Privacy Policy | Bellator Cyber Guard

Last Updated: March 2026

Effective Date: March 5, 2026

Bellator Cyber Guard, LLC ("Bellator," "we," "us," or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you visit our website at bellatorcyber.com (the "Site"), use our services, or otherwise interact with us.

As a cybersecurity company, we hold ourselves to the highest standards of data protection. We practice what we preach.

1. Information We Collect

1.1 Information You Provide Directly

We collect information you voluntarily provide when you:

Submit forms: Contact forms, consultation requests, download forms (e.g., WISP templates, HIPAA guides, white papers), and newsletter sign-ups. This includes your name, email address, phone number, company name, job title, and any additional information you choose to provide.
Create an account: Email address and password for user accounts on our platform.
Purchase products or services: Payment information (processed by Stripe; we never store full payment card numbers), billing address, and purchase history.
Schedule appointments: When you book consultations through Calendly, we receive your name, email, phone number, and scheduling preferences.
Apply to our affiliate program: Business name, contact information, tax ID (for commission payments), and website URL.
Communicate with us: Content of emails, phone calls, chat messages, and support tickets.

1.2 Information Collected Automatically

When you visit our Site, we automatically collect certain information through cookies, pixels, and similar technologies:

Device information: IP address, browser type and version, operating system, device type, screen resolution, and language preferences.
Usage data: Pages visited, time spent on pages, click patterns, scroll depth, referring URLs, exit pages, and navigation paths.
Location data: Approximate geographic location derived from your IP address (city/region level only; we do not collect precise geolocation).
Session recordings: We use Microsoft Clarity to record anonymized user sessions, including mouse movements, clicks, and scrolling behavior. These recordings help us understand how visitors interact with our Site and identify usability improvements. Clarity automatically masks sensitive input fields (passwords, payment data) and does not capture keystrokes in form fields.

1.3 Information from Third-Party Sources

We may receive information about you from:

Google OAuth: If you sign in with Google, we receive your name, email address, and profile picture.
Advertising platforms: Conversion data from Google Ads and Meta (Facebook/Instagram) Ads to measure campaign effectiveness.
CRM and sales tools: Salesforce may supplement submitted lead information with publicly available business data.

2. How We Use Your Information

We use collected information for the following purposes:

2.1 Service Delivery

Providing cybersecurity consulting, compliance documentation, managed security services, and educational resources
Processing purchases and delivering digital products (WISP templates, compliance guides, white papers)
Scheduling and conducting consultations
Responding to inquiries and support requests
Managing user accounts and affiliate relationships

2.2 Communications

Sending transactional emails (order confirmations, download links, appointment reminders)
Sending marketing communications, newsletters, and promotional content (only with your consent; you may opt out at any time)
Providing technical notices, security alerts, and service updates
Email marketing is managed through Klaviyo. You may unsubscribe from marketing emails at any time using the link in any email or by contacting us.

2.3 Analytics and Improvement

Analyzing usage patterns to improve Site functionality and content
Measuring advertising effectiveness and optimizing campaigns
Conducting A/B testing and usability research
Identifying and fixing technical issues

2.4 Legal and Compliance

Complying with applicable laws, regulations, and legal processes
Enforcing our Terms of Service and other agreements
Protecting against fraud, abuse, and security threats
Establishing, exercising, or defending legal claims

3. Cookies and Tracking Technologies

We use Google Tag Manager (GTM) container GTM-N9NM7NS8 to manage the following tracking technologies:

3.1 Strictly Necessary

Session cookies: Maintain your session state, authentication, and form progress
Security cookies: CSRF protection and fraud prevention

3.2 Analytics

Google Analytics 4 (GA4): Measures website traffic, user behavior, and conversion events. Data is processed by Google LLC. Google Privacy Policy
Microsoft Clarity: Session recording and heatmaps for usability analysis. Clarity masks sensitive form inputs and does not capture passwords or payment data. Microsoft Privacy Statement

3.3 Marketing and Advertising

Google Ads: Conversion tracking and remarketing. Measures which ads lead to form submissions, downloads, and consultations. Google Privacy Policy
Meta Pixel (Facebook/Instagram): Conversion tracking for social media advertising campaigns. Meta Privacy Policy

3.4 Managing Your Preferences

You can control cookies through your browser settings. Most browsers allow you to block or delete cookies, though this may affect Site functionality. You can also opt out of specific tracking:

Google Analytics: Install the Google Analytics Opt-Out Browser Add-on
Google Ads: Manage preferences at Google Ad Settings
Meta: Manage preferences in your Facebook Ad Settings
General opt-out: Visit Digital Advertising Alliance or Network Advertising Initiative

4. Information Sharing and Disclosure

We do not sell your personal information. We share information only in the following circumstances:

4.1 Service Providers

We share information with third-party service providers who assist in operating our business, subject to contractual obligations to protect your data:

Salesforce: Customer relationship management — stores lead and contact information
Klaviyo: Email marketing platform — manages newsletter subscriptions and email campaigns
Calendly: Appointment scheduling — processes scheduling data
Stripe: Payment processing — handles payment transactions (PCI DSS Level 1 compliant)
Google Cloud / Hosting: Infrastructure — hosts our application and database
SMTP provider: Email delivery — transmits transactional and notification emails

4.2 Professional Advisors

Lawyers, accountants, auditors, and insurers who provide professional services to our business.

4.3 Legal Requirements

We may disclose information when required by law, regulation, legal process, or governmental request, including:

Subpoenas, court orders, or other legal processes
Requests from law enforcement or regulatory agencies
Protection of our rights, property, or safety, or the rights, property, or safety of others
Investigation of suspected fraud or violations of our Terms of Service

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change and any choices you may have regarding your information.

5. Data Security

As a cybersecurity company, we implement comprehensive security measures to protect your personal information, including:

Encryption: All data transmitted to and from our Site is encrypted using TLS 1.2+ (HTTPS). Sensitive data at rest is encrypted using AES-256.
Access controls: Role-based access controls, multi-factor authentication for administrative access, and principle of least privilege.
Infrastructure security: Firewalls, intrusion detection systems, regular vulnerability scanning, and security monitoring.
Secure development: Security-focused development practices, code review, and dependency management.
Vendor security: We evaluate the security posture of all third-party service providers and require appropriate contractual protections.
Incident response: We maintain a documented incident response plan and will notify affected individuals and authorities as required by law in the event of a data breach.

While we implement industry-leading security measures, no system is completely impervious to attack. We cannot guarantee the absolute security of your information but are committed to promptly addressing any security incidents.

6. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law:

Account data: Retained for the duration of your account plus 30 days after deletion request
Form submissions and lead data: Retained for 3 years from submission, or longer if an active client relationship exists
Purchase records: Retained for 7 years for tax and accounting compliance
Marketing preferences: Retained until you opt out; suppression records maintained indefinitely to honor opt-outs
Analytics data: Aggregated and anonymized data may be retained indefinitely; identifiable analytics data is retained for 26 months (GA4 default)
Session recordings (Clarity): Retained for 30 days

7. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

7.1 All Users

Opt out of marketing: Unsubscribe from marketing emails using the link in any email, or contact us directly
Cookie controls: Manage cookie preferences through your browser settings
Do Not Track: We honor Do Not Track browser signals where technically feasible
Access and correction: Request access to or correction of your personal information by contacting us

7.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected, the sources, the business purposes, and the categories of third parties with whom we share it
Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions
Right to Correct: Request correction of inaccurate personal information
Right to Opt Out of Sale/Sharing: We do not sell personal information. We share information with advertising partners for cross-context behavioral advertising; you may opt out of this sharing
Right to Limit Use of Sensitive Personal Information: We only use sensitive personal information for purposes permitted under the CCPA
Non-discrimination: We will not discriminate against you for exercising your privacy rights

To exercise these rights, contact us at security@bellatorcyber.com or call (800) 492-6076. We will verify your identity before processing requests. You may designate an authorized agent to submit requests on your behalf.

7.3 Virginia, Colorado, Connecticut, Utah, and Other State Residents

If you reside in a state with comprehensive privacy legislation (Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, or similar), you may have rights to access, correct, delete, and port your personal data, as well as opt out of targeted advertising, sale of personal data, and profiling. Contact us to exercise these rights.

7.4 European Economic Area (EEA) and UK Residents

If you are located in the EEA or UK, we process your personal data under the following legal bases: consent, contractual necessity, legitimate interests, and legal obligations. You have rights under the GDPR/UK GDPR to access, rectify, erase, restrict processing, data portability, and object to processing. You also have the right to lodge a complaint with your supervisory authority. Contact us at security@bellatorcyber.com to exercise your rights.

8. Children's Privacy

Our Site and services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will take steps to delete that information promptly. If you believe we have collected information from a child under 16, please contact us immediately at security@bellatorcyber.com.

9. Third-Party Links and Services

Our Site contains links to third-party websites, including but not limited to Calendly, social media platforms, and educational resources. This Privacy Policy does not apply to those third-party sites. We encourage you to review the privacy policies of any third-party sites you visit. We are not responsible for the privacy practices or content of third-party websites.

10. Do Not Track Signals

Some browsers transmit "Do Not Track" (DNT) signals. We honor DNT signals where technically feasible by limiting non-essential tracking when a DNT signal is detected.

11. International Data Transfers

Our servers and service providers are located in the United States. If you access our Site from outside the United States, your information will be transferred to, stored, and processed in the United States. By using our Site, you consent to the transfer of your information to the United States, which may have different data protection laws than your country of residence.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

Update the "Last Updated" date at the top of this page
Post the revised Privacy Policy on our Site
For significant changes, provide notice through email or a prominent notice on our Site

Your continued use of the Site after any changes constitutes acceptance of the updated Privacy Policy.

13. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about our data practices, please contact us:

Bellator Cyber Guard, LLC
Email: security@bellatorcyber.com
Phone: (800) 492-6076
Website: bellatorcyber.com/contact

We will respond to privacy-related inquiries within 30 days (or sooner as required by applicable law).