Information you choose to provide
The enquiry form may collect your name, work email, company, product URL, requested service, deadline, reason for testing, any draft scope brief you attach, and the context you add. Please don't send passwords, access tokens, customer data, vulnerability details, or confidential architecture through this form.
Scope planner storage
The scope planner runs in your browser. It saves draft answers on your device under balhence_scope_builder_v1 so you can come back to them. Using it does not send your answers to Balhence. If you continue to the contact page, your generated brief passes through session storage under balhence_scope_brief_v1 and expires after two hours. It is sent only if you submit the contact form.
To remove saved answers, use the planner's reset control or clear this site's browser storage. Storage belongs to the browser profile, not a user account. Avoid sensitive planning on a shared device, and never enter credentials, tokens, customer records, or confidential architecture.
How the information is used
We use enquiry details to reply, check whether the project fits, prepare for scoping, and write a proposal if you request one. We also keep a record of the conversation and use information to protect the form from abuse. We don't sell it or use it to build advertising profiles.
AI-assisted engagement work
Approved AI assistance may help with limited testing tasks: checking scope references, developing questions to investigate, organizing sanitized material, or reviewing report quality. The signed engagement agreement says whether AI use is allowed, for which purposes and data types, and with what provider and retention restrictions. We don't submit client credentials, active tokens, customer records, source code, or unredacted vulnerability evidence to a public AI service unless the client explicitly approves the provider, purpose, and processing terms.
AI output needs checking before it can support a finding. People control live test actions, exploit validation, impact and severity judgments, reports, and re-test decisions. Read more about how we use AI in penetration testing.
Form processing
The enquiry form is processed by Formspree. When you submit it, the form contents, campaign tags present in the page URL, the same-site referring path or cross-site referring origin, and technical information needed to deliver the message are transmitted to that service. A fixed page label, such as web-pentest or field-notes, may be included to tell us which enquiry link you used. That label does not create a tracking cookie or a stored browsing history. Query strings and fragments are removed from the referral value. Review Formspree's privacy policy before submitting if you need more detail about that processing. You can avoid the form and email contact@balhence.com directly.
Analytics choice
The animated backgrounds follow your device's reduced-motion preference. They stop when their area is offscreen or the page is hidden. The site does not save an animation preference.
Google Analytics is configured on eligible informational pages to understand page visits and clicks on links such as pentest enquiries and sample reports. An enquiry-link click is not proof that a form was submitted. Analytics is not loaded on the scope planner, contact form, or this privacy page. On eligible pages, its script is not loaded unless you choose "Accept" in the analytics notice. Your choice is stored in your browser as balhence_analytics_consent. Choosing "Decline" prevents the analytics script from loading.
Use Analytics preferences below or in the footer to change your choice at any time. Declining stops further analytics collection and removes this site's analytics cookies without deleting your planner answers. If analytics is accepted, Google processes usage information under its own terms and privacy controls.
Legal basis and retention
Information supplied with an enquiry is processed to take steps you request before a possible contract and for the legitimate purpose of responding to business enquiries and preventing abuse. Optional analytics is based on your choice. Enquiry records are kept only as long as reasonably needed for the conversation, related legal or security needs, and ordinary business recordkeeping, then deleted or de-identified.
Sharing and international processing
Information may be handled by service providers needed to operate email, forms, hosting, or analytics. Those providers may process data in other countries. Information may also be disclosed when legally required or necessary to protect rights, safety, and service integrity. Balhence does not publish client or prospect information without permission.
Your choices and requests
You can ask what enquiry information we hold about you, request a correction or deletion, change your analytics choice, or ask us not to contact you again. We may need to keep some records if required by law or an active contractual dispute.
Security
Reasonable administrative and technical safeguards are used for website enquiries, but no internet transmission is risk-free. Sensitive engagement data, credentials, evidence, and reports use separately agreed delivery and retention controls rather than this public form.
Contact
Send privacy questions or requests to contact@balhence.com with "Privacy request" in the subject line.