Privacy policy
What we collect on our websites, why we collect it, and how to tell us to stop.
Effective September 21, 2026
This policy covers bluesteelcyber.com and bluesteelai.com. Both are operated by BlueSteel Cybersecurity. The two sites share a single customer relationship management system and a single analytics property, so if you visit both, your activity may be associated with one record.
Who is responsible
BlueSteel Cybersecurity
8017 Dorsey Run Road, Suite E
Jessup, MD 20794
(301) 531-4254
privacy@bluesteelcyber.com
For privacy questions or to exercise any right described below, write to the address above. We answer privacy requests within 30 days, or 45 days where the law allows an extension and we tell you why.
What we collect
Information you give us
When you submit a contact form, request an assessment or book a call, we collect what you type: typically your name, email address, phone number, company, and the content of your message. Meeting bookings are handled by HubSpot Meetings, which also records the time you chose and any details you add.
Information collected automatically
When you browse either site, we and our providers may record your IP address, approximate location derived from it, browser and device type, operating system, the page that referred you, the pages you view, and how long you spend on them. This happens through cookies and similar technologies described next.
We do not ask for and do not want sensitive personal information through these websites. Please do not put client data, protected health information, controlled unclassified information or anything similar into a web form. If an engagement requires that material, we will arrange a protected channel.
Cookies and similar technologies
- Strictly necessary. Set by BlueSteel and Cloudflare to serve the site, balance load and block abuse. These cannot be switched off and do not require consent.
- Analytics. Google Analytics 4, measurement ID G-R6443QZDCP, shared across both sites. Counts visits and shows which pages are useful.
- Marketing and functional. HubSpot, including the cookies hubspotutk, __hstc, __hssc and __hssrc. Recognises returning visitors and connects a form submission to the pages that led to it.
- Embedded third-party content. The Clutch review widget and web fonts served by Google. These providers may see your IP address.
Where the law requires consent, non-essential cookies are set only after you accept them in our cookie banner. You can change or withdraw that choice at any time by reopening the banner from the link in the footer. Most browsers also let you block or delete cookies directly, though parts of the site may then behave oddly.
Why we use this information
- To answer your enquiry and schedule conversations you ask for.
- To provide, secure and improve the websites.
- To understand which content brings people to us, so we write more of what helps and less of what does not.
- To send you material you asked for, and to follow up on a request. You can opt out of marketing messages at any time using the unsubscribe link or by writing to us.
- To meet our legal, tax and contractual obligations.
If you are in the United Kingdom or the European Economic Area, our legal bases are: consent for analytics and marketing cookies and for marketing email; steps taken at your request before entering a contract when you ask us to get in touch; legitimate interests in running and securing our own websites and understanding how they perform; and legal obligation where a law requires us to keep something.
Who we share it with
We do not sell your personal information for money. We share it with service providers who process it on our instructions:
- HubSpot, for our customer relationship management system, forms, meeting scheduling and website analytics.
- Google, for Google Analytics and web fonts.
- Cloudflare, which hosts and protects both websites.
- Clutch, whose review widget appears on bluesteelcyber.com.
We may also disclose information if the law requires it, to protect our rights or someone's safety, or to a buyer if the business is sold. Any such buyer would be bound by this policy until it tells you otherwise.
Some advertising and analytics cookies may count as sharing for cross-context behavioural advertising under California law even though no money changes hands. Declining non-essential cookies in our banner, or using a Global Privacy Control signal, opts you out.
Where the information goes
We are based in the United States and our providers process data in the United States. If you contact us from outside the United States, your information will be transferred there. Where that transfer is from the United Kingdom or the European Economic Area, our providers rely on the European Commission's standard contractual clauses or an equivalent approved mechanism.
How long we keep it
We keep personal information for as long as it is needed for the purposes described here, and then delete or anonymise it. Enquiries that do not become engagements are reviewed periodically and removed when they no longer serve a purpose. Records we must keep for legal, tax or contractual reasons are kept for the period the relevant law requires.
How we protect it
Both sites are served over HTTPS with a content security policy and strict transport security. Access to our customer relationship management system is restricted and authenticated. No website is perfectly secure, and we do not claim otherwise, but we treat our own infrastructure the way we advise clients to treat theirs.
Your rights
United Kingdom and European Economic Area
You have the right to access your personal data, to have it corrected or erased, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent at any time without affecting what we did before you withdrew it. You may also complain to your national supervisory authority.
California
You have the right to know what we collect and why, to obtain a copy, to have it corrected or deleted, to opt out of sale or sharing, and to limit the use of sensitive personal information. We will not treat you differently for exercising any of these rights. You may use an authorised agent, and we may ask that agent to prove you authorised them.
Other states and countries
Several other jurisdictions grant similar rights. If you have one, we will honour it. Write to privacy@bluesteelcyber.com and say what you want; you do not need to name the statute.
Children
These websites are for business audiences and are not directed at children under 16. We do not knowingly collect information from them. If you believe a child has given us information, tell us and we will delete it.
Links to other sites
Our sites link to other organisations, including LinkedIn, Clutch and the United States federal agencies whose frameworks we write about. We are not responsible for their privacy practices. Read their policies before giving them anything.
Changes to this policy
When this policy changes we update the effective date at the top. If a change materially affects your rights, we will say so more prominently than a date change.
Contact
BlueSteel Cybersecurity, 8017 Dorsey Run Road, Suite E, Jessup, MD 20794.
privacy@bluesteelcyber.com
or (301) 531-4254.