Legal

Privacy Policy

This Privacy Policy explains how ColorShield ID LLC (“ColorShield”, “we”, “us”, or “our”) processes information in connection with ColorShield ID services.

Last updated: October 8, 2026

1. Scope

This Privacy Policy covers information processed in connection with:

  • the public ColorShield ID website;
  • Contact submissions;
  • Request Protected Access submissions;
  • customer account / Customer Platform information;
  • security telemetry associated with protected deployments; and
  • commercial and support communications related to ColorShield ID.

This policy does not claim to cover unrelated third-party websites, products or services that are not operated by ColorShield ID LLC.

2. Information provided by users

ColorShield may process information that you or your organization submit voluntarily, including:

  • full name;
  • business email;
  • role / position;
  • company;
  • country;
  • website / protected domain;
  • industry;
  • requested protection type;
  • selected plan / service;
  • estimated protected interaction volume;
  • deployment environment;
  • inquiry type;
  • additional context / message;
  • authorization and confidentiality acknowledgments; and
  • support communications.

Do not submit secrets through public website forms. Do not include passwords, card numbers, banking credentials, API keys, private keys, authentication tokens or other secrets in Contact, Request Protected Access or similar public messages.

3. Security telemetry

Protected deployments may generate security and operational telemetry necessary for Form Identity Protection and service operation. Depending on the protected flow, configuration and event type, examples may include:

  • timestamp;
  • tenant / installation / protected flow identifier;
  • domain / hostname;
  • path;
  • form context;
  • source IP address;
  • pseudonymous or session identifier;
  • browser / User-Agent signals;
  • request patterns;
  • runtime proof outcome;
  • pre-submit authorization decision;
  • PERMIT / WARN / BLOCK outcome;
  • first / last seen information;
  • security event counters; and
  • operational logs.

Depending on context and applicable law, some telemetry may constitute personal data. ColorShield does not describe this telemetry as zero-telemetry, fully anonymous or free of personal data in all cases.

4. Business-form payload separation

ColorShield ID does not require the customer’s business-form payload merely to validate form authenticity. Examples of business-form values that are not required for Form Identity validation include passwords, card numbers, IBAN values and other customer form-field contents.

ColorShield validates the form and authorized interaction context. The customer’s business-form processing remains separate.

This section describes the product design for Form Identity validation. It is not an absolute statement that ColorShield can never process any personal data under any circumstance.

5. How information is used

We use information for product and business purposes such as:

  • responding to inquiries;
  • evaluating Protected Access requests;
  • onboarding approved customers;
  • providing and operating ColorShield services;
  • validating protected flows and authorized context;
  • issuing and verifying runtime proof;
  • evaluating pre-submit authorization;
  • recording security outcomes;
  • operating customer dashboards;
  • licensing and account administration;
  • fraud, abuse and security prevention;
  • support;
  • service improvement; and
  • legal and compliance obligations.

We do not use public website inquiry forms as advertising surveillance tooling.

6. Control Tower and Customer Platform

Control Tower is the ColorShield security authority for protected interactions. It evaluates authorized context, runtime proof and pre-submit authorization decisions associated with protected deployments.

Customer Platform data may include account information, authorized domains, Protected Flow configuration, license information, protection activity, security reports, support interactions and account-security information.

This policy does not describe internal operator consoles beyond the customer-facing ColorShield services.

7. Data minimization

ColorShield is designed to minimize data required for Form Identity Protection. We design ColorShield ID to limit collection and processing to information reasonably necessary for security, operation, support, commercial onboarding and legal obligations.

8. Retention

Retention depends on the type of information, the applicable plan or deployment and operational or legal needs.

  • Security-event retention depends on plan / deployment. Current commercial plans may provide 30-day, 90-day or custom event retention.
  • Account, commercial, support and legal records may be retained as reasonably necessary for operational, contractual, security or legal purposes.

ColorShield does not claim that all data is always deleted immediately after a plan’s security-event retention window.

9. Service providers

ColorShield may use service providers for functions such as infrastructure / hosting, email, security, payment / billing and business operations. Those providers process information only as needed to perform services for ColorShield, subject to applicable agreements and legal requirements.

ColorShield ID does not sell personal data to advertisers. This policy does not claim that ColorShield has no subprocessors.

10. Security

ColorShield uses technical and organizational measures designed to protect information. No system can guarantee absolute security. If you believe you have discovered a security issue related to ColorShield ID, contact us through the public Contact page using an appropriate inquiry type.

11. International processing

ColorShield ID LLC is a U.S. company. Information may be processed in the United States or other locations where service providers operate, subject to applicable legal requirements.

12. Privacy rights

Depending on location and applicable law, individuals may have rights to:

  • request access;
  • request correction;
  • request deletion;
  • object to or restrict certain processing;
  • request portability where applicable; and
  • withdraw consent where processing relies on consent.

Rights vary by jurisdiction and are subject to applicable law. ColorShield may need to verify a request and may decline or limit a request where legally permitted.

13. Children

ColorShield ID is a B2B cybersecurity service and is not directed to children.

14. Cookies and browser storage

Browser storage and cookies may be used where necessary for application functionality, security, authentication or preferences. Specific use depends on the applicable ColorShield service.

This policy does not invent advertising analytics, advertising cookies or tracking systems that are not part of the current public website implementation.

15. Contact for privacy requests

Privacy or data-protection inquiries should be submitted through the public Contact page:

Contact ColorShield ID

Select Inquiry Type General Inquiry or Security Inquiry, as appropriate, and describe your privacy request in the message. ColorShield ID LLC will review the request through its commercial and support processes.

16. Changes to this policy

We may update this Privacy Policy as the product, legal requirements or processing practices change. The “Last updated” date at the top of this page will be revised when changes are published.

Privacy or data-protection inquiry?

Use the public Contact form. Select General Inquiry or Security Inquiry as appropriate.

Contact Terms of Service Request Protected Access