Privacy policy
Last updated: October 7, 2026
Who we are
Shadow Perimeter is run by Edgar Gutierrez from Downey, California, USA. We produce external attack-surface reports for small businesses. Privacy contact: ceo@shadowperimeter.com.
What we collect
- Contact form: your name, business email and the domain you ask us to review.
- Information about your domain: public technical information we collect to build your snapshot or report (for example DNS records, certificate transparency data, publicly visible web configuration). This is information about a domain, not about people, but it can be commercially sensitive, so we treat it as confidential.
- Email and call content: what you write to us and what you discuss on review calls.
- Payment information: payments are processed by Stripe. We never see or store your card number; we receive confirmation of payment and billing details.
- Site technical data: our web server records standard access logs (IP address, browser, pages requested) for security and operations. We use no advertising or tracking cookies.
How we use it
To deliver the snapshot or report you requested, answer you, run the services you buy, send invoices, protect the site, comply with the law and improve our reports. We do not sell your data, do not share it for advertising, and do not publish your findings or name you as a client without your written permission.
Who we share it with
Only service providers that help us run the business, on our behalf, and only as needed:
- Formspree and Google (Gmail / Workspace): receive the contact form and our email.
- Stripe: payment processing.
- Cloudflare and our hosting provider: hosting and delivery of this site.
- We may also disclose information if the law requires it, to protect rights or safety, or in a sale or reorganization of the business.
How long we keep it
- Reports and findings: up to 24 months after delivery or the end of the service, then deleted.
- Contact form submissions and emails: while the business conversation lasts; you can ask us to delete them at any time.
- Billing records: as long as tax and accounting law requires.
- Server logs: for a limited period, then rotated out.
Your rights
You can ask us what information we hold about you, get a copy, correct it, delete it, or limit its use. Write to ceo@shadowperimeter.com. We may ask you to confirm your identity (for example by writing from the same business email). An authorized agent may act for you with your written permission. We answer within a reasonable time and at most 45 days, and we will not treat you worse for using your rights. If you are a California resident these are also your rights under CCPA/CPRA. We do not sell or share personal information, and we do not track you across sites, so there is nothing to opt out of; we honor Do Not Track and Global Privacy Control signals because we do not track.
Business outreach emails
If we email a business address, we identify ourselves, use an honest subject line and give you a clear way to ask us to stop, which we honor within 10 business days. Our unsolicited outreach, if any, relies only on public information about a domain (for example, a missing email-authentication record); it never involves accessing any system. We comply with CAN-SPAM and, for Canada, CASL.
Security
We use encrypted connections, restricted access and retention limits, and we handle reports as confidential. No system is 100% secure. If an incident affecting your information occurs, we will notify you as the law requires.
Other details
Your information is processed in the United States. Our services are for businesses and are not directed to anyone under 18. This site may link to third-party pages that have their own policies. We may update this policy; the new version will be published here with its date.