DRAFT FOR ATTORNEY REVIEW. Shuriken Cyber prepared this draft from what the website actually collects as of October 18, 2026. It is not legal advice. Fill in every [bracketed placeholder] and have counsel review the notice before publishing it at https://shurikencyber.com/privacy/.
Privacy Notice
Shuriken Cyber LLC · Effective [DATE]
We advise CISOs and boards on risk. This notice covers the personal data that shurikencyber.com collects: what we collect, why, how long we keep it, and who handles it. We collect as little as we can.
Who we are
Shuriken Cyber LLC is a Minnesota limited liability company providing cybersecurity advisory services, based in Chaska, Minnesota. We are the controller of the personal data described here. Contact: info@shurikencyber.com · +1-952-250-3388 · [MAILING ADDRESS]
What we collect
1. Briefing requests. When you use "Request a principal briefing" we collect your name, work email, and organization (required), plus your title, primary focus, and the decision in front of you (optional). Please don't put confidential or regulated information in the message field. We'll arrange a secure channel for that.
2. Quantum Readiness Pulse. The Pulse is scored entirely in your browser. Your answers aren't sent to us, stored by us, or tracked. Only if you choose "Send my results to a principal", tick the consent box, and press Send do we receive: - your five answers, your score, and its band - your email (required), plus any name, role, and company you choose to add - the time you consented and the page address
3. Email and phone. If you email or call us, we receive whatever you send, including your contact details and message.
4. Technical data. Our hosting and security providers automatically process standard request data to deliver and protect the site: IP address, browser and device type, pages requested, referring page, and timestamps. Security services may set a strictly necessary cookie to tell people from bots. [Confirm against the production host. On the preview host this is Cloudflare's __cf_bm cookie, which expires after 30 minutes.]
5. Cookies and analytics. We don't use advertising cookies, cross-site tracking, or session recording. [Today: no analytics. If you add privacy-friendly analytics, name the provider here.] Web fonts are self-hosted on our own domain, so loading a page makes no request to a third-party font service.
Why we use it
- To answer your briefing request or Pulse results and arrange a conversation (your request, or steps toward a contract you've asked about)
- To run, secure, and troubleshoot the site and prevent spam and abuse (our legitimate interest in a secure service)
- To keep records needed for legal, tax, or contractual obligations
We don't use your data for automated decisions about you or for profiling, and we don't add you to marketing lists. If we ever offer a newsletter, it will be opt-in.
Consent
Sending your Pulse results is optional and based on your consent. To withdraw it, email info@shurikencyber.com and we'll delete those results.
How long we keep it
| Data | Retention |
|---|---|
| Briefing requests and Pulse results that don't become engagements | [12 months] after our last contact, then deleted |
| Correspondence with clients | For the engagement plus [7 years], for contract and tax records |
| Hosting and security logs | [30–90 days], per provider defaults |
| Copies held by the form provider | Deleted from [FORM_PROVIDER] within [30 days] once delivered to our inbox |
Who we share it with
Only service providers who process it for us under contract, and only as needed: - Website hosting and delivery: [HOSTING_PROVIDER] - Form delivery: [FORM_PROVIDER, e.g. Formspree or Basin] - Email: Microsoft 365 (Microsoft Corporation) - Spam protection: [SPAM_PROVIDER, if any]
We may also disclose data when the law requires it, or to protect our rights or someone's safety. If our business is ever transferred, data moves with it under this notice.
We don't sell personal data. We don't share it for targeted (cross-context behavioral) advertising. We don't knowingly collect sensitive data through this site.
Security
We protect what we collect the way we'd advise you to: encryption in transit (HTTPS/TLS), access limited to principals, multi-factor authentication on our accounts, and providers chosen for their security posture. No system is perfectly secure. If a breach affects your data, we'll notify you as the law requires.
Your choices and rights
Wherever you live, you can ask us to: - confirm whether we hold your personal data and give you a copy - correct it - delete it - stop using it for any purpose you object to
Minnesota residents. The Minnesota Consumer Data Privacy Act (Minn. Stat. §§ 325M.10–.21, effective July 31, 2025) gives residents rights to access, correct, delete, and port their data, to opt out of sale, targeted advertising, and certain profiling, to question the result of a profiling decision, and to get a list of the specific third parties that received their data. It applies to businesses that process the data of 100,000 or more Minnesota consumers a year, or of 25,000 or more while earning over 25% of revenue from selling data. It largely exempts small businesses as defined by the U.S. SBA, which must still never sell sensitive data without consent. [Counsel to confirm whether the Act applies to Shuriken Cyber; at our size it likely does not.] Either way, we'll honor the requests above.
How to make a request: email info@shurikencyber.com with the subject "Privacy request." We may need to verify your identity. We'll reply within 45 days and won't treat you differently for asking. If we decline a request, we'll explain why and how to appeal. Minnesota residents can also contact the Minnesota Attorney General's Office.
Children
This site is for business professionals. It isn't directed to children under 16, and we don't knowingly collect their data. If you think we have, contact us and we'll delete it.
Visitors outside the United States
We're based in the United States, and our providers may process data in the U.S. or elsewhere. By contacting us from another country, you understand your data will be handled in the U.S. under this notice. [If you serve EU/UK clients, counsel to add GDPR/UK GDPR language: legal bases, transfer mechanisms, and the right to complain to a supervisory authority.]
Changes
If we change this notice, we'll post the new version here with a new effective date. If a change is material, we'll make it prominent on this page before it takes effect.
Contact
Shuriken Cyber LLC · [MAILING ADDRESS], Chaska, MN · info@shurikencyber.com · +1-952-250-3388