Privacy Policy

Contents

1. Information we collect and why
2. What happens when you send the form on this site
3. How long we keep information
4. Who else receives information
5. Cookies and browser storage
6. Sensitive information and minors
7. Information we see while providing our services
8. How we protect information
9. Your rights
10. How to make a request
11. Changes to this policy
12. Contact us

This policy applies to the English version of pralogy.co (the pages under pralogy.co/en/) and to what you send us through it or by email. The Spanish version of the site has its own policy.

The party responsible for your personal information is Pralogy LLC, a cybersecurity firm headquartered in Miami, with an office in Bogotá, Colombia. The team that handles requests works from Bogotá (Pralogy S.A.S.). In this policy, “Pralogy,” “we” and “us” mean Pralogy LLC. Our full details are at the end, in Contact us.

1. Information we collect and why

We work with companies and organizations. “Processing” means collecting, storing, using, sending or deleting personal information. We process information about these groups of people.

Visitors to this site

• Information: your IP address and technical data about the visit, such as your browser and the pages you open. On pralogy.co, and only if you accept measurement, also the identifiers stored in Google's cookies.
• Why: to deliver the pages, protect the site against abuse and, if you accept, measure visits and ads. We explain this in Cookies and browser storage.

People who contact us

Through the form on this site or by email.

• Information: name, company or organization, email, phone number and what you tell us about your request, such as what you need and by when. Some forms also ask for your job title, the size of your company, who asked you for the service, how you prefer that we contact you and how you heard about us. Those additional fields are optional.
• Why: to respond to your request; to schedule and hold the 30-minute consultation; to prepare and send you a quote or a proposal, if you ask for one; to follow up on that request; to know which page or ad brought you, so we can measure what works on the site and in our ads; and, only if you accept at the start of the meeting, to record it, transcribe it and prepare its minutes. If you do not accept, we do not record it.
• What we do not do: we do not use this information to send you newsletters or advertising by email.

Clients and their contact people

• Information: the name, job title, email and phone number of the people each client designates, and the company information needed to contract and invoice.
• Why: to prepare and sign the contract; to coordinate and deliver the services; to send reports and service notices; if the participants accept at the start, to record a meeting, transcribe it and prepare its minutes; to invoice and collect payment; and to meet our accounting and tax obligations.

2. What happens when you send the form on this site

To send the form, you check the authorization box. Without it, we do not store your information or handle your request.

What we store from each submission:

• What you wrote in the form.
• If you answered the self-assessment on the same page and pressed the “See what to review first” button, your answers: one mark per question (yes, no, not sure or unanswered), in the order of the questions and with no text of your own. If you do not send the form, your answers do not leave your browser.
• Proof of your authorization: that you checked the box, the version of the text you accepted, the version of this policy and the time.
• That you used the English version of the site, so we reply in English.
• Where you came from: the page you sent it from, the first page of your visit, the domain of the site that brought you (for example, www.google.com) and a 5-character visit code. If you arrived through a campaign link or a Google ad, now or on an earlier visit, also the identifiers of that campaign or that click.
• Technical data to stop abuse: part of your IP address (the network, without the full number of your device), the type of browser and how many seconds you took to fill in the form.

Your full IP address is not stored. To limit repeated submissions (5 per hour and 20 per day from the same connection), we turn it into a code that cannot be reversed without a secret key. That code is deleted with the first submission saved after the hour or the day ends.

Where it is kept: in a database at Cloudflare, the provider that hosts this site. No page on the site shows or downloads submissions.

Who is notified: when your submission arrives, the system sends an email notice through Microsoft 365 to [email protected], a list in our email that reaches the team members who handle requests. The notice includes your contact details, your request (with your self-assessment answers, if you sent them), the page you came from and the proof of your authorization. It does not include the part of your IP address or the type of browser. The Pralogy team that handles requests reads it, and a person replies to you.

Spam: submissions that look automated are marked as spam, do not trigger a notice and are deleted after 30 days. If an automated submission arrives without the box checked, we store only the technical data, the page, the form, the type of request, the need selected, whether the email was a work or personal address and the internal flags of the submission (for example, “no email”), without name, company, email, phone number or message.

The form does not accept attachments. Do not include passwords or confidential information in your message.

3. How long we keep information

• Form submissions: 24 months from the day they arrive. Spam, 30 days. Deletion is automatic: it runs each time the site receives a new submission, so expired data is deleted with the next submission saved after the period ends. Cloudflare keeps recovery copies of the database for up to 30 days; after that, deleted data can no longer be recovered.
• Form notices (in the mailboxes of the people who receive [email protected]), emails and, from recorded meetings, the audio, the transcript and the minutes: there is no automatic deletion. We keep them as long as they are needed to handle your request and any relationship that follows from it, and we delete them when you ask, except what a law or a contract requires us to keep.
• Proof of your authorization: it is in the submission and also in the notice to [email protected]. We keep it as long as we process your information.
• Clients: for as long as the relationship lasts and, after that, for the time that accounting, tax and commercial rules require.
• Your choice about cookies: 12 months in your browser; after that, we ask you again.
• Your light or dark mode: in your browser, until you clear this site's data.
• Your language choice: 12 months in your browser.
• Site measurement, if you accepted it: Google keeps it according to the retention period set in Google Analytics and Google Ads, and according to its own policies.

4. Who else receives information

Besides our team, these providers and entities receive personal information:

• Cloudflare: hosts this site and the form database. Like any web server, it receives the IP address and technical data of each visit to deliver the pages and protect the site.
• Microsoft (Microsoft 365 and Teams): our email and our meetings. The form notices and the emails you write to us arrive there.
• Our email security provider: filters the email that reaches our mailboxes, such as [email protected].
• Google: measurement of the site and of our ads, only if you accept it (we explain this in Cookies and browser storage).
• Pralogy's management platform, hosted on Amazon Web Services: where we keep our client records.
• Telegram: team members who have linked it receive the management platform's notifications there, for example about a scheduled meeting, with the person's name or email.
• AI services: we use them to transcribe and summarize the meetings we record with your acceptance, to review and draft emails and to prepare the reports and documentation of our work with each client. They may receive what you wrote to us, what was said in a recorded meeting, the contact details that appear there and our working notes with you.
• A bulk email service: sends the security awareness campaigns we run for our clients, to the email addresses each client gives us.
• Our web hosting and domain provider: provides a secondary email service (mail.pralogy.co) that sends automated emails from our services, such as alerts and reports, to the addresses each client designates.
• Our bank: receives the information needed to receive payments from clients.
• External advisors: if we need them, our accounting, tax or legal advisors receive the information they need for their work, under a duty of confidentiality.

Who processes information on our behalf. Cloudflare, Microsoft, our email security provider, Amazon Web Services, the AI services, the bulk email service and our web hosting and domain provider process it to provide their services to us. Google, Telegram and the AI services also process it under their own policies. Our bank processes it under its own policies and the law.

Outside the United States. The team that handles requests works from Bogotá, Colombia, so your information is also accessed and processed there. Cloudflare, Microsoft, our email security provider, Google, Amazon Web Services, Telegram, the AI services, the bulk email service and our web hosting and domain provider work from the cloud and may process information on servers in other countries. When your information goes to another country, we do so with the authorization you gave us, such as the box you check on our form, or when it is needed to perform our contract with you.

Authorities. We provide information to an authority when a law or a court order requires it.

We do not sell or rent your personal information.

5. Cookies and browser storage

A cookie is a small file that a site stores in your browser. Session storage is a similar space that is cleared when you close the tab. Local storage is similar too, but it stays when you close the browser.

What this site stores (details in the table below): a visit code, the first page of your visit, the campaign identifiers in the address, your choice about Google measurement, the light or dark mode and the language you choose with the buttons in the header and, after you send the form, a 5-minute cookie to show you the right confirmation page. None of it includes your name, email or phone number.

Analytics and campaign-measurement cookies (Google's): only on pralogy.co, and only if you accept them. The first time you open pralogy.co, a notice at the top of the page asks whether you accept cookies for analytics and to measure our advertising campaigns. Until you accept them, the site does not load Google Tag Manager or any Google tag. Your choice is stored in your browser for 12 months and applies to both language versions of the site. You can change it at any time with the “Cookie preferences” button at the bottom of the page.

If you accept, the site loads Google Tag Manager, which loads Google's tags. They store their own cookies, for example those that start with _ga and _gcl:

• Google Analytics: visit statistics, such as pages viewed, clicks on external links and downloads.
• Google Ads: to know whether a visit came from one of our ads and whether it led to a request.

If you accept, Google may use cookies for advertising purposes, such as measuring the results of our ads. Google may also collect information about your online activity over time and across different websites, under its own policies.

What the site asks Google not to do. When it loads Google's tags, the site tells Google not to use your visit for personalized advertising, such as showing you Pralogy ads on other sites (remarketing), and not to use the information you type in forms for advertising. According to Google, with these settings its tags do not use that information for advertising or add your visit to remarketing lists.

What the site tells Google, if you accept: clicks on the buttons that lead to the consultation form. When you send the form, the submission code, the form, the type of request, the need you chose, the timing you chose and whether the email is a work or personal address. The site's code does not send Google your name, email or phone number.

If you change your mind: if you decline measurement after accepting it, the site deletes Google's cookies for pralogy.co from your browser (those that start with _ga, _gid and _gcl) and, if measurement was already running on the page, reloads it without measurement.

Do Not Track and Global Privacy Control. Some browsers send these signals. This site does not read them: Google measurement stays off until you accept it in the cookie notice, and you can change your choice at any time.

How to block it:

• In your browser settings, you can block or delete cookies and site data, or use a private window.
• Google offers a browser add-on to opt out of Google Analytics and My Ad Center to control personalized ads.
• If you block cookies, storage or JavaScript, the site and the form keep working. We just stop knowing which page or campaign brought you, and the site does not remember your light or dark mode or your language. If you block storage, the cookie notice will ask you again on every page.

6. Sensitive information and minors

Sensitive information. This includes, for example, health or biometric data, or data that reveals racial or ethnic origin or religious or political beliefs. We do not ask for it on this site or to handle a request. If you send it to us without our asking, we do not use it for any of the purposes in this policy, and you can ask us to delete it. No one is required to give us sensitive information.

Minors. This site is for companies and organizations. It is not directed to minors, including children under 13, and we do not knowingly collect their information.

7. Information we see while providing our services

When we deliver a service, such as penetration testing or digital forensics, we may see personal information that belongs to our client: that of its employees, its customers or its users.

In those cases, Pralogy acts on behalf of its client. We process that information only to deliver the contracted service, under the contract, the nondisclosure agreement (NDA) and the client's instructions. We do not use it for anything else. To deliver our services, we use the providers named in Who else receives information.

If your information is in the systems of an organization that is our client, that organization is responsible for it, so please contact it. If you write to us, we will forward your request to that organization and let you know.

8. How we protect information

No measure eliminates all risk. These are the measures we apply today to the form on this site:

• The site is served over an encrypted connection (HTTPS) and tells your browser to always use it.
• Submissions are stored in a Cloudflare database that can only be accessed from Pralogy's account. No public page lists or downloads them. Previews of the site write to a separate database.
• We do not store your full IP address, and the control of repeated submissions uses a code that cannot be reversed without a secret key.
• The form only accepts submissions from this site, does not accept files and discards anything that does not match the expected format.
• The notice to [email protected] is plain text, without tracking links or images.
• The site only loads its own resources and, on pralogy.co and only if you accept measurement, Google's.

9. Your rights

You can:

• Access the personal information we have about you and know how we have used it.
• Correct it if it is inaccurate or incomplete.
• Delete it, except what a law or a contract requires us to keep.
• Withdraw your authorization at any time.

To exercise these rights, write to [email protected]. You can make these requests at no cost, yourself or through someone you authorize, with proof of that authorization.

Depending on where you live, you may have additional rights under state law. We will honor them to the extent they apply to us.

10. How to make a request

Write to [email protected]. It is the channel for these requests, because it keeps a record of what was asked and what was answered.

Include in your email:

• Your name and how we can identify you (for example, the email you used to contact us).
• What you are asking for: to access, correct or delete your information, to withdraw your authorization or to file a complaint about how we handled it.
• If it is a complaint, the facts and any documents that support it.
• The email where you want to receive the answer.
• If you are acting on behalf of someone else, a document that proves it.

Before we give you information or delete it, we may ask you to confirm your identity.

11. Changes to this policy

Version 1 · Effective October 20, 2026.

If we change this policy, we will publish the new version here, with its number and the date it takes effect. If the change is significant, for example a new purpose or a change in who is responsible for your information, we will let you know before it applies, on this site and through the channel we usually use to communicate with you. If the change is a new purpose, we will ask for your authorization again before using your information for it.

Each form submission stores the version of this policy that was in effect when you sent it.

12. Contact us

• Responsible for your personal information: Pralogy LLC.
• Address: 3940 NW 79th Ave #744, Miami, FL 33166.
• Email: [email protected], also for requests about your personal information.