Skip to content
Breakthrough Security
Talk to our experts (opens in a new tab)

Privacy notice

This page explains what this site collects, where it is kept and who holds it.

Last updated: 14 October 2026

What happens when I book a call?

Booking opens on Google's page. Google stores your name, email, your answer to "How did you hear about us?" and the meeting time. Google keeps this data outside Saudi Arabia.

What happens when I send the contact form?

We store your name, email, company, message and your answer to "How did you hear about us?" in our site database. Company is optional. We need the other fields so we can reply. A copy goes to our team by email through Google Workspace, so Google also holds that copy outside Saudi Arabia.

What happens when I sign up for Strike updates?

We store your email, your language, the time you agreed and the version of this notice you saw. We send one email through Google Workspace to confirm the address. Updates start only after you confirm. When you confirm, our team gets one notice email with your email address, your language and the time, sent through Google Workspace. Every update email has an unsubscribe link, and one press on it stops the updates. You can also email us.

Why do some pages load a bot check?

The Contact and Strike pages have forms, so they load a bot check called gkCAPTCHA when the page opens. gkCAPTCHA is made by Gatekeeper, our sister company. It runs in your browser to tell people from bots. Your browser connects to Gatekeeper's server, which sees your IP address and browser details. Pages without a form do not load it. Gatekeeper's server is in Riyadh, Saudi Arabia. Your browser reaches it through a server in Frankfurt, Germany.

Do you count visits to this site?

Yes. We count visits with Umami, which runs on our own server in Riyadh and sets no cookies. For each visit it records the page, the page you came from, your device type, browser, operating system, screen size and language, your country, region and city, and how fast the page loaded. It links the pages of one visit into a session with a hashed code, not a cookie, and it does not store your IP address. It also counts three actions: booking clicks, sent contact forms and Strike signups. We delete page counts after 13 months.

What do your web servers record?

Our web server logs each request: IP address, browser details and page address. Visits first pass through our edge server at DigitalOcean in Frankfurt, Germany, which passes the encrypted traffic through. The log files rotate by size, so old entries are overwritten.

What does this site keep in my browser?

It sets one cookie, named "lang", only when you use the language switch. Your theme choice is saved in your browser and never sent to us.

Do you keep backups?

Yes. Each night we encrypt copies of our three databases and store them in one restricted Google Drive folder, outside Saudi Arabia.

Why do you use my data, and on what basis?

We use your data only for the reason you gave it, and not for any other purpose. Booking, the contact form and Strike updates rely on your consent: you choose to send the data. The bot check, web server logs, backups and page counts rely on our legitimate interest in keeping this site safe, working and improving. You can read this site without giving us any data. If you leave out a required field, we cannot reply to your message or send you updates.

How long do you keep my data?

We delete contact form messages after 24 months. We delete page counts after 13 months. We delete a Strike signup that is not confirmed within 30 days, and we delete a signup 30 days after you unsubscribe. Our mailing list keeps your email marked as unsubscribed, so we do not mail you again. We delete encrypted backups in Google Drive after 30 days and backups on our own server after 14 days. Web server logs are overwritten when the log files rotate. Booking data and the email copy of your message stay in our Google account until you ask us to delete them. Signup notice emails also stay in our Google account until you ask us to delete them.

Why does some data leave Saudi Arabia?

Some services we use run outside the Kingdom. Our edge server in Germany delivers this site to you and sees only your IP address and the encrypted connection. The bot check also reaches Gatekeeper's server through it. Google books your call, delivers our emails and holds our encrypted backups. Better Stack checks that the site is up and receives no personal data. We send each service only the data it needs for that job.

What are my rights?

You can ask what data we hold about you and why. You can ask for a copy in a clear, readable format. You can ask us to correct, complete or update it. You can ask us to delete it when we no longer need it. You can withdraw your consent at any time: use the unsubscribe link for Strike updates, or email us for anything else. Withdrawing consent does not change what we did before.

Is this page legal advice?

This page explains how we handle data in plain words. It is not a lawyer's opinion. If anything is unclear, email us.

Where does my data go and who holds it?

Each card shows one kind of data, the system that holds it, the country and the provider. Some data leaves the Kingdom.

  • Visits to this site: your IP address and the encrypted connection

    System
    Our edge server, which passes encrypted traffic through
    Country
    Germany (Frankfurt)
    Provider
    DigitalOcean

  • Web server logs: IP address, browser details and page address

    System
    Our web server
    Country
    Saudi Arabia (Riyadh)
    Provider
    Breakthrough Security (our own server)

  • Booking: name, email, how you heard about us and meeting time

    System
    Google Calendar appointment booking
    Country
    Outside Saudi Arabia
    Provider
    Google

  • Contact form: name, email, company, message and how you heard about us

    System
    Our site database
    Country
    Saudi Arabia (Riyadh)
    Provider
    Breakthrough Security (our own server)

  • Copy of your contact message emailed to our team

    System
    Google Workspace mail relay and Gmail
    Country
    Outside Saudi Arabia
    Provider
    Google

  • Strike updates signup: email, language, consent time and privacy notice version

    System
    Our site database and our mailing list (Listmonk)
    Country
    Saudi Arabia (Riyadh)
    Provider
    Breakthrough Security (our own server)

  • Strike signup confirmation email

    System
    Google Workspace mail relay
    Country
    Outside Saudi Arabia
    Provider
    Google

  • Page counts: pages viewed, referring page, device type, browser, operating system, screen size, language, country, region and city, page speed and a session code, with no cookies

    System
    Umami page counting
    Country
    Saudi Arabia (Riyadh)
    Provider
    Breakthrough Security (our own server)

  • Encrypted nightly backups of our three databases

    System
    Google Drive, one restricted folder
    Country
    Outside Saudi Arabia
    Provider
    Google

  • Language cookie (lang) and theme choice

    System
    Your browser
    Country
    Your device
    Provider
    None

  • Bot check on the contact and signup forms

    System
    Our site API and gkCAPTCHA
    Country
    Saudi Arabia (Riyadh), reached through Frankfurt, Germany
    Provider
    Gatekeeper (gkCAPTCHA)

  • Uptime checks, with no personal data

    System
    Hosted uptime monitor
    Country
    Outside Saudi Arabia
    Provider
    Better Stack

Who do I ask about my data?

Breakthrough Security collects this data and decides how it is used. Email hello@breakthrosec.com to ask what we hold about you, to use any of the rights above, or to ask any question about your data.