This policy covers cyberpools.org: what the site collects, why, and who else handles it. We are a cybersecurity company, so we keep that list short on purpose.
In this policy, "CyberPools", "we" and "us" mean Gates Consulting, doing business as CyberPools.
The short version
- We don't use analytics, advertising pixels or tracking cookies.
- We don't sell your information or share it for advertising.
- We collect personal information only when you sign in to the member area, ask us a question there, or contact us.
What we collect
When you browse the site. Like every website, our hosting provider receives technical information with each request, such as your IP address, browser type and the page you asked for. We use it to deliver the site and keep it secure. We don't use it to build a profile of you.
When you sign in to the member area. We collect your work email address and send a one-time code to it. We check the address against the member organizations we serve, using the contact records we already hold for those organizations. We keep a record of sign-in activity, such as when a code was requested and whether sign-in succeeded, to protect the member area from misuse.
When you ask the vCISO a question. Questions sent from the member area reach our team by email, along with your email address and the organization you chose, so we can reply.
When you use the contact form. We collect what you enter: your name, work email, organization, what you need and any details you give. We use it to respond to you.
Cookies
The site sets cookies only when you sign in to the member area, and only to make sign-in work:
- __Host-cp_signin holds your sign-in attempt and expires after 15 minutes.
- __Host-cp_member keeps you signed in for up to 30 days, or until you sign out.
Both are limited to our site and can't be read by other sites or by scripts on the page. We don't use any other cookies, so there is nothing to opt in to or out of.
Who else handles your information
We use a small number of service providers to run the site. They handle information only to provide their service to us.
- Cloudflare hosts the site and stores member sign-in records. Cloudflare Turnstile checks that sign-in requests come from a person, not an automated script. It sees your IP address and basic browser signals and does not set cookies.
- Google Fonts supplies the typefaces the site uses. Loading them sends your IP address and browser information to Google.
- Microsoft 365 sends sign-in codes and delivers member questions and contact messages to our team.
We may also disclose information if the law requires it, or to protect the security of our systems and the people who use them.
How long we keep it
Sign-in codes expire after 10 minutes. Member sessions end after 30 days or when you sign out. We keep sign-in records, questions and contact messages for as long as we need them to provide our services, keep the member area secure and meet our legal obligations.
How we protect it
All traffic to the site is encrypted. Member content is available only after sign-in with a one-time code, and access is limited to the member organizations we serve. Sign-in attempts are rate-limited.
Do Not Track and Global Privacy Control
We don't track visitors across sites or over time, so the site works the same way whether or not your browser sends a Do Not Track or Global Privacy Control signal.
Our cyber risk control services
This policy covers this website. Information we handle while delivering services to member organizations, such as risk assessments, scans and phishing simulations, is governed by our agreements with those organizations and their pools. For example, our practice phishing emails lead to training pages that never ask for passwords or other credentials. Read more on Clicked a suspicious email?
Children
This site is for staff of insurance pools and their member organizations. It isn't directed to children, and we don't knowingly collect personal information from children under 13.
Your choices and requests
You can ask what personal information we hold about you, or ask us to correct or delete it, by emailing [email protected]. We may need to confirm your identity before acting on a request. Deleting your email address from our records may mean you can no longer sign in to the member area.
Changes to this policy
If we change this policy, we will post the new version on this page and update the effective date at the top. If a change materially affects how we use information we already hold, we will tell member organizations directly.
Contact us
Questions about this policy or your information: [email protected].