Your information.
Your choices.

SECTION 01

Who we are & when this policy applies

Diamond Bright LLC operates Diamond Bright CyberGuard and diamondguards.com. This policy explains personal information handling for our website, inquiries, purchases, client accounts, assessments, reports, and related support. Contact [email protected] or (618) 936-8308 with a privacy question or request.

For website visitors, account administration, and billing, we determine the relevant processing purposes. When we process information within a client’s authorized environment, the client may determine those purposes and we may act as a service provider or processor under the engagement. A signed data-processing or business associate agreement governs its specific subject matter. This notice does not itself create such an agreement.

SECTION 02

Information categories & sources

Depending on the service and information supplied, we collect the following categories:

Do not submit information you lack authority to share. Public forms and chat are not intended for patient records, biometric identifiers, government ID numbers, full payment-card data, passwords, secret keys, or raw production data.

SECTION 03

How we use information

• Respond to inquiries, schedule appointments, establish accounts, and provide support.
• Verify client authority and scope, perform requested assessments, prepare reports, and deliver purchased services.
• Process orders, coordinate shipping, issue invoices, verify payments, and resolve billing issues.
• Protect accounts, prevent misuse, investigate security events, maintain audit evidence, and troubleshoot reliability.
• Operate optional website analytics when allowed by your choice and improve the service using appropriate operational or aggregated insights.
• Send service communications and, where permitted, promotional communications with an opt-out.
• Meet legal obligations, resolve disputes, enforce agreements, and protect lawful rights.

We do not treat an assessment authorization as permission for unrelated marketing. Where a legal basis is required, it may be performing a contract or requested steps, consent, a legal obligation, or legitimate security and business interests subject to applicable rights and balancing requirements. Consent to optional processing can be withdrawn.

SECTION 04

Assessment data & confidentiality

Technical evidence can reveal sensitive details about a business, its devices, users, and security weaknesses. The permitted collection depends on the authorized service and scope. A standard scan is not blanket permission to copy business files or inspect unrelated communications.

We use client security material for the engagement, appropriate support, security, and related legal obligations. Access may be provided to authorized staff, designated client contacts, and providers supporting that work. Agree in advance on exceptional evidence collection, packet capture, remote access, or handling of regulated records. Public reporting samples should not be used to disclose identifiable client security material.

If your employer or another organization arranged the service, ask that organization about its instructions, notices, and privacy responsibilities. We will direct or assist requests concerning client-controlled records as appropriate to our role.

SECTION 05

Disclosures & service providers

We disclose information as needed for the stated purposes to providers supporting hosting, network delivery and security, payment processing, email, shipping, support, analytics, and AI-assisted features. Examples include Stripe for enabled card payments, Google Analytics for optional public-site measurement, and xAI for the public AI support assistant when enabled. The specific provider can depend on the service and configuration.

We may also disclose information to your authorized business representatives; professional advisers; authorities where legally required or appropriate to protect lawful rights; and parties involved in a business transfer, subject to applicable confidentiality and privacy obligations. We do not sell personal information for money. Analytics and other provider disclosures are described here rather than treated as no disclosure at all.

Some providers act under our instructions; others have independent responsibilities for activities such as fraud prevention, payment compliance, or their own services. Their privacy terms also apply to those activities. Contact us for provider or contractual information needed for a proposed engagement. We do not claim every provider stores data in one country.

SECTION 06

AI-assisted support & analysis

The public support assistant can send your question and recent conversation history to xAI to generate a response. Those messages may contain any personal or confidential information you enter. You can use the “Email a person” option or contact us directly instead of using the AI assistant.

Do not put passwords, keys, patient data, card information, or sensitive client evidence into public AI chat. AI replies may be inaccurate and are not a substitute for an agreed professional service. Provider retention and use are governed by the applicable service configuration and contract; this policy does not promise zero retention or no model training by every external provider.

Other automated or AI-assisted analysis may be used within a separately scoped service. Confirm permitted data, providers, and contractual protections before authorizing regulated or sensitive records for that use. We do not use the public assistant to make decisions with legal or similarly significant effects on your behalf.

SECTION 07

Cookies & your analytics choice

Essential technologies support authentication, form protection, fraud prevention, security, and functionality you request. Server logs and essential session processing are separate from optional Google Analytics. Browser storage may also remember cart selections and your privacy choice.

Our site-managed Google Analytics loader is off until you choose “Allow analytics.” You can select “Reject analytics” with the same ease and still use the site. This control enables our site-managed Google Analytics only on selected public information pages. Our shared analytics loader does not run it on login, checkout, order tracking, staff, or client-portal pages. If JavaScript or preference storage is unavailable, this site-managed analytics loader stays off.

Additional Cloudflare tracking: Cloudflare currently injects Google Tag Gateway and Zaraz separately from our website code. Those tools can load before or independently of the choice below and may send page URLs, device information, and usage events to Cloudflare or Google. Cloudflare also provides a performance beacon. The buttons here do not currently disable these edge-injected tools. Browser tracking protection or script blocking can limit them. We are reviewing that configuration; until corrected, this choice must not be understood as a site-wide tracking opt-out.

Your choice is saved in this browser for up to 180 days. Clearing browser storage or using another browser/device can require a new choice. Use Privacy choices to change it. Withdrawing permission stops our site-managed Google Analytics on a refreshed page and removes accessible first-party Google Analytics cookies; it does not recall information already sent to a provider.

When analytics is allowed, Google may receive connection information and usage events and use cookies or similar technologies. Our page-view configuration omits the URL query string and fragment and disables Google advertising signals and ad personalization. We do not load the general Google Tag Manager container through this shared loader. Third-party services you separately visit or use, such as a payment checkout, have their own cookie practices.

See Google’s Privacy Policy and Google Analytics opt-out information.

SECTION 08

Browser privacy signals

Our optional analytics control treats Global Privacy Control (GPC) and an enabled Do Not Track (DNT) signal as a request to keep our site-managed Google Analytics off, even if this browser previously allowed it. The separately injected Cloudflare tools described above are not controlled by this mechanism. The settings panel identifies when a signal is active. Essential service and security processing continues.

These controls apply to the analytics integration described here; they do not claim to control every independent provider or remove already-collected data. Where applicable law gives you a right to opt out of sale, sharing for cross-context advertising, targeted advertising, or certain profiling, you may also contact us to exercise that right. We evaluate the request under the law that applies to our activities and your location.

SECTION 09

Retention, deletion & backups

We keep information for the time reasonably needed for the relevant service and purpose, subject to contractual duties, legal obligations, security needs, and disputes. Different records have different needs:

• Account and support records support the relationship and resolution of open issues.
• Invoices, payment records, contracts, and authorization evidence may need to remain after an account closes for accounting, legal, or accountability purposes.
• Assessment evidence and reports support delivery, follow-up, agreed retention, and legitimate security or dispute needs.
• Technical logs and backups follow operational needs and applicable retention arrangements; deleting an active record does not instantly remove every backup copy.

Deletion requests are assessed against these needs, with retained information restricted to the purposes justifying retention. Ask us about a record category or agree a specific retention schedule before an engagement if your organization requires one. This policy does not promise a fixed deletion deadline or backup lifetime that has not been agreed and implemented.

SECTION 10

Safeguards & incident communication

We use safeguards such as access controls, authentication and session protections, and security logging appropriate to the service and information involved. No system, transmission, or storage method is completely secure. Use unique passwords, enable MFA where offered, keep recovery contacts current, and use agreed secure channels for evidence.

If we identify a security incident affecting personal information, we assess the facts and provide notifications required by applicable law and our contractual role. This policy does not promise one universal notification deadline for all incidents or jurisdictions. Report suspected account compromise or a privacy incident promptly through our contact details without emailing passwords or unnecessary sensitive records.

SECTION 11

Your privacy rights & requests

Depending on your location, the applicable law, and our processing role, you may have rights to access or obtain a copy of information; correct or delete it; restrict or object to processing; withdraw consent; opt out of particular uses or disclosures; or complain to a privacy regulator. Applicable exceptions and eligibility conditions may limit a particular request.

Submit a request: email [email protected] with “Privacy request,” the account email or business involved, the type of request, and enough context to locate the records. You can also call (618) 936-8308. Do not send a password or identity document unless a secure, necessary verification process has been arranged.

We may verify identity and authority in proportion to the request, including an authorized agent’s permission. We respond within applicable legal deadlines and explain relevant exceptions or necessary extensions. If a request is denied, contact the same address with “Privacy appeal” so the decision can be reviewed where that right applies. We will not unlawfully discriminate or retaliate for exercising a privacy right.

If records are controlled by your employer or another client, we may refer the request to that organization or assist it under our agreement. General privacy rights are not a means to obtain another client’s confidential information.

SECTION 12

Service messages & marketing

We may send account, security, delivery, billing, and support communications necessary for the relationship. You can opt out of promotional email through the message’s unsubscribe option where offered, by replying with an opt-out request, or by contacting us. Promotional opt-out does not stop essential service communications.

Providing a phone number for service contact is not blanket consent to automated marketing calls or texts. Where a campaign requires separate consent, its terms and opt-out instructions must be provided in that context.

SECTION 13

International processing

We primarily serve U.S. businesses, but infrastructure and service providers may process information in the United States and other countries. Those countries may provide different protections from your home jurisdiction.

If transfer restrictions apply, the required lawful transfer mechanism and contractual safeguards must be addressed for the engagement. Visiting this website is not blanket consent to a restricted international transfer, and this policy does not claim a particular certification, adequacy status, or signed transfer agreement that has not been established.

SECTION 14

Adults & sensitive records

The Services are intended for businesses and authorized adult representatives, not for children under 13. We do not knowingly solicit personal information directly from children through the public website. Contact us if you believe a child has submitted information so we can investigate and take appropriate action.

A business engagement involving children’s, health, financial, biometric, or other regulated information requires appropriate scope, authority, safeguards, and any necessary contract. A child’s or patient’s data does not become unrestricted merely because a business provided it.

SECTION 15

Policy changes & contact

This policy is version 2026-09-26. Material changes will be identified here and communicated when required. We obtain any additional consent required for a new purpose rather than treating continued use alone as consent. Existing contractual protections and mandatory rights remain applicable.

Diamond Bright LLC · Diamond Bright CyberGuard
[email protected]
(618) 936-8308
diamondguards.com

Request our current legal mailing address if you need to send a formal postal notice.