Privacy policy

1. Who we are

Crownstone Strategy Group LLC, a Texas limited liability company ("Crownstone", "we", "us"), is an independent cybersecurity advisory firm. We operate the website at crownstone.io and the Lens platform at lens.crownstone.io, which our clients use as a client portal and our staff use to deliver engagements.

For questions about this policy or your information, email contact@crownstone.io or write to us at 2831 Sunfish St, Prosper, TX 75078.

2. What this policy covers

This policy applies to personal information we handle through:

• The website, crownstone.io, including its contact form, booking links, self-assessments and downloadable resources.
• The Lens platform, including the client portal, agreement signing and invoicing pages.
• Our services, including advisory engagements, assessments, meetings and related correspondence.

Two roles. For website visitors, prospects and our own business contacts, Crownstone decides how information is used and acts as the controller (or "business" under US state laws). For information a client gives us to perform an engagement, including files uploaded to the Lens platform, we act on the client's behalf and under its instructions as a processor (or "service provider"). In that case the client's Master Services Agreement (MSA), Statement of Work (SOW) and any data processing terms we have agreed with that client govern how we handle the information, and they prevail over this policy where they differ. If you are an employee of one of our clients, questions about your organization's data may be best directed to your organization first; we will help it respond.

This policy does not cover third-party websites or services that we link to, which have their own privacy policies.

3. What we collect

Website visitors

• Usage information collected by Google Analytics, such as pages viewed, approximate location derived from your IP address, device and browser type, referring page, and campaign tags (for example, utm_source) in the link you followed.
• What you send us through the contact form or by email: typically your name, email address, company and message.
• Self-assessment answers. If you complete one of our online assessments, we receive your answers and, if you choose to see or receive your results, the name, email address, company and role you provide.
• Booking details. When you book a call, Calendly collects your name, email address, the time you choose and any answers you give, and shares them with us.

Prospects and business contacts

Business contact details (name, title, organization, business email and phone), notes from our conversations, and information you share about your organization while we discuss working together. We may also use publicly available professional information, such as a company website or professional profile. We find prospects through our own outreach, referrals and public sources such as LinkedIn; we do not buy contact lists from data providers.

Clients and client staff

• Names, job titles, business email addresses and roles of the people we work with.
• Meeting details and, where a client agrees, meeting notes or transcripts.
• Billing contact and billing details needed to invoice. Card and bank payments are handled by Stripe; we do not receive or store full card numbers.
• Agreements and signature records (see electronic signatures in our Terms).

Lens portal users

• Account information: name, business email address, organization and role. Passwords are stored only as one-way hashes.
• Security and activity records: sign-in times, IP address, browser information, active sessions, and a record of significant actions (for example, uploading a file, approving a document or signing an agreement).
• What you add: comments, approvals, responses to questionnaires and files you upload.

Data clients provide for engagements

To assess a security program, clients may give us documents, configurations, policies, interview responses, vulnerability scan results and similar material. This can incidentally include personal information, such as staff names, usernames, email addresses, device names or IP addresses. We ask clients to share the minimum needed and to remove anything that is not. The portal tells users never to enter passwords, keys, health records (PHI) or controlled government information (CUI), and our Terms prohibit it.

What we do not seek

We do not ask for, and ask you not to send us, sensitive personal information such as government identification numbers, financial account credentials, health information, precise location, or information about children.

4. How we use information

• To respond to enquiries, schedule calls and send proposals you ask for.
• To deliver our services: running engagements, preparing findings and reports, and communicating with your team.
• To provide, secure and support the Lens platform, including authenticating users, preventing misuse, and keeping an audit trail.
• To prepare and sign agreements, issue invoices and collect payment.
• To send service emails, such as invitations, password resets, signing requests and invoice notices.
• To understand how the website is used so we can improve it.
• To send occasional professional updates where you have asked for them or where the law otherwise allows; every such message includes a way to opt out. Our newsletter, The Lens Signal Report, goes only to people who sign up for it, through our email provider, and you can unsubscribe at any time.
• To meet legal, tax, accounting and regulatory obligations, and to establish or defend legal claims.

We do not sell personal information, and we do not use it for targeted advertising.

5. Legal bases

If you are in the European Economic Area, the United Kingdom or Switzerland, data protection law requires a legal basis for each use of your information. Where those laws apply, we rely on:

• Contract: to provide services and portal access, sign agreements and invoice.
• Legitimate interests: to respond to business enquiries, run and secure our website and platform, keep audit records, and improve our services, balanced against your rights.
• Consent: for website analytics cookies where consent is required, and for optional marketing emails. You can withdraw consent at any time without affecting earlier processing.
• Legal obligation: to keep financial records and respond to lawful requests.

6. AI processing

Parts of the Lens platform use AI models provided by Anthropic to help our team analyze engagement material, for example to summarize documents and meeting notes, draft findings and suggest recommendations. Our commitments:

• Client data is never used to train AI models. We use Anthropic under its commercial terms, which do not permit training on the content we send, and we do not use client data to train any model of our own.
• A person reviews the output. AI-assisted drafts are reviewed by Crownstone staff before they reach a client. We do not use AI to make decisions that have legal or similarly significant effects on individuals.
• Only what is needed is sent. We send the material a task requires, not a client's whole data set.

Anthropic keeps the inputs we send and the outputs it returns only for the limited period its commercial terms allow, then deletes them. They are never used to train models.

7. Sharing and sub-processors

We share personal information only with service providers that help us run our business, under contracts that limit their use of it to providing their service to us. The providers we use today are:

We will update this list before adding a provider that processes client engagement data, and we notify clients as their agreements require.

We may also disclose information:

• to professional advisers, such as lawyers, accountants and insurers, under duties of confidentiality;
• when required by law, court order or other legal process, or to protect the rights, safety or property of Crownstone, our clients or others; where the law allows, we will tell the affected client before disclosing its data;
• in connection with a merger, acquisition or sale of all or part of our business, subject to this policy's protections.

8. International transfers

We are based in the United States and store data in the United States. If you contact us or use our services from another country, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses or a provider's certification under the EU-US Data Privacy Framework. For clients and visitors in the European Economic Area or the United Kingdom, we rely on the Standard Contractual Clauses.

9. How long we keep information

We keep personal information only as long as we need it for the purposes above, then delete it or make it anonymous.

• Client engagement files uploaded to the Lens platform are kept until the engagement closes and for 12 months afterwards, then deleted, unless the client's agreement says otherwise or the client asks us to delete them sooner.
• Signed agreements, invoices and payment records are kept for as long as needed to meet legal, tax and accounting obligations, which is 7 years.
• Security audit records are append-only, so that no one can quietly alter the history of who did what. They are kept for 7 years. When a portal account is removed, the account is anonymized rather than deleted where audit or financial records still refer to it.
• Portal accounts remain while the user's organization is a client and the account is active. Accounts that have not been used for 24 months are removed.
• Enquiries and prospect records are kept for 24 months after our last contact, unless a relationship begins.
• Website analytics data is kept in Google Analytics for 14 months.
• Backups may hold deleted information until they age out on their normal schedule of 7 days.

10. How we protect information

Security is our profession, and we apply it to our own systems. We describe our measures in general terms so the description does not help anyone trying to defeat them. They include:

• Encryption of data in transit (HTTPS with strict transport security) and at rest on our hosting provider, with additional encryption for stored credentials and integration secrets.
• Access control: portal access is by invitation only; each user sees only their own organization's information; staff access follows least privilege.
• Session protection: sign-in uses secure, httpOnly session cookies backed by server-side sessions that expire after inactivity and can be ended at any time; changing a password ends existing sessions.
• Request protection: protection against cross-site request forgery, rate limiting on sign-in and other sensitive actions, and restrictive browser security headers.
• Audit trail: significant actions are recorded in a tamper-evident audit log.
• Monitoring of availability and errors, with alerts to our team.
• Secrets management: keys and passwords are held in a managed secret store, never in code.

No system is perfectly secure, and we cannot promise that information will never be accessed without authorization. If we become aware of a security incident affecting your personal information, we will notify you and the relevant authorities as the law and our client agreements require.

To report a security concern about our website or platform, email contact@crownstone.io. Please do not include sensitive details in the first message; we will arrange a secure way to share them.

11. Cookies and analytics

The Lens platform does not use analytics or advertising cookies. You can block or delete cookies in your browser settings; blocking Lens session cookies will prevent you from signing in. You can also opt out of Google Analytics with Google's browser add-on. Google signals and ad personalization are turned off in our Google Analytics account, and we do not use Google Analytics data for advertising.

12. Your rights and choices

Depending on where you live, you may have the right to:

• know what personal information we hold about you and receive a copy;
• correct information that is inaccurate;
• have information deleted;
• receive information in a portable format;
• object to or restrict certain processing, including direct marketing;
• withdraw consent where we rely on it;
• opt out of the sale of personal information, sharing for targeted advertising, or profiling with significant effects (we do none of these);
• not be treated differently for exercising your rights;
• complain to a data protection authority.

How to make a request. Email contact@crownstone.io with the subject "Privacy request". We will confirm receipt, verify your identity in a way proportionate to the request (usually by confirming control of your email address), and respond within the time the law requires, normally within 30 to 45 days. You may use an authorized agent; we will ask for proof of their authority. If we decline a request, we will explain why, and where the law provides it you may appeal by replying to our decision with the subject "Privacy appeal". We will respond to an appeal within the time the law requires.

Information we process for a client. If your request concerns data that a client provided for an engagement, we will pass it to that client and help it respond, as our agreement with the client requires.

13. US state privacy laws

Several US states, including California (under the CCPA as amended by the CPRA) and Texas (under the Texas Data Privacy and Security Act), give residents specific privacy rights. Where these laws apply to Crownstone, the rights in section 12 are available to you, and this section provides the additional disclosures they require.

• Categories collected in the last 12 months: identifiers (such as name, email address and IP address); professional or employment information; commercial information (such as services purchased and invoices); internet activity on our website and platform; and approximate location derived from IP address. Sources and purposes are described in sections 3 and 4.
• Disclosures: we disclose these categories to the service providers listed in section 7 for business purposes only.
• Sale and sharing: we do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the last 12 months. We do not knowingly collect information from anyone under 16.
• Sensitive personal information: we do not seek it and do not use it to infer characteristics about anyone. Account passwords are used only to authenticate you.
• Retention: described in section 9.

14. Children

Our website, platform and services are intended for businesses and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

15. Changes to this policy

We may update this policy as our services, providers or the law change. We will post the new version on this page with a new effective date and version number. If a change materially affects how we handle information we already hold, we will tell clients and portal users in advance, by email or in the portal.

16. Contact us

Crownstone Strategy Group LLC
2831 Sunfish St, Prosper, TX 75078
contact@crownstone.io

See also our Terms of Service.