PRIVACY POLICY
EFFECTIVE AUGUST 31, 2026
This policy covers this website only. It describes what Threshold Security Consulting collects here, why, who else sees it, and what you can do about it. Threshold Security Consulting is a sole proprietorship operating in California.
The short version. If you fill out the contact form, we get what you typed and we use it to answer you. If you accept cookies, Google gets analytics and advertising data. If you decline, or your browser sends a Global Privacy Control signal, no Google advertising or analytics tag loads at all. The site also runs a cookieless visitor count from Cloudflare that sets nothing on your device and cannot identify you, described in the Cookie Notice. We do not sell or rent anything you give us.
What we collect
Information you type into the contact form
- Your name and email address (required)
- Your organization (required)
- The property type, county, and grant deadline you select (property type, county and deadline required; property size optional)
- Your phone number (optional)
- Whatever you write in the message field (optional)
- Whether you checked the box consenting to text messages
- Whether you checked the box asking for the newsletter
We use this to respond to your inquiry, to schedule and carry out an assessment if you hire us, and to send the newsletter if you asked for it. Nothing else.
Submitting the form also sends an automatic confirmation to the email address you entered, telling you we received the request. It confirms receipt and nothing more.
Information collected automatically
- Server and security logs. Our host, Cloudflare, records IP address, browser and device type, referring page, and request timestamps. This is used to keep the site up and to block abuse.
- Bot protection. The contact form uses Cloudflare Turnstile, which evaluates browser signals to tell a person from a script. It runs whether or not you accept cookies, because the form does not work without it.
- Visitor counting, always on. The site uses Cloudflare Web Analytics, which counts page views. It sets no cookies, stores nothing on your device, and does not fingerprint your browser or follow you to other sites. Because it stores nothing, it runs whatever you choose about cookies.
- Advertising and analytics, only after you accept. If you click Accept on the cookie banner, Google Analytics and Google Ads load and may set cookies and collect device, browser, page-view, and ad-click information, including a Google click identifier if you arrived from one of our ads. If you decline, or never choose, these do not load.
Phone calls
If you call the number on this site, your carrier connects the call and we see your number the way any recipient does. We do not record calls.
Categories of personal information collected
| Category | Examples | Source |
|---|---|---|
| Identifiers | Name, email address, phone number, IP address | You, or automatically |
| Commercial information | The service you are asking about, property type, organization | You |
| Internet activity | Pages viewed, referring page, browser and device type, ad click identifiers | Automatically, advertising and analytics only with consent |
| Communications content | What you write in the message field | You |
We do not ask for and do not want government ID numbers, financial account numbers, health information, or detailed descriptions of your security vulnerabilities through this website. Please do not send them here.
Categories of third parties we share information with
- Cloudflare — website hosting, bot protection, and security logging.
- Resend — our email provider. It delivers your contact form submission to us and the confirmation back to you, and keeps a copy in its delivery logs for a limited period.
- Google (Gmail) — our business mailbox runs on Gmail, so every contact form submission is delivered into Gmail inboxes. This happens whatever you choose about cookies.
- Google Analytics and Google Ads — only if you accept cookies.
- Cloudflare Web Analytics — counts page views without cookies and without identifying you. Runs whatever you choose about cookies.
- Law enforcement or legal process — if we are legally required to produce something.
We do not sell your personal information, we do not rent it, and we do not trade it. We do not use what you send through this form for any purpose other than responding to you and doing the work you hire us for.
Do Not Track and Global Privacy Control
Do Not Track. Browsers can send a Do Not Track signal, but there is still no agreed standard for what a site should do about it, so this site does not respond to Do Not Track signals.
Global Privacy Control. This site does honor Global Privacy Control. If your browser or extension sends a GPC signal, we treat it as a standing decline: no advertising or analytics tags load, no advertising or analytics cookies are set, and the cookie banner does not appear.
Third-party tracking. If you accept cookies, Google may collect information about your browsing activity over time and across other websites. If you decline, it does not. The site's typefaces are served from our own domain rather than a font network, so no third party receives a request for them. Cloudflare's visitor count is not advertising or analytics in the tracking sense: it has no cookie and no identifier, so there is nothing to follow you with.
Your California rights
The California Consumer Privacy Act applies to businesses that clear at least one of three thresholds: more than $26,625,000 in annual gross revenue, buying, selling or sharing the personal information of 100,000 or more California residents or households, or deriving half or more of revenue from selling personal information. Threshold Security Consulting meets none of them and is not a covered "business" under the CCPA.
We will honor these requests anyway, because there is no reason not to. Email or call us and we will:
- tell you what we hold about you,
- correct it if it is wrong,
- delete it, unless we need it for a legal or tax obligation,
- and stop sending you anything.
We will not treat you differently for asking.
How to review or change your information
Contact us at the phone number or address at the bottom of this policy and tell us what you want changed or removed. We will confirm what we did. If you asked for the newsletter, every issue will carry an unsubscribe link, and it will work immediately.
How long we keep things
- Contact form submissions that do not become work: deleted after 12 months.
- Client records: kept as long as the engagement plus the period required for tax and business records.
- Newsletter subscriptions: until you unsubscribe.
- Server and security logs: kept per our host's standard retention, which is short.
Security
The site is served over HTTPS only. Form submissions are transmitted over TLS and delivered to our mailbox through our email provider, which necessarily handles the contents in transit. We do not store them in a form database and we use no third-party form service. Our email provider keeps a copy in its delivery logs for a limited period, as any email service does, and our mailbox is hosted on Gmail. No system is perfect and we do not claim otherwise.
Children
This site is for businesses and organizations. It is not directed to anyone under 16 and we do not knowingly collect information from anyone under 16.
Changes to this policy
If we make a material change, we will update the effective date at the top of this page and post a notice on the home page for at least 30 days. Continuing to use the site after a change means you accept the updated policy.
Contact
Threshold Security Consulting
Phone: (949) 414-5781
Email: [email protected]