Privacy

The short version

We use cookies and analytics to understand how people find and use this site, and we may use that information to show you our advertising elsewhere. If you fill in a form or book a meeting, we keep what you tell us so we can respond and maintain a record of our dealings with you.

If you pay us by card or bank account, the payment runs through Stripe, or through our older billing portal for clients who have not moved over yet. When you pay through Stripe, your full card and bank account numbers go straight to Stripe and are never stored in our own systems. Please never email or text them to us.

We do not sell your personal information to anyone. We do not share it with other organizations for their marketing.

You can decline analytics and marketing cookies when you first arrive, or change your mind later, and the site works exactly the same either way.

Cookies and similar technologies

These fall into three kinds.

Necessary. A record of your cookie choice, and anything required to make pages load and forms submit. These cannot be switched off and do not track you between websites.

Analytics. Google Analytics tells us which pages people read, how they arrived, and where they give up, which is how we decide what to write next. Google processes this on our behalf and sets cookies to do it. We also use Google Search Console, which reports how the site performs in search results and sets nothing on your device.

Marketing. HubSpot, our customer relationship management system, sets a cookie so that when someone gets in touch we can see which pages they read first. If we run advertising, platforms such as Google or LinkedIn may set cookies so we can show our ads to people who have visited this site and measure whether those ads worked.

Analytics and marketing cookies are not set until you agree to them. You can change your choice at any time from the cookie settings link in the footer.

Information you give us

If you complete a form, book a meeting, call, or email, we keep what you send: usually your name, company, email address, phone number, and whatever you tell us about your situation. It is stored in HubSpot and used to reply to you, prepare for a meeting, and keep a history of our correspondence.

If you arrived from an advertisement or a particular article, that context is attached to your record so we know which of our work is genuinely useful. It is held in your browser during your visit and sent only if you choose to contact us.

Card and bank details are handled differently, as described under Payments and billing below.

The self-assessment and the pricing calculator

Both run entirely in your browser. Your answers are not transmitted to us unless you explicitly choose to send them.

When you finish the self-assessment, your answers are encoded into the page address so you can bookmark the result or send it to a colleague. That address contains only your answers. It holds no name, no email, and nothing identifying you or your business.

Payments and billing

You can pay our invoices and service tickets by card or by bank account (ACH). We process payments through Stripe, Inc., a PCI-DSS Level 1 certified payment processor. Some clients still pay through our older billing portal while we move everyone to Stripe, as explained below.

How you can pay. Through a payment link we send by email or text message, through our client portal at stm.sentrycto.com/portal, in person with a card reader or a phone that accepts tap-to-pay, or by giving your card details to one of our staff, who enters them directly into Stripe's secure form.

Card and bank numbers go to Stripe. Your full card number, security code, and full bank account and routing numbers are entered into Stripe's own secure forms, pages, and card readers, and go straight to Stripe. When you enter them yourself, we never receive them. When one of our staff enters them for you, including over the phone, they go directly into Stripe's secure form, and we do not record phone calls. Either way, our systems never store them. Stripe handles everything you enter into its forms, pages, and card readers under its own privacy policy: https://stripe.com/privacy

Please never email or text us payment details. We never ask for them that way. If you send them anyway, we enter them into Stripe and delete your message. An email also leaves a copy in our ticketing system, which keeps a record of client correspondence, and we cannot remove that copy.

Linking a bank account. When you link a bank account, Stripe may verify it using a Stripe service called Financial Connections, which Stripe's privacy policy also covers.

Our older billing portal. Some clients still pay through our older billing portal, run by ConnectBooster, while we move everyone to Stripe. Payments made through that portal are processed by BNG Gateway and Paya.

Saved payment methods and autopay. You can choose to save a card or bank account for future payments, and you can turn on automatic payment of your invoices. We only save a payment method, or charge one automatically, when you have agreed to it. You can ask us to remove a saved method or turn off autopay at any time.

What we keep about a payment method saved through Stripe. Only these details:

• whether it is a card or a bank account
• the card brand, the last 4 digits, and the expiration month and year
• the bank's name
• the identifiers Stripe issues for you and for that payment method
• a record of when and how you agreed to save it

For a bank account, we also keep the ACH debit authorization details Stripe returns to us: when you accepted the authorization, and the IP address and browser information from that moment. U.S. banking rules set by Nacha require us to keep these records.

Records of payments. We keep a record of each payment and refund: the amount, the date, its status, and which invoice or ticket it paid. We also record payments against your invoices in QuickBooks Online, our accounting software from Intuit.

Payment messages. We send payment links, receipts, and billing notices by email through Microsoft 365. Payment links we send by text message go through Telnyx, our text-messaging provider.

We do not sell payment information, and we do not use it for advertising.

How long we keep payment records is covered under How long we keep it, below.

Who we share information with

Only the service providers that make this work, and only so they can provide that service to us: our website host, HubSpot, Google, and our email provider. They act on our instructions and may not use your information for their own purposes.

When you pay us, these companies also handle your information:

• Stripe, which processes card and bank payments. Stripe handles what you enter into its forms, pages, and card readers, including bank verification through Financial Connections, under its own privacy policy: https://stripe.com/privacy
• ConnectBooster, which runs our older billing portal while we move clients to Stripe, and BNG Gateway and Paya, which process the payments made through that portal.
• Intuit QuickBooks Online, our accounting software, where we record your payments against your invoices.
• Microsoft 365, our email service, which carries the payment links, receipts, and billing notices we email you.
• Telnyx, our text-messaging provider, which delivers any payment link we send you by text.

Text messages. We do not share mobile phone numbers, or text-messaging opt-in data and consent, with any third party or affiliate for marketing or promotional purposes. Telnyx and the mobile carriers receive your number only so our messages can be delivered.

We will also disclose information where the law requires it. Beyond that, nobody else sees it. We do not sell, rent, or trade personal information.

How long we keep it

Inquiries and correspondence are kept for as long as we have a relationship with you, and for a reasonable period afterwards in case you come back. Analytics data follows Google's standard retention schedule. If you ask us to delete your information we will, unless we are required to keep it.

We keep records of payments and refunds for seven years after the payment, to meet tax and accounting requirements. For bank (ACH) payments, we keep the record of your authorization for at least two years after that authorization ends or is revoked, as U.S. banking rules require. Because we are required to keep these records, a request to delete them has to wait until those periods end.

When our relationship with you ends, we turn off automatic payments and remove your saved cards and bank accounts, so they can no longer be charged. We keep a record that each payment method existed, such as the card brand and last 4 digits, along with your authorization, for the periods above. Stripe keeps its own records, as described in its privacy policy.

Hosting and security

This site is hosted by a third-party provider and served over an encrypted connection. Our host keeps standard server logs, including IP addresses and pages requested, used to operate the service and investigate abuse.

We are a cybersecurity company, and we hold our own systems to the standards we recommend to clients.

Embedded video

Some pages include video hosted on YouTube. Nothing is requested from YouTube and no cookies are set until you press play. After that, YouTube's own privacy policy applies to the playback.

Client data

This policy covers the website and the payments you make to us. Other information we hold while delivering managed services to a client is governed by the agreement with that client, which is a separate and considerably more detailed document. Payment and billing information follows this policy, including for clients with a managed services agreement.

Your choices and rights

You can ask us to:

• tell you what we hold about you
• correct anything that is wrong
• delete it
• remove a saved card or bank account, or turn off automatic payments
• stop sending you marketing, which you can also do from any email we send

Email [email protected] or call (928) 350-8069. We will not make you jump through hoops and we will not charge you.

Two things cannot be deleted on request: payment records we are required to keep, for the periods under How long we keep it, and the copy of any email you sent us containing payment details, which stays in our ticketing system.

Depending on where you live you may have further rights, including under the California Consumer Privacy Act. Because we do not sell or share personal information as those terms are defined there, there is nothing to opt out of, but the rights above apply to you regardless.

Children

This is a business website and is not directed at children. We do not knowingly collect information from anyone under 16.

Changes

If we change this policy we will update the date at the top. Material changes to how we handle information will be described rather than quietly absorbed.

Contact

Sentry CTO
Mailing address: 3623 Crossings Dr Ste 280, Prescott, AZ 86305
[email protected]
(928) 350-8069