Privacy Policy
Bridgham Cyber, LLC ("Bridgham," "we," "us," or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy describes how we collect, use, disclose, and protect information when you use our Services, Platform, and website.
Bridgham Cyber, LLC is a North Carolina limited liability company based in Raleigh, North Carolina.
1. Information We Collect
1.1 Information You Provide
- Account Information: Name, email address, phone number, company name, job title, and billing information when you register for an account or engage our Services.
- Engagement Information: Business and technical information you provide during the course of a Tailored Research engagement or Protection Partnership, including but not limited to network configurations, security policies, vendor information, and organizational data.
- Communications: Information contained in emails, support requests, feedback, and other communications with Bridgham.
- Payment Information: Credit card numbers, bank account details, and billing addresses processed through Stripe, Inc. Bridgham does not directly store full payment card numbers.
1.2 Information Collected Automatically
- Usage Data: Information about how you interact with the Platform, including pages visited, features used, timestamps, and session duration.
- Device Information: IP address, browser type, operating system, device identifiers, and screen resolution.
- Cookies and Similar Technologies: We use cookies, web beacons, and similar technologies to collect usage information and improve your experience. See Section 7 for our Cookie Policy.
- Log Data: Server logs that record requests made to our Platform, including IP addresses, timestamps, and referring URLs.
1.3 Information From Third Parties
- Business Partners: We may receive information from business partners, referral sources, or publicly available databases to support our service delivery.
- Security Data Sources: In the course of providing Services, we may collect information from threat intelligence feeds, public vulnerability databases, and other security data sources relevant to your engagement.
2. How We Use Your Information
2.1 We use the information we collect to:
- Provide, maintain, and improve our Services and Platform;
- Deliver the Program's advisory services;
- Process payments and manage billing;
- Communicate with you regarding your engagement, account, and support inquiries;
- Send security alerts, threat intelligence updates, and advisory notifications;
- Conduct security assessments, risk analyses, and compliance evaluations as part of our Services;
- Develop and improve our AI-powered features, including the AI Security Advisor, subject to Section 5;
- Comply with legal obligations and respond to lawful requests;
- Detect, prevent, and address fraud, security incidents, and technical issues; and
- Enforce our Terms of Service and applicable Service Agreements.
3. How We Share Your Information
3.1 We do not sell your personal information. We may share your information in the following circumstances:
- Service Providers: With third-party vendors who assist in providing our Services, including cloud hosting providers, payment processors, email service providers, analytics tools, and AI service providers, subject to contractual obligations to protect your information.
- Legal Compliance: When required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
- Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of the transaction, subject to applicable privacy obligations.
- With Your Consent: When you have provided explicit consent for a specific disclosure.
- Aggregated or De-Identified Data: We may share aggregated or de-identified data that cannot reasonably be used to identify you, for research, industry benchmarking, or product improvement purposes.
4. Data Retention
4.1 We retain your information for as long as necessary to fulfill the purposes described in this Privacy Policy, subject to the following:
- Account Information: Retained for the duration of client engagement and for a period of three (3) years following termination, unless a longer period is required by law.
- Engagement Data: Retained for the duration of client engagement and for a period of five (5) years following the conclusion of the engagement, to support ongoing advisory obligations and legal compliance.
- Payment Records: Retained for a period of seven (7) years following the transaction, consistent with tax and financial record-keeping requirements.
- Usage and Log Data: Retained for up to two (2) years following collection, unless required for security investigation or legal purposes.
- Communications: Retained for the duration of client engagement and for a period of three (3) years following the last communication.
- AI Training Data: De-identified data used for AI training may be retained indefinitely. See Section 5 for details on de-identification.
4.2 Upon expiration of the applicable retention period, we will securely delete or de-identify your information in accordance with industry-standard practices.
5. AI Training and De-Identification
5.1 AI Training
Bridgham may use de-identified client data to train, improve, and develop its AI-powered features, including the AI Security Advisor. Data used for AI training is de-identified in accordance with the standards described in Section 5.3 before being incorporated into training datasets.
Bridgham's AI features are powered by third-party AI model providers, currently Anthropic (large language models), which process de-identified query context under data-processing agreements.
5.2 AI Training Opt-Out
(a) Service Agreement Clients: If you have a signed Service Agreement with Bridgham, the AI Training opt-out provisions of that Agreement govern your rights regarding the use of your data for AI training.
(b) Other Users: You may opt out of AI training by emailing support@bridghamcyber.com. Upon receipt, we will exclude your data from future AI training activities within thirty (30) days. Opting out does not affect models already trained prior to your opt-out request.
5.3 De-Identification Standards
Bridgham de-identifies client data used for AI training in accordance with industry-standard practices consistent with Federal Trade Commission guidance on de-identification, including removal of direct identifiers, suppression of quasi-identifiers, and reasonable measures to prevent re-identification.
5.4 No Re-Identification
Bridgham will not attempt to re-identify de-identified data except for the purpose of testing and validating the effectiveness of our de-identification processes.
5A. How We Use Your Data and AI
Your data stays yours. We use it to run your service and to train a private advisor for your firm; that advisor is ours, and your access ends when you leave. We also keep de-identified, pooled insights that help protect every client and cannot be traced back to you. We never share your data with another client. You can export your reports during the engagement, ask us to delete your identifiable data on request, and opt out of de-identified use in your first 30 days. For the full picture, see our AI transparency page.
6. Data Security
6.1 Bridgham implements administrative, technical, and physical safeguards designed to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include, but are not limited to:
- Encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256);
- Access controls and role-based permissions;
- Regular security assessments and vulnerability testing;
- Employee security awareness training;
- Incident response procedures; and
- Secure data disposal practices.
6.2 While we take reasonable measures to protect your information, no method of transmission or storage is completely secure. We cannot guarantee absolute security.
7. Cookies and Tracking Technologies
7.1 We use the following types of cookies and similar technologies:
- Essential Cookies: Required for Platform functionality, authentication, and security.
- Analytics Cookies: Used to understand how visitors interact with our website and Platform, including PostHog.
- Functional Cookies: Used to remember your preferences and settings.
7.2 You may manage cookie preferences through your browser settings. Disabling certain cookies may limit Platform functionality.
7.3 We do not use cookies for third-party advertising purposes.
8. Your Rights and Choices
8.1 Depending on your jurisdiction, you may have the following rights regarding your personal information:
- Access: Request access to the personal information we hold about you.
- Correction: Request correction of inaccurate or incomplete personal information.
- Deletion: Request deletion of your personal information, subject to legal retention requirements.
- Portability: Request a copy of your personal information in a structured, commonly used, machine-readable format.
- Objection: Object to certain processing activities, including direct marketing.
- Restriction: Request restriction of processing under certain circumstances.
- Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
8.2 To exercise any of these rights, contact us at support@bridghamcyber.com. We will respond to your request within thirty (30) days, or such other period as required by applicable law.
8.3 We will not discriminate against you for exercising your privacy rights.
8A. California Privacy Rights (CCPA / CPRA)
8A.1 Scope. This section applies to California residents and supplements the rest of this Privacy Policy. It is provided under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"). Terms used in this section have the meaning given to them in the CCPA.
8A.2 Categories of personal information. In the preceding twelve (12) months, Bridgham Cyber, LLC has collected the categories of personal information described in Section 1, which may include identifiers, customer records, commercial information, internet and network activity, geolocation data, professional or employment information, and inferences drawn from the foregoing. The sources, business purposes, and recipients for each category are described in Sections 1 through 3.
8A.3 Sensitive personal information. To the extent we collect information that the CCPA treats as sensitive personal information, we use it only for the purposes permitted by the CCPA and the purposes described in this Privacy Policy. We do not use or disclose sensitive personal information for the purpose of inferring characteristics about you.
8A.4 No sale or sharing. Bridgham Cyber, LLC does not sell personal information and does not share personal information for cross-context behavioral advertising, as those terms are defined by the CCPA. We have not sold or shared the personal information of California residents, including residents under 16 years of age, in the preceding twelve (12) months.
8A.5 Your California rights. Subject to the conditions and exceptions in the CCPA, California residents have the right to:
- Know and Access: request the categories and specific pieces of personal information we have collected, the categories of sources, the business or commercial purpose for collecting it, and the categories of third parties to whom we disclose it;
- Delete: request deletion of personal information we have collected from you, subject to legal retention requirements;
- Correct: request correction of inaccurate personal information we maintain about you;
- Opt Out of Sale or Sharing: opt out of the sale or sharing of personal information. Because we do not sell or share personal information, no opt out is necessary on that basis;
- Limit Sensitive Personal Information: limit the use and disclosure of sensitive personal information to the uses permitted by the CCPA; and
- Non-Discrimination: not receive discriminatory treatment for exercising any of these rights.
8A.6 How to exercise your rights. California residents may submit a request by emailing support@bridghamcyber.com. We will confirm receipt within ten (10) business days and respond within forty-five (45) days, with one additional forty-five (45) day extension where reasonably necessary and permitted by law. We will take steps to verify your identity before fulfilling a request, which may require you to provide information we can match against our records.
8A.7 Authorized agents. You may use an authorized agent to submit a request on your behalf. We may require the agent to provide proof of your written authorization and may require you to verify your identity directly with us.
8A.8 Shine the Light. California Civil Code Section 1798.83 permits California residents to request information regarding our disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.
9. Children's Privacy
9.1 Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected information from a child under 18, we will take steps to delete such information promptly.
10. International Data Transfers
10.1 Bridgham is based in the United States. If you access our Services from outside the United States, your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those of your jurisdiction.
10.2 Where required by applicable law, we implement appropriate safeguards for international data transfers, including standard contractual clauses or other approved mechanisms.
11. Breach Notification
11.1 In the event of a data breach affecting your personal information, Bridgham will notify affected individuals and applicable regulatory authorities without unreasonable delay, consistent with N.C. Gen. Stat. § 75-65 and other applicable breach notification laws.
11.2 Notification will include, to the extent known: (a) a description of the nature of the breach; (b) the categories of information affected; (c) the measures taken or proposed to address the breach; and (d) recommendations for steps you can take to protect yourself.
12. Third-Party Links and Services
12.1 Our website and Platform may contain links to third-party websites or services. We are not responsible for the privacy practices or content of such third parties. We encourage you to review the privacy policies of any third-party services you access.
13. Contact Information
Bridgham Cyber, LLC
Raleigh, North Carolina
Privacy inquiries: support@bridghamcyber.com
General inquiries: support@bridghamcyber.com
Data protection requests: support@bridghamcyber.com
14. Changes to This Privacy Policy
14.1 Bridgham may update this Privacy Policy from time to time. Material changes will be communicated via email or Platform notification at least thirty (30) days before taking effect. Your continued use of the Services or Platform after the effective date constitutes acceptance of the updated Privacy Policy.
14.2 We encourage you to review this Privacy Policy periodically.
Effective September 26, 2026