Privacy Policy

01Who we are

PowerSEC is a service operated by CinderEye LLC (“PowerSEC,” “we,” “us,” or “our”). Our registered address is 7901 4th St N, Ste 300, St. Petersburg, FL 33702. You can reach us at [email protected].

This Privacy Policy explains what information we collect when you use PowerSEC’s website, the PowerSEC WordPress plugin, and the PowerSEC Central dashboard (collectively, the “Service”) — how we use that information, and the choices you have.

02Information we collect

We collect the following categories of information. Each category includes only what’s needed to operate the Service.

03How we use information

We use the information we collect to:

• provide, operate, and improve the Service;
• authenticate users and protect accounts;
• perform security monitoring on connected sites and surface findings to you;
• execute remote actions, rule syncs, scans, and backups that you trigger;
• send service messages, alerts, and account notifications;
• send the blog newsletter to people who subscribed and confirmed, until they unsubscribe;
• process billing, invoicing, and subscription changes;
• detect, investigate, and prevent abuse, fraud, and security incidents;
• respond to support requests and feedback; and
• comply with legal obligations and enforce our Terms of Use.

04Cookies and local storage

We use a small number of strictly necessary cookies and browser local storage entries to keep you signed in, remember your preferences, and protect against abuse. On our public pages we also use Google Analytics and Microsoft Clarity to understand how visitors find and use the site; neither is loaded in the dashboard, admin, or sign-in pages.

Google Analytics sets cookies named _ga and _ga_* that count visits and pages viewed. Advertising features and Google signals are turned off. In the European Economic Area, the United Kingdom, and Switzerland, analytics cookies are off by default and Google receives only cookieless, aggregate signals. If your browser sends a Global Privacy Control signal, analytics stays off.

Microsoft Clarity records how visitors move through our public pages — clicks, scrolling, and page layout — as session replays and heatmaps, with the text people type into forms masked. It sets cookies named _clck and _clsk. We load it only for visitors outside the European Economic Area, the United Kingdom, and Switzerland, and never when we cannot tell where a visit comes from. You can turn off both tools for this browser here:

05Service providers we use

We rely on a small set of vendors to operate the Service. These providers receive only the information needed to perform their function and are bound by contractual obligations to protect it.

• Hosting and database. The PowerSEC Central application and its database run on dedicated servers in the United States and store account, site, and telemetry data.
• Network. Cloudflare carries all web traffic to and from powersec.io.
• Payments. Stripe, a PCI-compliant payment processor, handles subscription checkout and billing. PowerSEC receives plan and status information; full card data never reaches our servers.
• Email and notifications. Amazon Web Services (SES) delivers our transactional email — account messages, security alerts, and password resets.
• Website analytics. Google Analytics, a Google service, measures visits to our public pages: pages viewed, referring site, approximate location, and device type. It does not receive account, site, or dashboard data.
• Session replays and heatmaps. Microsoft Clarity records how visitors use our public pages (clicks, scrolling, page layout), with typed form text masked. It is not loaded in the dashboard, admin, or sign-in pages, or for visitors in the EEA, the UK, or Switzerland.
• Operational monitoring. Logging and error-reporting tooling helps us investigate issues and keep the Service reliable.
• Backup storage. By default your cloud backup archives are held by our managed cloud storage provider in a United States region, encrypted at rest by the provider and integrity-verified (SHA-256) after upload. You may optionally add your own storage bucket (Bring Your Own Storage).
• AI assistance. Google (Gemini) processes limited account context — your sites, vulnerabilities, alerts, and billing status — to generate plain-language explanations and power the in-app support assistant. Only the context needed to answer a request is sent. AI Advisory, when a site administrator opts in, sends Google a redacted excerpt of files the scanner already flagged; see Security for exactly what it sends.
• Sign-in. If you choose to sign in with Google, Google confirms your identity and shares your name and email address with us.
• Customer-configured storage. If you point PowerSEC at S3-compatible object storage for backups, that storage provider is your processor under your own agreement.

Need a Data Processing Agreement (DPA) or the full, up-to-date list of subprocessors — including our backup storage provider — for your due diligence? Email [email protected] and we’ll provide them.

06How information is shared

We do not sell personal information. We disclose information only:

• to service providers, as described above, under written agreements;
• to comply with applicable law, valid legal process, or lawful requests from public authorities;
• to enforce our Terms of Use or protect rights, property, or safety; and
• in connection with a corporate transaction such as a merger or acquisition, in which case we will require comparable privacy protections.

07Data retention

We keep account and site data for as long as your account is active or as needed to provide the Service. Specific data types are aged out on defined schedules, for example:

• Security alerts: retained ~180 days
• Email delivery logs: ~180 days
• Newsletter signups that are never confirmed: deleted after 7 days
• Unsubscribed newsletter addresses: we keep only a one-way hash of the address, for up to 12 months, so we do not email it again
• Shared free-scan reports: the link stops working 7 days after it is created and the report is deleted the next day; the delete link in the email removes it at once
• AI usage/audit events: ~90 days
• Capacity and security metrics: up to ~24 months
• Billing and growth records: ~365 days (billing records kept longer where required by tax and accounting law)
• Backup restore points: per your plan’s retention window; superseded copies are purged after a short grace period

When you delete your account, we remove or anonymize associated data within 30 days, except where retention is required by law or necessary to resolve disputes.

08Security measures

We use technical and organizational measures designed to protect the Service, including encryption in transit, access controls, signed plugin-to-Central communication, scoped API keys, and audit logging.

No system can be made completely secure. You are responsible for protecting your own account credentials, using strong passwords, keeping your WordPress sites updated, and following the security guidance we publish.

09Your rights and choices

Depending on your location, you may have rights to access, correct, delete, restrict, or port the personal information we hold about you, and to object to certain processing.

You can update most account information directly from PowerSEC Central. For other requests, email us at [email protected] from the address tied to your account. We may need to verify your identity before fulfilling a request and we will respond within the timelines required by applicable law.

Blog newsletter. We email you only after you confirm the link we send to your address, and only about new articles on the PowerSEC blog. Every newsletter email has a one-click unsubscribe link. After you unsubscribe we delete your address and keep only a one-way hash of it, so we do not email it again; subscribing again later starts a new confirmation. To have the hash removed as well, email [email protected].

10Children’s privacy

PowerSEC is intended for businesses, agencies, and adult site operators. The Service is not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

11International users

PowerSEC operates in the United States. If you access the Service from another country, you understand that your information will be processed in the United States and other locations where our service providers operate. We use appropriate safeguards to protect information transferred internationally.

12Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Effective date” above and, where appropriate, notify account holders by email or in-product message. Continued use of the Service after the changes take effect means you accept the updated policy.

13Contact us

Questions, requests, or complaints about this policy can be sent to [email protected], or by mail to: