What this site collects, and why.

Who this covers

This policy covers postclassicalsecurity.com, operated by Howard Poston, who is the controller of the personal data described here (the person who decides why and how it's used). It does not cover other sites Howard operates (howardposton.com, pythonforcyber.com, cryptoagile.org) or any third-party site linked from here (including Pluralsight and Coursera course pages) — each of those has its own privacy practices.

What we collect, and why

This site has five forms. Each stores only the fields shown below — nothing beyond what you actually submit (plus, for purchases, the payment confirmation details Stripe sends back to us).

Legal basis for each (GDPR):

• Contact: legitimate interests — answering a message you sent us.
• Note subscribe: your consent, confirmed by clicking a link we email you, which you can withdraw at any time.
• Book a Call and Schedule a Briefing: steps taken at your request before entering a contract.
• Purchase: performing a contract with you, and legal obligations around financial records.

Providing this information is voluntary, but we can't reply to a message, arrange a call, or fulfill an order without the fields each form asks for. We don't use automated decision-making or profiling.

We don't use tracking cookies, and we don't run ad-network trackers of any kind — this site carries no advertising and doesn't sell or share data with advertisers.

Analytics

We use Cloudflare Web Analytics, which is cookieless and doesn't track you individually across visits or across other sites. It reports aggregate traffic patterns (which pages get visited, roughly how much traffic, general geography) without building a profile tied to you personally.

Who else sees this data

We use a small number of service providers to run this site. Each only sees what's necessary to do its job:

• Cloudflare — hosts the site and its database (Cloudflare D1), and provides the analytics described above. Standard web server logs (like IP address and request timing) pass through Cloudflare as part of ordinary hosting infrastructure, the same as with any web host.
• Stripe and Link — process payments when you buy something. Purchases are made through Link, a Stripe service that acts as the merchant of record, so the sale, your receipt, and any refund are handled by Stripe and Link rather than by us. You enter your card details and billing information on Stripe's own checkout page; they never touch our servers or database. We receive and store only the order confirmation details listed above. Stripe and Link handle your payment data under their own privacy policies, and you can ask them to delete it. That doesn't remove our own order record, which we keep for accounting and support; ask us if you want that deleted too.
• Resend — relays the emails this site sends: notifying us when a form is submitted, delivering purchased files to buyers, and sending the confirmation link for the Note list. It's used purely as a delivery mechanism and doesn't add you to any marketing list of its own.
• Cloudflare Turnstile — an anti-spam check that may run on form submission. It evaluates the request to filter automated spam; see Cloudflare's own privacy policy for how Turnstile itself processes data.

We don't sell, rent, or share your information with any other third party, and we don't use your data for advertising.

Transfers outside your country

Cloudflare, Stripe, and Resend are US-based companies and may process data in the United States and other countries. Where personal data of people in the EEA or UK is transferred, it relies on the safeguards these providers offer for such transfers, such as the EU–US Data Privacy Framework or Standard Contractual Clauses. Each provider's own privacy documentation has the details.

How long we keep it

• Messages and requests (Contact, Book a Call, Schedule a Briefing): kept as long as reasonably useful for the purpose they were collected for — for example, so we have context if you follow up — and deleted on request.
• Note subscriptions: signups you never confirm are never emailed and are deleted after about 30 days. Once confirmed, your subscription is kept until you unsubscribe. After that we keep your address, marked as unsubscribed, only so we don't email you again. Ask us to delete it entirely if you'd rather.
• Purchase records: kept for as long as financial record-keeping rules require.
• Earlier report requests: before Reports became fully open, a short email form collected addresses to send reports to. Any such addresses already on file are treated like messages above, and deleted on request.

Your rights and choices

• Unsubscribe: every email sent to the Note list includes an unsubscribe link — one click and a confirmation, no login. You can also ask us through the contact form.
• Your rights: if you're in the EEA or UK, you have the right to ask for access to your personal data, to have it corrected or deleted, to restrict or object to how it's used, and to receive a copy in a portable format. Where we rely on your consent (the Note list), you can withdraw it at any time; that doesn't affect anything done before you withdrew.
• How to use them: email support@postclassicalsecurity.com or use the contact form. We'll respond within one month, and we'll locate and delete or share what we have on file for your email address.
• Complaints: you also have the right to complain to your local data protection authority — for example, your national authority in the EU, or the Information Commissioner's Office in the UK.
• No account required: nothing on this site requires creating an account or a password — every interaction is a one-time form submission.

Children's privacy

This site is intended for a professional, adult technical and business audience and is not directed at children. We don't knowingly collect information from anyone under 16.

Links to other sites

Some pages link to third-party sites (course platforms, guest publications, social profiles). Once you leave postclassicalsecurity.com, that site's own privacy policy applies, not this one.

Changes to this policy

If this policy changes in a material way, the "Last updated" date at the top of this page will change to reflect that.

Contact

Questions about this policy or a request about your data: email support@postclassicalsecurity.com or use the contact form. Howard Poston is the controller for everything described here.