Privacy Policy

This Privacy Policy explains how Multisum Cybersecurity & Services ("Multisum", "we", "us") collects, uses, stores, shares and protects the personal information you provide when you use our website at multisumcybersec.com. It is written to be transparent about every form on the site and to align with the principles of the EU General Data Protection Regulation (GDPR), the Brazilian Lei Geral de Proteção de Dados (LGPD) and applicable US state privacy laws.

1. Who is responsible for your data

The data controller is Multisum Cybersecurity & Services, Anaheim, California, United States. For any privacy question or to exercise your rights, contact us at contact@multisumcybersec.com.

2. Information we collect through our forms

We only collect the information you choose to submit through one of our four web forms. We do not require you to create an account, and we do not ask for payment information on this website. The fields collected by each form are:

2.1. Contact form (contact page)

• First name and last name
• Corporate email address
• Company name
• Subject and the free-text message you write

2.2. Pre-launch / "Notify me at launch" form (home page)

• Full name
• Corporate email address
• Company name
• Number of sites you plan to manage
• Plan of interest (only if you arrived from a plan button)

2.3. Newsletter subscription (news page)

• Full name
• Corporate email address
• Company name

2.4. Gated document download (news page)

• First name and last name
• Corporate email address
• Company name and job title
• Phone number
• Country
• Industry sector and company size
• Area of interest
• The title of the document requested
• Your explicit consent (a required checkbox) to be contacted about it

2.5. Technical information collected automatically

With every form submission we also record the page you submitted from and your selected site language, to help us route and understand the request. Our servers process your IP address transiently to enforce anti-abuse rate limiting; the IP address is stored only as a short-lived, hashed counter (see Retention) and is not added to your lead record. If, in the future, we enable the Cloudflare Turnstile anti-bot check, Cloudflare will process a challenge token as described in section 6.

The website also stores a small amount of information in your browser's local storage (not cookies) purely for functionality: your language preference, a record that you accepted the Data Privacy & AI Consent Agreement in the checkout preview, and, if applicable, the plan you showed interest in. This information stays in your browser and is not transmitted for advertising purposes.

3. Why we collect it and our legal bases

• To respond to your inquiry (contact form) — performance of steps taken at your request / our legitimate interest in answering prospects and customers. Legal basis: GDPR Art. 6(1)(b)/(f); LGPD Art. 7 II/IX.
• To send you the document you requested (download form) — performance at your request, plus your explicit consent to follow-up contact. Legal basis: GDPR Art. 6(1)(a)/(b); LGPD Art. 7 I/IX.
• To send the newsletter — your consent, which you can withdraw at any time. Legal basis: GDPR Art. 6(1)(a); LGPD Art. 7 I.
• To notify you at product launch (pre-launch form) — your consent / our legitimate interest in maintaining a waitlist. Legal basis: GDPR Art. 6(1)(a)/(f); LGPD Art. 7 I/IX.
• To measure and improve the website (Google Analytics) — your consent where cookie consent is legally required, otherwise our legitimate interest in understanding aggregate site usage. Legal basis: GDPR Art. 6(1)(a)/(f); LGPD Art. 7 I/IX.
• To keep the site secure (rate limiting, anti-bot, abuse prevention) — our legitimate interest and legal obligation to protect the service. Legal basis: GDPR Art. 6(1)(f)/(c); LGPD Art. 7 IX.

4. How your data is processed and where it is stored

When you submit a form, the data is sent to a server-side endpoint on our hosting provider (Hostinger). That endpoint validates the request and then forwards the fields to Google Sheets via Google Apps Script, where each submission is stored as one row so we can manage and follow up on leads. Google LLC therefore acts as a data processor and stores this data on its infrastructure (primarily in the United States).

For the contact form specifically, your message is additionally sent by email to our team inbox (contact@multisumcybersec.com) so we can reply to you directly; your email address is set as the reply-to so we can respond.

We do not process card or payment data on this website. If you purchase a subscription after launch, payments will be handled by our payment provider (Lemon Squeezy) as Merchant of Record under its own privacy terms; this policy will be updated before that flow goes live.

5. Who we share it with

We do not sell or rent your personal information. We share it only with the service providers that operate the website on our behalf, under their respective data-processing terms:

• Hostinger — web hosting and email delivery.
• Google LLC — Google Apps Script and Google Sheets, where lead submissions are stored; Google Analytics 4 for aggregate website statistics (see section 6).
• Cloudflare, Inc. — Turnstile anti-bot verification on our forms (see section 6).

We may also disclose information where required by law or to protect our rights, safety, or property, or those of others.

6. Cookies, analytics and tracking

We use Google Analytics 4 (provided by Google LLC) to understand how visitors use this website — for example which pages are viewed, how long visits last, approximate country or region, device and browser type, and how visitors arrived at the site. We use this information in aggregate to improve the site and our content. We do not use it to build advertising profiles, and we do not sell it.

Google Analytics sets first-party cookies on this domain (currently _ga and _ga_*), which contain a random identifier used to recognise repeat visits; they expire after up to 13 months. IP addresses are not logged or stored by Google Analytics 4, and we have not enabled Google Signals, advertising features or remarketing. Where required by law, analytics cookies are only set after you give consent, and you can withdraw that consent at any time. You can also block them in your browser settings or with the Google Analytics opt-out add-on; the website works normally without them. You can change your choice at any time through the "Cookie preferences" link in the footer of every page. More about how Google processes this data: policies.google.com/technologies/partner-sites.

Our forms are protected by Cloudflare Turnstile, a privacy-preserving anti-bot check provided by Cloudflare, Inc. When a form is displayed, Turnstile evaluates browser and interaction signals to tell humans from automated traffic; it does not use tracking cookies and is not used for advertising. Apart from the above, we do not use advertising cookies, we do not track your activity across other websites, and the only other client-side storage is the functional browser local storage described in section 2.5, which is not used for tracking.

7. International data transfers

Because we use Google and Cloudflare, your data may be processed in the United States and other countries where these providers operate. Where personal data of EU/UK or Brazilian residents is transferred, it is protected by the providers' standard contractual clauses and equivalent safeguards.

8. How long we keep it

• Lead and contact submissions (Google Sheets rows and contact emails): retained for as long as needed to handle your request and manage the ensuing commercial relationship, and then reviewed periodically for deletion. You may request earlier deletion at any time (see section 9).
• Newsletter subscription: retained until you unsubscribe or ask us to delete it.
• Analytics data: Google Analytics cookies expire after up to 13 months; event-level data is retained in Google Analytics for 14 months (the shortest retention setting we can select) and then aggregated or deleted.
• Anti-abuse rate-limit data: hashed IP counters are kept only for the short limiter window (minutes) and idempotency keys for up to 24 hours; they are then automatically discarded.

9. Your rights

Depending on where you live, you have rights over your personal data, including the right to access it, correct it, delete it, restrict or object to its processing, receive a portable copy, and withdraw consent at any time (without affecting processing already carried out). Residents of the European Union/UK (GDPR), Brazil (LGPD) and US states such as California (CCPA/CPRA) are expressly covered.

To exercise any of these rights, email contact@multisumcybersec.com with your request. We will respond within the period required by applicable law. You also have the right to lodge a complaint with your local data protection authority (for Brazil, the ANPD; for the EU, your national supervisory authority).

10. Security

We apply technical and organizational measures appropriate to a marketing website, including HTTPS/TLS encryption in transit, HTTP security headers and a Content Security Policy, server-side input validation, protection against spreadsheet formula injection, anti-automation controls (honeypot and rate limiting, with CAPTCHA available), and least-privilege access to the spreadsheets that hold submissions. No method of transmission or storage is 100% secure, but we work to protect your data proportionately to its sensitivity.

11. Children

This website and our services are directed to businesses and professionals. We do not knowingly collect personal information from children (under 16 under GDPR, under 13 under US COPPA). If you believe a child has provided us data, contact us and we will delete it.

12. Changes to this policy

If we change this Privacy Policy — including before enabling the payment flow or any new third-party service — we will post the updated version on this page and revise the date below.

Last Modified: August 21, 2026

Contacting us

For any question about this Privacy Policy or the data we hold about you, contact us at contact@multisumcybersec.com, or use our Contact page.

Go to Contact Us