact form, free assessment form, or request a gated resource, the details you provide (such as your name, email address, and phone number) are transmitted to and stored in our customer relationship and email marketing platform, Systeme.io, which acts as a processor on our behalf. Alongside those details we send Systeme.io which form you used and the address of the page you submitted it from, so we know what you were reading when you got in touch. Systeme.io processes this information in accordance with its own privacy policy.

We use Cloudflare Web Analyticsto measure aggregate, privacy-friendly site traffic (such as page views, top pages, and referrers). Cloudflare Web Analytics does not use cookies, does not fingerprint visitors, and does not collect personal information about you. See Cloudflare's privacy policy for details.

We also use Microsoft Clarity to understand how visitors interact with our website through aggregate behavioural metrics, heatmaps, and session replays. Clarity collects information such as pages visited, clicks, scrolling activity, and time spent on pages, and may capture mouse movements and similar interactions. Sensitive form fields are automatically masked. This data helps us improve our website and services. Microsoft processes this information in accordance with its privacy statement. Clarity is loaded only if you opt in to analytics. You can also opt out via your browser's Do Not Track setting or by using a privacy-blocking extension.

We use Google Analytics 4 to measure site traffic and understand which pages and campaigns bring visitors to us. Google Analytics sets cookies on your device and collects information such as pages visited, session length, approximate location derived from your IP address, and how you arrived at the site. Google processes this information in accordance with its privacy policy. Google Analytics is loaded only if you opt in to analytics.

We use Ahrefs Web Analytics to measure page views and referring sites for search-performance reporting. Ahrefs processes this information in accordance with its privacy policy. Ahrefs Web Analytics is loaded only if you opt in to analytics.

Cloudflare DNS (free tools).Some of our free tools, such as the DMARC checker and the security-grade scan, look up public records for a domain name you type in. To do that, we send the domain name you entered to Cloudflare's public DNS resolver. We send the domain name only; we do not send your identity or your IP address to the resolver.

We do not keep a record of the domains you submit to these tools. A domain you enter is used to run the check and return your result, and is not written to any database or log we hold. To stop the tools being abused we count requests against the requesting IP address and a short time window; that counter holds no domain name and expires on its own. The domain you enter is not sent to our analytics providers. We count that a tool was used, and what verdict or grade it returned, but the domain itself is not included in that measurement. One thing does happen with the domain locally, and we would rather be plain about it: the security-grade tool saves the domain and its score in your own browser's local storage, so it can tell you whether your score has changed since last time. That stays on your device and is never sent to us.

5. Data Security

We implement industry-standard technical and organisational measures designed to protect your personal information against unauthorised access, alteration, disclosure, or destruction. No method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required by law. When your data is no longer needed, we securely delete or anonymise it.

7. Your Rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your personal information
• Object to or restrict our processing of your data
• Request a portable copy of your data
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us at [email protected].

8. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with specific rights regarding your personal information.

You have the right to:

• Know what categories of personal information we collect, the sources of that information, the business purposes for collecting it, and the categories of third parties (if any) we share it with
• Request access to the specific pieces of personal information we hold about you
• Request deletion of your personal information, subject to legal exceptions
• Request correction of inaccurate personal information
• Opt out of the "sale" or "sharing" of your personal information for cross-context behavioural advertising
• Limit the use and disclosure of any sensitive personal information
• Be free from discrimination for exercising any of your CCPA / CPRA rights

We do not sell or share your personal information as those terms are defined under the CCPA / CPRA. To exercise any of your California privacy rights, please contact us at [email protected]. We will verify your request before responding.

9. UK & EU Visitors (UK GDPR / EU GDPR)

If you are located in the United Kingdom or the European Economic Area, you have rights under the UK GDPR and EU GDPR including those listed in Section 7. Our lawful bases for processing your personal data are: your consent (for marketing communications and non-essential cookies), the performance of a contract or pre-contractual steps you request (for example, responding to your enquiry or assessment request), and our legitimate interests in operating and improving our website and services. Where we transfer personal data outside the UK or EEA — for example to our US-based service providers such as Systeme.io — we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum. To exercise your rights or to lodge a complaint, contact us at [email protected]. UK and EEA residents also have the right to complain to their local supervisory authority.

Part B — Client Data Processed on Our Clients' Behalf

This Part describes data we access in the course of delivering managed security services to a client — for example data on protected endpoints, in client email and identity systems, in client cloud storage, and in backups we hold on a client's behalf.

10. Our Role and the Governing Agreement

We process this data as a service provider, acting on the instructions of the client that engaged us. We do not use it for our own purposes, and we do not sell it.

The handling of this data is governed by the client's contract with us — the Master Services Agreement, data processing agreement, or equivalent — and not by this website policy. Where a term of that contract conflicts with this policy, the contract controls for that data. If you are an employee, customer, or contact of one of our clients and you want to exercise a right over your personal data, please contact that client, who is the controller of it. We will support them in responding.

11. Protected Health Information (HIPAA)

Where we create, receive, maintain, or transmit protected health information ("PHI") for or on behalf of a covered entity, our handling of that PHI is governed by the Business Associate Agreement ("BAA") signed with that client. The BAA controls over this policy in respect of PHI.

12. Sub-processors

We use third-party security vendors to deliver our services. Those vendors may process client data as sub-processors, under their own agreements with us and subject to the obligations we owe our clients.

A current list of the sub-processors used in service delivery is available to clients on request. Please contact us at [email protected].

General Provisions

The following sections apply to both Part A and Part B.

13. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal data, please contact us immediately.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

15. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us:

• Email: [email protected]
• Website: kapacyber.com/contact
• Mail: Anzaa Enterprises, Inc. dba Kapacyber, 621 Stockton St. #204, San Francisco, CA 94108