Privacy

Scope

This policy explains how Sophrono handles information from the Custos by Sophrono website: its forms, the Super Intelligence Newsletter, and scheduling. Custos is a service of Sophrono.

Professional engagements have separate agreements and data-handling instructions.

Information you provide

A form may ask for your name, work email, company, role, staff count, what you are concerned about, a description of the AI tools or system involved, and a message. Please do not send credentials or vulnerability details through a form.

The shadow AI check scores your answers in your browser. If you ask for the result by email, only your answer codes, first name, and email are sent.

Each form also sends its form name, the page it was on, the page address, and the submission time. Please leave confidential records and credentials out of website forms.

What each form asks for

Each form asks only for what its request needs. Fields marked optional can be left blank.

The shadow AI check result by email: work email. Optional: name.

The free call with a security engineer: name, work email, company, what you are concerned about, and what prompted the question.

The Shadow AI Review: name, work email, company, your role, staff count, and the most sensitive data your staff handle.

The contact form: name, work email, and your message. Optional: company and the topic.

Service requests: name, work email, company, your role, and a description of what you need, plus two questions about the service.

The Super Intelligence Newsletter: work email. Optional: topics of interest.

Follow-up emails

Two requests start a short series of follow-up emails about the thing you asked for: the shadow AI check result by email, and the free call with a security engineer. Each form says so before you send it.

Every follow-up says why you are receiving it and carries a link that ends all follow-ups to your address with one click. Requesting a paid service ends the follow-ups that were leading to it.

To run the series, Cloudflare keeps your email, first name, the request that started it, which emails were sent, and the campaign tags described below. If you end follow-ups, we keep your address on a do-not-send list so we can honor that choice.

Information sent with a form

With each form, the site sends the first page you opened on this visit, the website that referred you, and any campaign tags and ad click IDs (from Google, LinkedIn, Meta, or Microsoft) in the link you followed.

Our hosting provider adds the country your connection comes from. We use this context to understand which pages lead to requests.

How requests are processed

Website forms are live. Each submission goes to the site’s own request handler, hosted on Cloudflare, which emails it to the Sophrono team through Google Workspace.

The handler also emails you a receipt of what you sent. It keeps no separate copy of the submission: the team’s copy is the notification email in Google Workspace.

We use the information to respond, provide what you requested, hold the calls you book, and keep records for security and legal obligations.

Newsletter choices

Requests and downloads do not subscribe you to anything. Each form offers a separate, optional newsletter checkbox, which starts unticked.

You join the Super Intelligence Newsletter only by ticking that box or using a subscription form. Every issue and signup receipt includes an unsubscribe link, and you can also reply to ask us to remove you.

Browser storage and tracking

The site uses no cookies of its own and no advertising scripts.

Cloudflare Web Analytics, run by our host, counts page views, referring sites, browsers, countries, and page-load times. Cloudflare describes it as using no cookies or local storage to identify visitors. We see totals, not individual visitors.

Session storage in your browser holds the first page, referrer, campaign tags, and ad click IDs of this visit. They leave your browser only with a form you submit, and clear when you close the tab.

Session storage also holds the type of request you sent, so the confirmation page can show the right message. It holds no form answers.

Booking a call

After a call request, the confirmation page and email offer a booking link. Free calls are booked through Google Calendar appointment schedules, operated by Google. Shadow AI review kickoff calls are booked through Cal.com.

The details you enter on a booking page, usually your name, email, and chosen time, go to that provider and to Sophrono so we can hold the call.

Each provider operates its booking page under its own privacy terms. Opening a booking link does not complete a booking. Other external links are controlled by their operators.

Service providers

Cloudflare hosts the website, provides its page analytics, runs the request handler, and keeps the Super Intelligence Newsletter list in a Cloudflare D1 database. Cloudflare also keeps short-lived technical logs of the handler for troubleshooting.

Google Workspace (Gmail) sends form email and hosts Sophrono email, so notifications, receipts, and our replies are stored there. Google Calendar holds free-call bookings, and Cal.com holds kickoff call bookings.

Access is limited to the purposes for which each service is used. If we connect a customer-relationship or newsletter tool, this policy will name it before it receives submissions.

Sophrono handles website requests from Scottsdale, Arizona, in the United States. These providers run global networks, so information may be processed in other countries.

Sophrono does not sell personal information.

Retention

Form submissions are kept for the purpose of the request, follow-up, security, recordkeeping, and applicable legal requirements. Those records are the emails in Google Workspace; no separate copy is stored in Cloudflare.

While you are subscribed, the Super Intelligence Newsletter list keeps your email, the topics you chose, and where you signed up.

After you unsubscribe, we keep the address, the dates, and a record of each choice so we can honor it.

Your choices and requests

Depending on your location, applicable law may provide rights concerning access, correction, deletion, restriction, objection, portability, or information about processing.

Contact us with a privacy request. We may need to verify your identity before acting. Newsletter choices remain separate from replies to your requests.

Security

Safeguards depend on the processing services and access involved. We identify permitted data, access owners, and handling responsibilities before engagement work begins.

No online system offers absolute security. Avoid sending sensitive records through a website form.

Policy updates

This policy will be updated when the site, processing services, or requirements change. The effective date identifies the published revision.