Privacy Policy

01 About this notice

BaseLayer Security operates from Hyderabad, India, and offers a security remediation product and security assessment and consulting services. In this notice, “we” and “our” refer to the BaseLayer Security business operating this website.

This notice describes personal information handled through our public marketing website, including enquiries, demo requests, and design-partner, pilot and early-access applications.

For questions about the operator or this notice, email contact@baselayersecurity.com.

02 Information collected

Information you provide: Depending on the form you use, we receive your name, email address, company, optional telephone number, selected product or service interest, and message.

Our early-access application also asks for your role, approximate annual security finding volume, the challenge you describe, and whether you are interested in a design partnership, pilot or demo. We also receive information you include in subsequent correspondence.

Required fields are identified on the relevant form. You can choose not to submit a form, although missing contact or enquiry details may prevent us from responding.

Technical information: Hosting, form-processing and font providers receive information associated with requests, which may include an IP address, browser or device information, requested resource, timestamps and referring-page information. This is distinct from behavioural advertising tracking.

Please keep submissions limited: These forms are not intended for payment details, identity documents, passwords, API keys, sensitive personal information, customer records or confidential vulnerability evidence. Avoid including these in free-text fields.

03 Uses and processing grounds

• Responding to you: Handling enquiries, arranging requested demonstrations and discussing relevant services or product access.
• Evaluating applications: Understanding your needs and assessing suitability for design-partner, pilot and early-access discussions.
• Operating the website: Delivering pages and forms, investigating technical problems, and preventing spam, abuse and security incidents.
• Administration: Maintaining relevant correspondence and addressing applicable legal obligations or disputes.

Where a law requires us to identify a lawful basis, the basis depends on the purpose and circumstances. These may include our legitimate interests in responding to business enquiries and operating a secure website, steps you request before entering a contract or performance of a contract with you, and compliance with legal obligations.

If we specifically ask for consent for a separate activity, we will explain that activity when asking. You may withdraw that consent without affecting earlier processing based on it. Submitting an enquiry or continuing to browse is not, by itself, consent to unrelated marketing.

We do not sell enquiry information or use it for third-party targeted advertising. You may ask us to stop optional follow-up communications by replying or using the contact address below.

04 Providers and international processing

The website uses providers for delivery and communication:

• Formspree: Receives form submissions, processes and stores submitted information, and delivers notification emails. It may also process technical information for service operation and abuse prevention. Formspree privacy policy.
• Vercel: Hosts and delivers website pages and related functions and may process request and operational logs. Vercel privacy notice.
• Google Fonts: Supplies fonts requested by the browser; these requests disclose technical information such as your IP address to Google. Google Fonts privacy information.
• GitHub and Decap CMS: Support website content management and administrator authentication. Public blog pages are generated during deployment; reading a blog does not require a GitHub account. Administrators using the editor interact with these services separately. GitHub privacy statement.
• Email services: Process enquiry notifications and correspondence sent to or from our contact address.

Authorised people handling your enquiry and the providers supporting those activities may receive relevant information. Disclosure may also be necessary to comply with applicable legal requirements or to establish, exercise or defend legal claims.

Provider processing may take place outside your country, including in the United States. Formspree describes using infrastructure in the United States and other locations where it operates. Locations, retention and applicable protections depend on the provider and service arrangement; the provider notices above give further information. Contact us for questions about an enquiry you have submitted.

Following a link to another website brings you under that website’s own privacy practices.

05 Retention

Retention depends on the information and its purpose, including whether an enquiry is active, whether a pilot or service relationship follows, and whether records are needed for applicable legal obligations or claims. We do not state one fixed deletion period for all records.

Form submissions, email correspondence, technical logs and provider backups may have different retention arrangements. A deletion request does not necessarily remove every backup copy immediately, and some records may need to be retained for a lawful reason.

You may contact us to ask what information is held about your enquiry, request deletion, or obtain clarification about retention.

06 Your choices and rights

Depending on applicable law and the circumstances, you may have rights to request access, correction or deletion of personal information; restrict or object to processing; receive certain information in a portable form; or withdraw consent where processing relies on it. These rights are subject to applicable conditions and exceptions.

Email contact@baselayersecurity.com with your request. We may need proportionate information to verify your identity or clarify the request. Do not send identity documents unless an appropriate verification method has been agreed.

We will address requests within the time limits required by applicable law and explain any applicable limitations or extensions. Where available under local law, you may also raise a complaint with the relevant data protection authority or use the applicable grievance process.

07 Cookies and external resources

The current public marketing pages do not include Google Analytics, advertising pixels or our own behavioural tracking scripts. Their form-submission counters operate in page memory rather than persistent browser storage.

This does not mean that no technical information is processed. Hosting requests, form submissions and externally loaded fonts involve the providers described above. Administrator sign-in and third-party websites may use cookies or browser storage under their own practices.

If we introduce non-essential tracking or similar technologies, we will update the relevant information and obtain consent where required. You can manage cookies and browser storage through your browser settings.

08 Security

The website and form submissions use HTTPS to encrypt data in transit. Enquiry forms send information to Formspree, so submissions are handled by that provider as well as through the correspondence channels used to respond.

No website, transmission method or storage system can guarantee absolute security. Use public forms only for initial business enquiries. If you need to share sensitive assessment material, contact us first to arrange an appropriate channel.

To report a website vulnerability, see our Vulnerability Disclosure page. Do not include credentials or other people’s personal information in an initial report.

09 Children

This business website is directed at organisations and adult professionals, not children. If you believe a child has submitted personal information, contact us so we can review the situation and take appropriate action.

10 Contact and updates

We may revise this notice as website features or processing practices change. The date above identifies the latest revision. Where applicable law requires additional notice or consent for a change, we will follow that requirement.