LEGAL
Privacy Policy
We use one analytics tool, we do not record your screen, and we never sell anything. Here is the detail.
The short version
- We use PostHog to see which pages work and where people get stuck
- No session recording. Nothing here records your screen or what you type
- In the EU, UK and Switzerland nothing loads until you say yes
- We only hold personal data you deliberately send us
- We never sell or rent personal data, and we never will
- Card payments are handled by Stripe — we never see your card details
1. Who is responsible
The Borderlands Group, Inc., incorporated in the District of Columbia, United States and operating from Kyiv and Washington, D.C., is the data controller for the information described here.
1101 3rd St SW, Ste 506
Washington, DC 20024
United States
[email protected]
2. What we collect
When you use the contact form. Your name, email address, company or organisation, the category you select, and whatever you write in the message. We use it to reply to you and to prepare for a first conversation. Our lawful basis is our legitimate interest in responding to business enquiries, and taking steps at your request before entering a contract.
Contact-form submissions are passed to GoHighLevel, our customer relationship system, so the enquiry reaches a person and nothing is lost. Nothing else is collected from that page.
When you email us directly. Whatever the email contains, plus the usual technical headers.
When you engage us. The materials you share for the Readiness Assessment — specifications, test data, financial and production information, and whatever your team tells us on the calls. These are held in confidence under our Terms of Service and processed to perform the contract.
When you pay. Stripe processes the payment and gives us the transaction record, your billing details, and, where collected, your business tax number. Card numbers never reach this website or our systems.
3. Analytics, and what we deliberately do not do
We use PostHog to understand which pages work and where people give up. It records the pages you visit, the links you click, roughly where in the world you are, and what kind of device and browser you used. It sets a cookie and uses local storage so it can tell one visit from two.
We do not record your screen. PostHog can replay sessions and we have switched that off deliberately, in code — so nothing on this site captures what you type, including anything typed into a form and then deleted. We also do not use heatmaps, fingerprinting, or any tool that follows you to other websites.
PostHog is loaded through this domain rather than from PostHog's own servers. That is so ad blockers do not silently break it, not so that anything is hidden from you — this page is the disclosure, and you can switch it off below.
Two other pieces of storage are not analytics and are not covered by the choice below, because they exist to deliver something you asked for: a note of your consent decision, so we stop asking; and, if you signed up for the talk, a reference that lets us send the right follow-up emails.
Your choice
In the EU, UK and Switzerland, nothing analytical loads until you choose. Everywhere else, analytics start on and you can turn them off here — including now, and including if you accepted earlier.
Declining changes nothing about how the site works. Forms, video, booking and checkout all behave identically.
If your browser sends a Global Privacy Control signal — Brave, DuckDuckGo and Firefox can — we treat that as a decline before you arrive. You will not see the banner and nothing analytical loads. Twelve US states now give that signal the same legal weight as clicking an opt-out link, and we honour it in all of them and everywhere else too. You can still override it for this site with the button above.
Selling and sharing, in the legal sense
We do not sell personal information. Nobody pays us for your data and we will never put a list up for sale. That is the plain-English answer and it will not change.
The legal answer needs one more sentence, because California defines the words differently to the way anyone speaks. Under the CCPA as amended, “sharing” means passing personal information to a third party for cross-context behavioural advertising — whether or not any money changes hands. Advertising pixels are the standard example.
Today this site runs no advertising pixels at all, so no sharing takes place under either definition. If that changes, this section and the banner change in the same deploy — they are driven by the same switch in the code, specifically so that one cannot move without the other.
Either way, the control is the same one: Your Privacy Choices, in the footer of every page.
4. Fonts, and the one third party
The site loads its typefaces from Google Fonts. That means your browser requests
files from fonts.googleapis.com and fonts.gstatic.com,
and Google will see your IP address and browser details as part of that request.
No cookie is set and we receive nothing from it.
Recommended change: self-host the fonts. It removes this third-party request entirely, makes the page load faster, and eliminates a transfer of visitor IP addresses to a US provider that some European visitors and their lawyers object to. It is a small piece of work and it would let this section be deleted.
5. Hosting and AI crawlers
The site is hosted on Cloudflare Pages. Cloudflare processes standard server logs, including IP addresses, for security and delivery.
Our robots.txt deliberately permits AI crawlers. This is a choice: we
want the company's published material to be findable through AI search. It affects
published pages only — nothing you send us privately is exposed to crawlers.
6. Who we share with
We do not sell, rent, or trade personal data. We share it only with service providers who process it on our behalf — Stripe for payments, Cloudflare for hosting, GoHighLevel, our customer relationship system, which receives contact-form and sign-up enquiries and runs our booking calendar, and PostHog for the analytics described above — and with professional advisers, or where the law requires it.
7. International transfers
We are a US company operating in Ukraine, so data you send us will be processed in the United States and in Ukraine, and by service providers who may process it elsewhere. Our PostHog project is hosted in the United States, so analytics data about EU and UK visitors — which is only collected after they agree to it — is transferred there. Where data moves out of the European Economic Area or the United Kingdom, we rely on appropriate safeguards such as standard contractual clauses.
8. How long we keep it
Enquiries that do not become engagements: up to twenty-four months, then deleted. Client materials and Readiness Reports: for the engagement and for as long as we need them afterwards for professional and legal reasons. Financial records: as long as tax and company law requires.
9. Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to how we use it, receive a portable copy, and withdraw consent where we relied on it.
If you are in the European Economic Area or the United Kingdom, you can also complain to your national data protection authority. If you are a California resident, you have rights under the CCPA — including to know and to delete — and we confirm we do not sell or share personal information as those terms are defined there.
To exercise any of this, email [email protected]. We respond within thirty days.
10. Security
The site is served over HTTPS. Client materials are held in access-controlled systems and shared internally on a need-to-know basis. No system is perfectly secure, and we will tell you promptly if a breach affects your data.
11. Children
This is a business-to-business service. It is not directed at children and we do not knowingly collect their data.
12. Changes
We will update this page when our practices change, and revise the date at the top.
This policy is a plain-language draft prepared for review, and describes the site as it is actually built. It has not yet been settled by counsel. Two items still need a decision: whether an EU representative is required given that European defence companies are a target audience, and confirmation of the entity's state of incorporation.