Privacy Policy

Last Updated: March 2026

Effective Date: March 5, 2026

Bellator Cyber Guard, LLC ("Bellator," "we," "us," or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you visit our website at bellatorcyber.com (the "Site"), use our services, or otherwise interact with us.

As a cybersecurity company, we hold ourselves to the highest standards of data protection. We practice what we preach.

1. Information We Collect

1.1 Information You Provide Directly

We collect information you voluntarily provide when you:

• Submit forms: Contact forms, consultation requests, download forms (e.g., WISP templates, HIPAA guides, white papers), and newsletter sign-ups. This includes your name, email address, phone number, company name, job title, and any additional information you choose to provide.
• Create an account: Email address and password for user accounts on our platform.
• Purchase products or services: Payment information (processed by Stripe; we never store full payment card numbers), billing address, and purchase history.
• Schedule appointments: When you book consultations through Calendly, we receive your name, email, phone number, and scheduling preferences.
• Apply to our affiliate program: Business name, contact information, tax ID (for commission payments), and website URL.
• Communicate with us: Content of emails, phone calls, chat messages, and support tickets.

1.2 Information Collected Automatically

When you visit our Site, we automatically collect certain information through cookies, pixels, and similar technologies:

• Device information: IP address, browser type and version, operating system, device type, screen resolution, and language preferences.
• Usage data: Pages visited, time spent on pages, click patterns, scroll depth, referring URLs, exit pages, and navigation paths.
• Location data: Approximate geographic location derived from your IP address (city/region level only; we do not collect precise geolocation).
• Session recordings: We use Microsoft Clarity to record anonymized user sessions, including mouse movements, clicks, and scrolling behavior. These recordings help us understand how visitors interact with our Site and identify usability improvements. Clarity automatically masks sensitive input fields (passwords, payment data) and does not capture keystrokes in form fields.

1.3 Information from Third-Party Sources

We may receive information about you from:

• Google OAuth: If you sign in with Google, we receive your name, email address, and profile picture.
• Advertising platforms: Conversion data from Google Ads and Meta (Facebook/Instagram) Ads to measure campaign effectiveness.
• CRM and sales tools: Salesforce may supplement submitted lead information with publicly available business data.

2. How We Use Your Information

We use collected information for the following purposes:

2.1 Service Delivery

• Providing cybersecurity consulting, compliance documentation, managed security services, and educational resources
• Processing purchases and delivering digital products (WISP templates, compliance guides, white papers)
• Scheduling and conducting consultations
• Responding to inquiries and support requests
• Managing user accounts and affiliate relationships

2.2 Communications

• Sending transactional emails (order confirmations, download links, appointment reminders)
• Sending marketing communications, newsletters, and promotional content (only with your consent; you may opt out at any time)
• Providing technical notices, security alerts, and service updates
• Email marketing is managed through Klaviyo. You may unsubscribe from marketing emails at any time using the link in any email or by contacting us.

2.3 Analytics and Improvement

• Analyzing usage patterns to improve Site functionality and content
• Measuring advertising effectiveness and optimizing campaigns
• Conducting A/B testing and usability research
• Identifying and fixing technical issues

2.4 Legal and Compliance

• Complying with applicable laws, regulations, and legal processes
• Enforcing our Terms of Service and other agreements
• Protecting against fraud, abuse, and security threats
• Establishing, exercising, or defending legal claims

3. Cookies and Tracking Technologies

We use Google Tag Manager (GTM) container GTM-N9NM7NS8 to manage the following tracking technologies:

3.1 Strictly Necessary

• Session cookies: Maintain your session state, authentication, and form progress
• Security cookies: CSRF protection and fraud prevention

3.2 Analytics

• Google Analytics 4 (GA4): Measures website traffic, user behavior, and conversion events. Data is processed by Google LLC. Google Privacy Policy
• Microsoft Clarity: Session recording and heatmaps for usability analysis. Clarity masks sensitive form inputs and does not capture passwords or payment data. Microsoft Privacy Statement

3.3 Marketing and Advertising

• Google Ads: Conversion tracking and remarketing. Measures which ads lead to form submissions, downloads, and consultations. Google Privacy Policy
• Meta Pixel (Facebook/Instagram): Conversion tracking for social media advertising campaigns. Meta Privacy Policy

3.4 Managing Your Preferences

You can control cookies through your browser settings. Most browsers allow you to block or delete cookies, though this may affect Site functionality. You can also opt out of specific tracking:

• Google Analytics: Install the Google Analytics Opt-Out Browser Add-on
• Google Ads: Manage preferences at Google Ad Settings
• Meta: Manage preferences in your Facebook Ad Settings
• General opt-out: Visit Digital Advertising Alliance or Network Advertising Initiative

4. Information Sharing and Disclosure

We do not sell your personal information. We share information only in the following circumstances:

4.1 Service Providers

We share information with third-party service providers who assist in operating our business, subject to contractual obligations to protect your data:

• Salesforce: Customer relationship management — stores lead and contact information
• Klaviyo: Email marketing platform — manages newsletter subscriptions and email campaigns
• Calendly: Appointment scheduling — processes scheduling data
• Stripe: Payment processing — handles payment transactions (PCI DSS Level 1 compliant)
• Google Cloud / Hosting: Infrastructure — hosts our application and database
• SMTP provider: Email delivery — transmits transactional and notification emails

4.2 Professional Advisors

Lawyers, accountants, auditors, and insurers who provide professional services to our business.

4.3 Legal Requirements

We may disclose information when required by law, regulation, legal process, or governmental request, including:

• Subpoenas, court orders, or other legal processes
• Requests from law enforcement or regulatory agencies
• Protection of our rights, property, or safety, or the rights, property, or safety of others
• Investigation of suspected fraud or violations of our Terms of Service

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change and any choices you may have regarding your information.

5. Data Security

As a cybersecurity company, we implement comprehensive security measures to protect your personal information, including:

• Encryption: All data transmitted to and from our Site is encrypted using TLS 1.2+ (HTTPS). Sensitive data at rest is encrypted using AES-256.
• Access controls: Role-based access controls, multi-factor authentication for administrative access, and principle of least privilege.
• Infrastructure security: Firewalls, intrusion detection systems, regular vulnerability scanning, and security monitoring.
• Secure development: Security-focused development practices, code review, and dependency management.
• Vendor security: We evaluate the security posture of all third-party service providers and require appropriate contractual protections.
• Incident response: We maintain a documented incident response plan and will notify affected individuals and authorities as required by law in the event of a data breach.

While we implement industry-leading security measures, no system is completely impervious to attack. We cannot guarantee the absolute security of your information but are committed to promptly addressing any security incidents.

6. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law:

• Account data: Retained for the duration of your account plus 30 days after deletion request
• Form submissions and lead data: Retained for 3 years from submission, or longer if an active client relationship exists
• Purchase records: Retained for 7 years for tax and accounting compliance
• Marketing preferences: Retained until you opt out; suppression records maintained indefinitely to honor opt-outs
• Analytics data: Aggregated and anonymized data may be retained indefinitely; identifiable analytics data is retained for 26 months (GA4 default)
• Session recordings (Clarity): Retained for 30 days

7. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

7.1 All Users

• Opt out of marketing: Unsubscribe from marketing emails using the link in any email, or contact us directly
• Cookie controls: Manage cookie preferences through your browser settings
• Do Not Track: We honor Do Not Track browser signals where technically feasible
• Access and correction: Request access to or correction of your personal information by contacting us

7.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected, the sources, the business purposes, and the categories of third parties with whom we share it
• Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt Out of Sale/Sharing: We do not sell personal information. We share information with advertising partners for cross-context behavioral advertising; you may opt out of this sharing
• Right to Limit Use of Sensitive Personal Information: We only use sensitive personal information for purposes permitted under the CCPA
• Non-discrimination: We will not discriminate against you for exercising your privacy rights

To exercise these rights, contact us at guard@bellatorit.com or call (800) 492-6076. We will verify your identity before processing requests. You may designate an authorized agent to submit requests on your behalf.

7.3 Virginia, Colorado, Connecticut, Utah, and Other State Residents

If you reside in a state with comprehensive privacy legislation (Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, or similar), you may have rights to access, correct, delete, and port your personal data, as well as opt out of targeted advertising, sale of personal data, and profiling. Contact us to exercise these rights.

7.4 European Economic Area (EEA) and UK Residents

If you are located in the EEA or UK, we process your personal data under the following legal bases: consent, contractual necessity, legitimate interests, and legal obligations. You have rights under the GDPR/UK GDPR to access, rectify, erase, restrict processing, data portability, and object to processing. You also have the right to lodge a complaint with your supervisory authority. Contact us at guard@bellatorit.com to exercise your rights.

8. Children's Privacy

Our Site and services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will take steps to delete that information promptly. If you believe we have collected information from a child under 16, please contact us immediately at guard@bellatorit.com.

9. Third-Party Links and Services

Our Site contains links to third-party websites, including but not limited to Calendly, social media platforms, and educational resources. This Privacy Policy does not apply to those third-party sites. We encourage you to review the privacy policies of any third-party sites you visit. We are not responsible for the privacy practices or content of third-party websites.

10. Do Not Track Signals

Some browsers transmit "Do Not Track" (DNT) signals. We honor DNT signals where technically feasible by limiting non-essential tracking when a DNT signal is detected.

11. International Data Transfers

Our servers and service providers are located in the United States. If you access our Site from outside the United States, your information will be transferred to, stored, and processed in the United States. By using our Site, you consent to the transfer of your information to the United States, which may have different data protection laws than your country of residence.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Post the revised Privacy Policy on our Site
• For significant changes, provide notice through email or a prominent notice on our Site

Your continued use of the Site after any changes constitutes acceptance of the updated Privacy Policy.

13. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about our data practices, please contact us:

Bellator Cyber Guard, LLC
Email: guard@bellatorit.com
Phone: (800) 492-6076
Website: bellatorcyber.com/contact

We will respond to privacy-related inquiries within 30 days (or sooner as required by applicable law).