Privacy policy

1. Introduction

Glacier Byte Technology LLC (“we,” “our,” or “us”) is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website glacierbytetechnology.com and use our services.

As a cybersecurity contractor serving federal agencies, we maintain the highest standards of data protection in compliance with NIST 800-53, FedRAMP, and other applicable federal security frameworks.

2. Information we collect

2.1 Information you provide

When you contact us through our website forms, we collect:

• Full name
• Email address
• Organization name
• Message content and service requirements

2.2 Automatically collected information

We automatically collect certain information when you visit our website:

• Browser type and version
• Operating system
• Referring website
• Pages visited and time spent on pages
• IP address (anonymized for privacy)

3. How we use your information

We use the information we collect for the following purposes:

• Responding to your inquiries and service requests
• Communicating about our cybersecurity services and solutions
• Improving our website and user experience
• Analyzing website traffic and usage patterns
• Complying with legal obligations and security requirements
• Protecting against fraudulent or unauthorized access

4. Form data processing

Contact form submissions are processed through a secure backend powered by AWS Lambda and Amazon Simple Email Service (SES). When you submit a form:

• Your data is transmitted securely via HTTPS/TLS encryption to our API
• Cloudflare Turnstile verifies you are not a bot before processing
• Form data is delivered to our designated email address via Amazon SES
• Submissions are not stored in any database; they are delivered as email only
• Rate limiting and input validation are enforced to prevent abuse

For more information about AWS's privacy practices, please visit the AWS Privacy Policy.

5. Analytics and cookies

Website analytics (first-party, cookieless)

We use first-party, privacy-respecting analytics to understand how our website is used. We do not use any third-party analytics service, advertising tracker, cookie, or client-side tracking script for analytics. Instead, our content-delivery network (Amazon CloudFront) records standard server access logs for requests to the site. These logs are delivered only to storage we control inside our own Amazon Web Services account and are not shared with any third-party analytics provider. For each request, the logs may include your IP address, browser type / user-agent, the referring page, the page or file path requested (including counts of template-document downloads), the HTTP response status, and a date and time stamp.

We use this information only for aggregate website-usage statistics, to count document downloads, and to keep the site secure and reliable. We do not use it to build profiles of individual visitors. For visitors in the EU/EEA and UK, our lawful basis is our legitimate interests in operating, securing, and improving the website (GDPR Article 6(1)(f)). We retain raw access logs for a limited period (approximately 30 to 90 days) and then delete them, keeping only aggregate, non-identifying statistics.

Cookies

The marketing site (glacierbytetechnology.com) is cookieless by default: simply browsing it sets no cookies. We use localStorage only to remember your preferred light or dark theme; localStorage is not a cookie and is never sent to a server. No analytics, advertising, or cross-site tracking cookies are set.

Two features load a third party only when you choose to use them, at which point that third party may set its own cookie:

• Form spam protection. When you begin filling in the contact or newsletter form, we load Cloudflare Turnstile to confirm you are not a bot. Cloudflare may set a strictly-necessary security cookie (__cf_bm, about 30 minutes) on its own domain, used only for bot protection, not for advertising or cross-site tracking. It is not loaded unless you engage a form.
• Careers job board. Our open roles are hosted on a third-party board (Dover). On the Careers page it is not loaded automatically: you click "Load the job board," and only then does Dover load and potentially set its own cookies (see Dover's privacy policy). Until you click, no Dover cookie is set.

The Client Portal at portal.glacierbytetechnology.com (a separate subdomain) sets short-lived, strictly-necessary authentication cookies (OAuth state values, flagged Secure and SameSite=Lax, expiring in about 10 minutes). Those are scoped to the portal subdomain and are not present on the marketing site.

Because the marketing site is cookieless by default, sets no analytics or advertising cookies, and loads the strictly-necessary form-protection and opt-in careers embeds only when you choose to use them, no cookie-consent banner is required under GDPR, ePrivacy / PECR, or CCPA. You may request access to, or deletion of, information we hold, or object to this processing, by contacting us.

6. Data security

We implement industry-standard security measures to protect your information, including:

• HTTPS/TLS encryption for all data transmission
• Input validation and sanitization to prevent XSS and injection attacks
• Rate limiting to prevent automated abuse
• Regular security audits and vulnerability assessments
• Compliance with NIST 800-53 security controls
• Secure hosting on Amazon S3 with CloudFront (HTTPS, private origin)

No method of transmission over the internet is 100% secure. We implement the controls listed above and continuously monitor our security posture.

7. Information sharing and disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• Service Providers: With trusted third-party service providers (e.g., AWS (Lambda, SES, API Gateway) for form processing, Cloudflare (Turnstile CAPTCHA) for bot protection) who assist in operating our website
• Careers (Dover): Our careers page embeds a job board hosted by Dover (app.dover.com). If you apply through it, the information you submit is collected and processed by Dover under its own privacy policy; we do not receive that application data through this website.
• Legal Compliance: When required by law, court order, or governmental request
• Security Purposes: To protect our rights, property, safety, or that of our users or the public
• Business Transfers: In connection with a merger, acquisition, or sale of assets

8. Data retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law. Contact form submissions are retained for business communication purposes and deleted upon request or when no longer needed.

9. Your privacy rights

You have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information
• Objection: Object to our processing of your personal information
• Portability: Request transfer of your data to another service

10. Government compliance

As a federal contractor, Glacier Byte Technology adheres to strict government security and privacy requirements, including compliance with the Federal Information Security Modernization Act (FISMA), FedRAMP authorization requirements, and NIST Special Publications. Our data handling practices meet or exceed federal standards for protecting sensitive information.

11. Children's privacy

Our website and services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately.

12. Changes to this privacy policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by posting the updated policy on this page with a new “Last Updated” date. Your continued use of our website after such changes constitutes acceptance of the updated policy.

13. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: