Privacy & Disclosure

Privacy Policy & Affiliate Disclosure

Last updated: October 27, 2026.

This page explains how Obsidian Ridge LLC handles information through this website, our request forms and the emails you send us.

What we collect

Briefing requests and bookings: first and last name, email, company, team size, how you found us, an optional note, and the plan, service or page that brought you to the form. When you continue to the calendar, we send your name and email to HubSpot to fill them in for you. HubSpot handles the time you choose and any additional booking answers.
Newsletter signups: email and the signup page. We record whether you confirmed or unsubscribed. Asking for a download does not by itself subscribe you; the optional newsletter choice has a separate confirmation email.
Vulnerability alerts: email and the products, search terms or categories you choose to follow, plus confirmation and delivery status.
Security and AI-use checks: answers and progress stay in your browser while you use the tool. If you ask for a report, we receive your name, email, company-size or industry choices, the type of check and any frameworks you select, answers, results, source page and any separate newsletter choice. The insurance-readiness check sends answers and contact choices only when its follow-up form is available and you submit it.
Free 30-Day AI Security Assessment requests: company name, team-size range, industry, whether insurance renewal is within six months, email, source page and campaign labels. This request form does not install software or collect an inventory from your computers. A later assessment is a separate engagement.
Ransomware cost calculator: business type, daily revenue, staff count, backup, insurance and seasonal choices. The calculation and saved draft stay in your browser. If you ask us to email the report, we also receive your email, optional company name, inputs, results and separate marketing choice. That choice does not currently start a marketing email sequence.
Emailed pricing summaries: email, selected plan or service and source page, so we can send the summary you requested.
Emails and calls: the contact details, message and attachments you choose to give us. The free questionnaire-review links open your email app; they do not upload a document through this website. Please do not put passwords, medical records or other sensitive third-party information in public forms.
Site visits and security checks: page addresses, referral and campaign information, page views, clicks, broad device/browser information, approximate location and performance measurements. Hosting and anti-abuse systems also process network details such as your IP address. Diagnostic and email-delivery logs can contain recipient addresses and error details.

When you first visit, your browser remembers which website sent you here (just the site name, like chatgpt.com), any campaign label in the link, the first page you opened and when. We store this first-touch record in your browser and send it with a briefing request so we know how people find us. We use it for up to 30 days, and remove or replace an expired record the next time the site checks it. This record uses browser storage, not cookies, and keeps the referring site name and first page path rather than full web addresses. The separate analytics described below can receive page addresses and referral information before you submit a form.

Some tools also save your progress or preferences on your device. See Cookies and browser storage for the storage details.

How we use it

We use the information to answer requests, prepare and schedule conversations, send requested reports and confirmed newsletters or alerts, check whether an assessment fits, limit spam and abuse, and understand which pages and sources bring visitors. The AI Check launcher is a link to a tool, not a chat or a background scan.

Services we use

Vercel hosts the site and its forms. It processes page/API requests and server logs. Vercel Web Analytics counts visits, and Speed Insights measures page performance.
Supabase stores form submissions, subscription preferences, confirmation status and email-delivery records.
Resend receives email addresses, messages and requested report attachments to deliver our emails and internal request alerts.
HubSpot is our customer-relationship and booking tool. It receives briefing requests, plan and arrival details, and calendar bookings. Its calendar loads after your briefing details are accepted.
Cloudflare supplies Turnstile verification on configured forms. Its browser check and our server verification process a verification token and network details, including IP address, to help limit automated abuse.
Upstash processes IP-based request counts to limit repeated submissions and analytics requests.
Plausible counts visits and events without analytics cookies. Our site forwards page/event data, IP address and browser headers to it through a first-party proxy. It is separate from Vercel's analytics and performance tools.
Google handles mail sent to our business inboxes. The message and any attachments you send are handled there.
Vimeo receives browser requests when you press Play on an embedded film. We request its reduced-tracking player mode. The video service can still use security storage.
Google Fonts and unpkg supply fonts and scripts on our older standalone explainer pages under /reels/. Our main website serves its fonts from our own domain.
Stripe handles payment and billing details when you follow a checkout or billing link. We do not collect card details in our website forms.

Our newsletter uses Supabase and Resend. The website does not currently send newsletter signups to beehiiv. Other websites you choose to visit from our links have their own privacy practices.

What we don't do

The website does not send form answers to advertising pixels or provide a sale or advertising-sharing feed. We do not sell the personal information collected through this site or share it for other companies' advertising. You do not need an account to read articles, browse pricing or use the Phish or Real game.

Cookies and browser storage

Browser storage remembers arrival details, tool drafts and some preferences. These optional records are different from cookies. Blocking or clearing them can remove saved progress, but does not prevent reading the site. Our booking and video providers can set their own security cookies after you open those features.

We tell the HubSpot calendar not to track analytics, but it can still create session analytics state and send diagnostic or usage requests. Opening a calendar or video connects your browser to that provider. You can ask us to arrange a briefing by phone or email instead.

The table records storage found in our code and browser checks on October 27, 2026. We did not observe a cookie set on our own domain before an action. Optional arrival storage can still be created when a page opens. A browser session normally ends when you close the relevant tab or window; browser restore settings can keep it longer.

Storage used by this site and features you choose to open
Name	Set by	Purpose	How long it lasts	Necessary or optional
`obsidianridge:first-touch:v1`	Our site · local storage	Referring site, campaign labels, first page path and arrival time.	Used for up to 30 days; removed or replaced on the next check after expiry.	Optional
`obsidianridge:visit-touch:v1`	Our site · session storage	Arrival details for the current visit.	Browser session, with a 30-day freshness check.	Optional
`obsidian-ridge-assessment-tool-v1`	Our site · session storage	Assessment answers and progress. Saved drafts leave contact fields blank.	Browser session; cleared by reset or successful submission.	Optional
`obsidian-ridge-readiness-check-v1`	Our site · session storage	Insurance-readiness answers and progress.	Browser session; reset replaces the saved answers with an empty draft.	Optional
`obsidian-ridge-ransomware-calc-v1`	Our site · local storage	Calculator inputs, without email or company name.	No automatic expiry; Reset or clearing browser storage removes it.	Optional
`or:assessment-promotion:v1`	Our site · local storage	Remembers an assessment request or a promotion dismissal. The older timed promotion is not currently shown.	No automatic deletion. Dismissals suppress that promotion for 30 days; a submitted marker has no expiry.	Optional
`dental-explainer-v1:t; obsidian-phish-video:t; soc2-reel:t; obsidianridge:t; itdr-reel:t`	Our standalone /reels/ pages · local storage	Saves playback position in each explainer.	No automatic expiry; clear browser storage to remove it.	Optional
`__cf_bm`	HubSpot calendar · cookie on hubspot.com, hsappstatic.net and hubspotusercontent-na2.net	Cloudflare bot protection for the booking service, loaded after briefing details are accepted.	About 30 minutes.	Security for the requested calendar
`__hmpl`	HubSpot calendar · session storage in its frames	Vendor session/device identifiers and counters, even with our analytics consent reply set to false.	Browser session.	Optional analytics/diagnostics
`HUBLYTICS_EVENTS_53`	HubSpot calendar · session storage	Vendor event queue, even with our analytics consent reply set to false.	Browser session.	Optional analytics/diagnostics
`__cf_bm`	Vimeo player · cookie on vimeo.com	Cloudflare bot protection after you press Play.	About 30 minutes.	Security for the requested video
`__cf_ob`	Vimeo player · cookie	Observed during the player's security challenge; its exact purpose is not confirmed.	Browser session in our check.	Provider controlled; necessity unconfirmed
`_cfPre_tabId`	Vimeo player · session storage	Observed as part of the player's Cloudflare challenge.	Browser session.	Security state; exact purpose unconfirmed
`cf.turnstile.u`	Cloudflare challenge frame · local storage	Observed in a security challenge opened by Vimeo. This was separate from our form verification widget.	No expiry was established in our check.	Security state; provider controlled

On a narrow screen, scroll within the table to read all five columns. Cloudflare Turnstile also checks configured website forms. Our local check could not load that form widget, so we have not verified its storage in the production configuration. The video challenge items above are not a claim that our form widget sets the same items. Provider storage can change with their settings and your browser.

Plausible and Vercel Web Analytics are designed to measure visits without analytics cookies. That does not mean no information leaves your browser: page requests, analytics and performance measurements still go to the providers listed above.

Do Not Track and Global Privacy Control

The site does not have a separate response to the older Do Not Track browser signal. When your browser enables Global Privacy Control, we skip Plausible, Vercel Web Analytics and Vercel Speed Insights. Forms, security checks, optional first-touch storage and a calendar or video you choose to open still work. Those providers may apply their own browser-signal settings; our setting does not control their systems.

How long information stays

Browser storage periods are described above. Newsletter confirmation links expire after 48 hours; that does not delete the subscription record. Unsubscribing from the newsletter marks the subscription as stopped. Unsubscribing from a KEV watch removes that watch's subscriber record.

Our form systems do not currently delete submission records automatically after a fixed period. You can ask us to see, correct or delete information using the contact details below. We'll reply within 2 business days. A browser storage period is not a deletion period for requests already sent to us, emails, logs or provider backups.

How we protect website requests

The public site uses HTTPS. Form requests are handled on the server and checked for expected origin, valid fields and abuse. Configured submission forms also use a server-verified human check and request limits before forwarding details. Database submission credentials are kept on the server. These measures reduce risk; they do not make a website or an email completely secure.

Your choices

Every marketing email we send carries an unsubscribe link, and one click is enough: opting out is automatic and takes effect right away. Nobody has to read an inbox and act on it. The link stops that kind of email, and the page it opens also offers to stop all marketing email from us. You still get messages you ask for, like a report you request or a confirmation of something you booked.

You can also contact us to request access, correction or deletion, or to ask us to stop promotional messages. Clearing browser storage removes saved drafts and preferences from that browser; it does not delete records you already submitted.

Children

This site is not intended for children under 13, and we do not knowingly collect their personal information. If you believe a child has sent us information, contact us using the details below.

Affiliate & reseller relationships

We earn money from services and products we sell, including managed security and Island Enterprise Browser. That commercial interest is part of how to read our recommendations. The partner-routing pages below describe whether each arrangement is live, pending, prospect or editorial. An inactive entry is not an active affiliate purchase link.

An active affiliate link can earn us a commission if you buy from the vendor. There are currently no active affiliate purchase destinations in these routing pages. Buying a managed service from us is a separate reseller or direct-service relationship.

Changes to this policy

When this policy changes, we update the date at the top of this page.

Contact

For privacy questions, access, correction, deletion or unsubscribe requests, email security@obsidianridge.io or write to Obsidian Ridge LLC, 964 High House Rd, PMB 2086, Cary, NC 27513. This is a mailing address, not a visitor office.