Privacy Policy.

What this policy covers

This policy applies to the MALTO Cyber website at maltocyber.com (the “Site”), operated by MALTO Cyber from Toronto, Ontario, Canada. It explains how we handle personal information when you browse the Site, contact us, or join one of our waitlists.

It does not cover our products. Our compliance software (NISTForge and SOCLedger) runs on your own infrastructure or under separate product terms, and the data you process inside those products is governed by the agreement that comes with them, not by this policy. Paid consulting engagements are governed by the contract we sign with you. If you are not sure which document applies to a given interaction, ask us and we will point you to the right one.

Information we collect

Information you give us directly. When you use the Site, you may choose to share:

• Contact form: your name, email address, an optional company name, the type of inquiry, and whatever you write in the message field.
• Waitlists and newsletter: your email address, plus which list you joined (for example, the NISTForge or SOCLedger waitlist).
• Booking a call: if you book time with us, you do that through Calendly, and the details you enter there are handled under Calendly’s own privacy policy.

Information collected automatically. Like almost any website, ours records some technical information so it can run and stay secure:

• Server logs: our hosting provider records standard request data such as your IP address, browser type, the pages you request, and timestamps. This is used to operate the Site and to detect and prevent abuse.
• Software downloads: if you are an existing licensee downloading our software, our download endpoint records the license identifier, your IP address, and your browser’s user agent. Your IP address is also used, on a short-lived basis, to rate-limit requests and stop license sharing and automated probing.

We do not ask for, and the Site does not collect, sensitive personal information, payment card details, or government identifiers. Please do not include sensitive details in a contact-form message; if you need to share something confidential, ask us for a secure channel first.

How we use it

• To answer your message and follow up on your inquiry.
• To send you the launch and product updates you asked for when you joined a waitlist or the newsletter. Every one of those emails has an unsubscribe link.
• To operate, maintain, and secure the Site, and to investigate suspicious activity.
• To deliver software downloads to licensees and enforce reasonable usage limits.
• To meet our legal and record-keeping obligations.

Where the law requires a legal basis (for example, for visitors in the EU or UK), we rely on your consent for marketing emails, on our legitimate interest in running and securing the Site, and on the performance of a contract where you are downloading software you are licensed to use. You can withdraw consent for marketing at any time without affecting anything else.

Cookies and tracking

We have kept this deliberately boring. The Site uses no advertising cookies, no tracking pixels, and no cross-site profiling. We do not sell or rent your personal information to anyone, and we never have.

Our fonts are served from our own servers rather than loaded from a third party, so simply reading a page here does not quietly hand your IP address to an advertising network. To see which pages get read and roughly where visitors arrive from, we use Vercel Web Analytics, a privacy-first tool from our hosting provider. It sets no cookies, does not follow you across other sites, and does not build a profile of you. It counts visits in aggregate, and nothing it records identifies you personally.

The only cookies that may be set are the strictly necessary ones our hosting provider uses to keep the Site secure and running, plus any needed to remember a choice you actively make. If we ever add anything more revealing than the aggregate counting described above, we will update this policy first and, where the law requires it, ask for your consent.

Who we share it with

We share personal information only with the service providers that help us run the Site, and only so they can perform that service for us. Our current providers are:

• Vercel. Hosts the Site, processes server logs, and provides the cookieless, aggregate page analytics described above.
• Resend. Delivers our email and stores waitlist and newsletter contacts.
• Upstash. Provides the short-lived rate-limiting used by the download endpoint.
• Cloudflare. Stores and delivers the software files served to licensees.
• Calendly. Handles scheduling if you book a call with us.

We may also disclose information where we are legally required to, or where it is needed to protect our rights, our users, or the security of the Site. If our business is ever sold or reorganized, information may transfer to the new owner, who would remain bound by this policy or one at least as protective.

Where your data is processed

We are based in Canada, but several of the providers above are based in the United States and may process your information there. Canadian privacy law lets us use foreign service providers, but it does not let us hand off our responsibility for protecting your information, so we remain accountable for it wherever it is processed and we choose providers that offer comparable protection.

If you are in Quebec, the European Union, or the United Kingdom, your information may be transferred outside your jurisdiction in the course of providing the services above. Where the law requires it, we rely on recognized safeguards for those transfers. You can ask us for more detail using the contact below.

How long we keep it

• Contact inquiries: for as long as we need to handle your request and keep reasonable business records, after which we delete or anonymize them.
• Waitlist and newsletter: until you unsubscribe or ask us to remove you.
• Server and download logs: for a short period for security and troubleshooting, then they age out.

Your rights

Depending on where you live, you have some or all of the following rights over your personal information: to access it, to correct it, to ask us to delete it, to withdraw consent, and to opt out of marketing. For marketing email, the fastest route is the unsubscribe link in any message. For everything else, email us and we will respond within the time the law allows.

• Canada (PIPEDA): you may request access to and correction of your information.
• Quebec (Law 25): you have additional rights, including data portability, and you can reach our Privacy Officer using the contact below.
• EU and UK (GDPR): you have rights of access, rectification, erasure, restriction, portability, and objection, and you may complain to your local supervisory authority.
• California (CCPA/CPRA): you may request access and deletion. We do not sell or share personal information as those terms are defined under California law.

Security

We take reasonable technical and organizational measures to protect the limited information we collect, and we keep what we collect small on purpose, because the data you never gather is the data you can never lose. That said, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we ever experience a breach affecting your information, we will notify you and the relevant regulators as required by law.

Children

The Site is meant for businesses and the professionals who run them. It is not directed to children, and we do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with information, contact us and we will delete it.

Contact and Privacy Officer

To exercise any of the rights above, or to ask a question about this policy, contact our Privacy Officer:

• Email: privacy@maltocyber.com
• MALTO Cyber, Toronto, Ontario, Canada

Changes to this policy

We may update this policy as our Site or the law changes. When we do, we will revise the “Last updated” date at the top, and for significant changes we will give clearer notice. Continuing to use the Site after an update means you accept the revised policy.

Looking for our website terms? See the Terms of Use.