Legal
Privacy Policy
Truehat is a security assessment brand. We collect only what we need to run this website, answer enquiries, deliver accepted Free Exposure Briefs, and improve the site experience.
Who is responsible for your data
Privacy requests: Contact
Data collected
Through the Free Exposure Brief and contact forms we may receive company name, work email, submitted domain(s), optional extra domains, optional role and phone, and contact-form message content. If you book a meeting, HubSpot processes the scheduling details you provide. We also process consent state, locale preference, and — if you accept analytics — basic technical and aggregate usage information.
Why data is used
We use this information to verify Free Brief requests, prepare and deliver accepted Briefs, respond to enquiries, arrange scoping calls, manage potential and active client relationships, prevent abuse, maintain site security, and — only with analytics consent — measure anonymous funnel performance.
Free Brief request data
Submitted domains are used to verify the request and to prepare a passive, non-invasive Free Exposure Brief. Form submit does not start security tooling against your systems.
Legal bases
We process lead and enquiry data to take steps at your request and to pursue our legitimate interest in answering business enquiries and delivering the Free Brief. Analytics and optional HubSpot tracking run only where you have consented. Essential cookies support basic site function and your stored choices.
Service providers
Hosting and delivery use Cloudflare Pages and related Cloudflare services. Lead forms, CRM, and meetings use HubSpot. If you accept analytics, Google Analytics 4 (GA4) receives pseudonymous usage data — not your email, phone, or company name from our forms. We do not invent additional processors beyond what this site actually uses.
International transfers
Some providers may process data outside your country. Where transfers occur, we rely on the safeguards those providers offer and limit what we send to what each purpose requires. This notice does not make unsupported legal guarantees about every transfer path.
Retention
Lead and Brief enquiry records are kept as long as needed to handle the request, follow up, and meet ordinary business or legal needs. Exact calendar retention periods for each record type are tracked internally pending counsel approval and are not stated as fixed public durations here. Analytics retention follows the provider settings we configure. The consent cookie remains until it expires or you change your choice.
Your rights
Depending on applicable law, you may request access, correction, or deletion of your personal data, and object to certain processing. You can also withdraw analytics consent at any time via Cookie settings. Privacy requests: hello@truehat.net.
Complaints
If you believe we have mishandled your data, you may contact us first. You also have the right to lodge a complaint with the supervisory authority competent for your situation — for example an EU/EEA data protection authority where GDPR applies, or Tunisia’s INPDP where Tunisian law applies.
Website analytics
If you accept analytics, we load Google Analytics 4 to measure visits, devices, approximate location, pages viewed, and Brief funnel steps. We do not send your email, phone, or company name to Google Analytics. Choose Essential only to skip analytics.
HubSpot (leads & meetings)
Free Exposure Brief, enrichment, contact forms, and optional meeting booking submit to HubSpot so we can reply and schedule. After you accept analytics, we may also load HubSpot’s tracking script so later page views can attach to your contact record after a form submit.
Cookies & choices
We store your analytics choice and language preference in small first-party cookies (truehat_consent and truehat_locale). Analytics and HubSpot tracking scripts load only if you accept analytics. Full details are on the Cookie Policy page. Cookies
Contact
Privacy requests: hello@truehat.net