Privacy Policy

1. Who we are

This Privacy Policy explains how we collect, use, share and protect personal data when you visit our website, contact us, or use Bulwark, our governance platform for AI agents.

The controller of your personal data is Bastion Shield Technologies Ltd ("we", "our", "us"), a company registered in England and Wales with company number 17105460. Our registered office is as shown on the Companies House register. You can contact us about privacy at info@bastionshieldtechnologies.com.

Where a customer organisation sends personal data to Bulwark as part of its own data (for example, agent and audit records), that organisation is the controller and we process the data on its behalf, as described in our Terms of Service. This policy covers the data for which we are the controller.

2. Information We Collect

2.1 Information You Provide

We collect information that you provide to us when you:

• Fill out our contact form, for example to request information, early access or an architecture review
• Email us or contact us by phone
• Create or use a Bulwark account, or are invited to one by your organisation
• Subscribe to a paid Bulwark plan

Through the contact form this is your name, email address, company name, the service you are interested in and your message. For Bulwark accounts it is your name, work email address, organisation name, role and the answers you give when you sign up. For paid plans it includes billing contact details; card details are collected by Stripe, not by us.

2.2 Automatically Collected Information

We run no analytics on this website. Like any website, the infrastructure that serves it handles some technical details of each request so it can deliver the page and keep the site secure. These are held in routine server and security logs and can include:

• IP address
• Browser type and version
• Operating system
• The page you requested
• The address of the page that linked to us, if your browser sends it

We use this only to deliver and protect the website and to limit abuse of our contact form. We do not use it to build profiles of visitors or to track you across other sites.

3. How we use your information, and our legal bases

Data protection law requires a legal basis for each use of personal data. In plain English:

• Answering your enquiry. When you contact us, we use your details to reply and to follow up on your request. Our basis is our legitimate interest in responding to business enquiries, or taking steps you have asked for before entering into a contract.
• Providing Bulwark. We use account data to create and run your account, send service emails such as sign-up, invitation and password emails, and support you. Our basis is performing our contract with your organisation, and our legitimate interest in running the accounts of its users.
• Billing. We use billing details to take payment and keep financial records. Our basis is performing the contract, and our legal obligations on tax and accounting records.
• Security and abuse prevention. We use technical request data to keep the website and the Service secure and to limit abuse. Our basis is our legitimate interest in protecting our systems and users.
• Marketing. We send marketing emails only where the law allows it, and with your consent where the law requires consent. You can opt out at any time.
• Legal requirements. We use and keep data where we must do so to comply with the law. Our basis is legal obligation.

4. Cookies and Tracking Technologies

This website sets no cookies and performs no analytics, advertising, or behavioural tracking. The only item stored in your browser is an entry in your browser's session storage recording that you have dismissed our notice banner, which is cleared when you close the tab. Our Cookie Notice lists it in full, including how to remove it.

5. Information Sharing and Disclosure

We do not sell your personal information. We share it only:

• With the service providers listed in section 6, who process it for us to run the website, the Service and our business
• When required by law or to protect our rights
• In connection with a business transfer or merger
• With your consent

6. Sub-processors and service providers

We use the following providers. Each processes personal data only to provide its service to us.

• Amazon Web Services (AWS Amplify and Amazon CloudFront)

  Purpose: Hosting this website and delivering its pages.

  Data: Technical request data such as IP address, browser details and the page requested (see section 2.2), and the contact form submission while it is passed through the website.

  Location: Pages are delivered through CloudFront's network of edge locations. We will confirm the region on request.

  Privacy information: https://aws.amazon.com/privacy/

• Amazon Web Services (Amazon S3)

  Purpose: Storing backup copies of the Bulwark database.

  Data: Bulwark account data and customer data held in the database.

  Location: We will confirm the region on request.

  Privacy information: https://aws.amazon.com/privacy/

• Fly.io

  Purpose: Hosting the Bulwark application, API and Postgres database.

  Data: Bulwark account data, customer data, and technical request data.

  Location: London, United Kingdom (Fly.io region lhr), per our deployment configuration.

• Resend

  Purpose: Sending Bulwark service emails, such as sign-up, invitation and password emails.

  Data: Your name, email address and the content of the email.

  Location: We will confirm the region on request.

• Stripe

  Purpose: Payment processing, subscriptions and invoices for paid Bulwark plans.

  Data: Billing contact details, payment card details and payment history. Stripe processes card details under its own terms; we do not store full card numbers.

  Location: We will confirm the region on request.

  Privacy information: https://stripe.com/privacy

• Slack

  Purpose: Internal notifications to our team when a new Bulwark account is created.

  Data: Organisation name, sign-up email address, chosen plan, and the answers given at sign-up.

  Location: We will confirm the region on request.

• Formspree

  Purpose: Backup delivery of contact form submissions, used only if our email delivery fails.

  Data: The contents of the contact form: name, email address, company, service of interest and message.

  Location: We will confirm the region on request.

• Zoho (Zoho Mail)

  Purpose: Our company email. Messages you send us, and contact form submissions delivered to us by email, are held in our mailbox.

  Data: Your name, email address and anything you include in your message.

  Location: We will confirm the region on request.

  Privacy information: https://www.zoho.com/privacy.html

If you connect Bulwark to services you choose and control, such as your own Slack workspace, PagerDuty, SIEM tools or webhooks, data you send to them is handled under your own arrangements with those providers.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure.

8. Data Retention

• Contact form submissions: the website does not store them. When you submit the form, the website sends your submission to us as an email; if that fails, it passes the submission to Formspree for delivery instead. To limit abuse, the website briefly holds your IP address in memory to count requests, for no more than about a minute. The email itself is kept in our company mailbox for as long as we need it to deal with your enquiry and any follow-up. You can ask us to delete it at any time.
• Bulwark account data: kept while your account is active. When an account or organisation is closed, we delete it as described in our Terms of Service. Backup copies are removed as our backup cycle rotates.
• Billing records: kept for as long as the law requires for tax and accounting purposes.
• Other personal information: kept only as long as necessary for the purpose we collected it for, unless the law requires a longer period.

9. International Data Transfers

Some of the providers in section 6 may process personal data outside the UK. Where personal data is transferred outside the UK, we will make sure the transfer is permitted under UK data protection law. You can ask us for details of any transfer by emailing info@bastionshieldtechnologies.com.

10. Your Rights

Under UK data protection law, and the EU GDPR where it applies to you, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your data where we have no lawful basis to retain it
• Right to restrict processing: Request that we limit how we use your data in certain circumstances
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent
• Right to complain: Lodge a complaint with the Information Commissioner's Office (ICO) in the UK, or your local data protection authority

To exercise any of these rights, email info@bastionshieldtechnologies.com or call +44 7387 746588. We will respond within one month. If your data is held in a Bulwark workspace that your organisation controls, we may refer your request to your organisation and help it respond.

11. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the new version on this page and update the "Last updated" date.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Bastion Shield Technologies Ltd
Registered in England and Wales, company number 17105460.
Registered office as shown on the Companies House register.
Email: info@bastionshieldtechnologies.com