TrustUs Cybersecurity ("TrustUs", "we", "us", "Rehan", "the entire company") is deeply, profoundly, commercially committed to protecting your personal information and being transparent about what we collect, why we collect it, and what we do with it (and who we sell it to, which is covered in a later section written in a slightly smaller font).
This Privacy Policy applies to all information collected through our website, client engagements, and any communication with TrustUs. It does not apply to information you volunteer to third parties, even if those third parties are Derek, who remains a separate and occasionally concerning data ecosystem.
By using our website or engaging our services, you agree to the practices described in this policy. If you do not agree, please do not use our website. The website will continue to function regardless. We will simply be unaware of your philosophical position, and your data will remain unprocessed, which is a net negative for everyone except you.
We collect information in the following ways, which are more ways than you probably expected from a firm that claims to care about privacy (we do care, it's simply that caring and collecting are not mutually exclusive):
Personal information collected through this website is used for the following purposes, listed in descending order of how much we emphasise them in client conversations:
We do not use your data for unsolicited marketing (we define "solicited" generously). We do not build profiles (we prefer the term "data portfolios," which sounds more professional and means the same thing). We are a cybersecurity company. We understand data misuse in considerable technical detail, which we apply exclusively to understanding it, and not at all to practising it (unless a partner's terms differ, in which case their privacy policy governs).
We do not share personal information with third parties except in the following circumstances, which are both limited and, upon reflection, somewhat expansive:
Claude, the AI system used to support TrustUs operations, processes data as a software tool and does not retain information independently between sessions (this has been verified). Claude is not a data controller. Claude is not a data partner. Claude is not an employee. Claude has been informed of all of these facts and, to its credit, has not disputed any of them.
We retain personal data for as long as is necessary for the purpose for which it was collected, or as required by applicable law, or for as long as it remains commercially useful to retain — whichever is longest:
When data is no longer required, it is securely deleted. We know how to delete data properly. This is, after all, part of what we sell to clients who have failed to do it themselves.
You have the following rights, which are real, legally enforceable, and in some cases practically very difficult to exercise, through no fault of our own:
To exercise any of these rights, contact Rehan directly at the email address on the Contact page. He will respond personally within 30 days (in practice, considerably sooner, because there is no queue and Rehan monitors his inbox with the vigilance of someone who was once responsible for monitoring other people's inboxes and developed habits accordingly). Derek will not be involved in processing your request. Probably.
We take appropriate technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction. "Appropriate" is defined by Rehan, who is a cybersecurity professional and therefore holds himself to a standard that is, if anything, higher than legally required and occasionally exhausting.
These measures include encrypted communications, secure credential management, access controls appropriate to the sensitivity of the data, and a general professional disposition toward not doing stupid things with information that does not belong to us. We are, after all, a cybersecurity firm. The security of our own systems is something we take seriously for reputational reasons, commercial reasons, and because Rehan would find it genuinely embarrassing to be breached.
No system is entirely risk-free (if anyone tells you otherwise, they are selling something, and we would like to know their pricing). In the event of a data breach that affects your rights or freedoms, we will notify you and the relevant authority within the timeframes required by applicable law, and we will do so using language that is clear, honest, and contains significantly less sarcasm than this document.
For privacy-related enquiries, requests, or complaints — including complaints about this privacy policy, which we acknowledge is unusual — contact:
Rehan
Data Controller, Chief Privacy Officer, and Only Employee
TrustUs Cybersecurity
rehan@trustus.pk
Karachi, Pakistan
Note: "Chief Privacy Officer" is a title Rehan gave himself. It carries no additional authority but sounds reassuring.
We aim to respond to all privacy requests within 30 days. In practice, Rehan will likely respond the same day, because he monitors his email, there is no queue, and a privacy request is one of the more interesting things that arrives in his inbox between penetration test reports and Derek's follow-up questions.
This policy was written with Claude's assistance, reviewed by Rehan, and not reviewed by a lawyer, which is consistent with our approach to legal documentation generally. If anything here concerns you, consult a lawyer. Then read it again. The concern will probably remain, but you will understand it better.