Privacy Policy

CarbeneAI, LLC ("CarbeneAI," "we," "our," or "us") is a Texas limited liability company based in Austin, Texas. We run carbene.ai, kit.carbene.ai, cyberdefensetactics.com, and kit.cyberdefensetactics.com. Cyber Defense Tactics (CDT) is a practice of CarbeneAI, LLC, not a separate company. CarbeneAI, LLC is the parent company, and it is the business that collects your information, sells CDT products, and provides CDT services. This policy covers all four sites and the emails we send from them. It does not cover our client engagements, which are governed by the engagement agreement.

CarbeneAI, LLC, 5900 Balcones Dr #29361, Austin, TX 78731. Email contact@carbene.ai. Phone +1 (512) 270-0061.

Contact forms and license requests

When you use a contact form, request a scoping call, or request a Partner license, we collect your name, email address, company (optional), the subject you choose, and your message. We use it to reply to you. The form sends it to our mailbox as an email. We do not add you to a marketing list because you wrote to us.

Newsletter

If you subscribe to The Cyber Defense & AI Brief, we collect your email address. The newsletter platform (Buttondown) also records the IP address and signup details that come with the request, and sends a confirmation email. You are not subscribed until you confirm. Every email has an unsubscribe link.

Free kits

To get a free kit (the AI Cost Control Kit or the AI Tabletop Exercise Kit), you give us your email address. We add it to our email list through Buttondown, with a tag for that kit, and Buttondown records the signup IP address. Signing up for a Cyber Defense Tactics kit also subscribes you to The Cyber Defense & AI Brief. After you confirm, we email you a personal download link.

To make that link work, we keep a short-lived record in a Vercel Redis database: a random link ID, the expiry, a download count, and a marker tied to your email address that stops us sending you the same link twice. The link expires after 7 days and works for a limited number of downloads (5). The kit file itself sits in private Vercel Blob storage and is served only through a valid link. The email is sent through Resend.

When you buy a paid kit, we keep delivery records for your order: the order ID, when the download email was sent, and for each download the time, IP address, and browser (user agent). We use them to confirm delivery, prevent fraud and misuse of license links, and answer billing disputes.

Purchases

Paid products are paid for through Stripe. Stripe collects your card or other payment details, billing details, and the order information we ask for (such as your name, company name, and email). Card data goes to Stripe. We do not receive or store your full card number. We receive order details from Stripe, such as your name, email, company, billing address, what you bought, the amount, and the payment status. We use the buyer and company name to prepare your license and to stamp the files you buy with the name of the licensed organization. We deliver the files by email. Stripe's handling of your data is covered by Stripe's privacy policy.

Automatically collected information

Our sites use Google Analytics 4 to count visits and see which pages are useful. Google Analytics sets cookies and collects information such as your IP address, device and browser details, approximate location, the pages you visit, and the site that referred you. Our hosting provider (Vercel) also keeps standard server logs, including IP address and user agent. We use IP addresses for abuse prevention and rate limiting on our forms. We do not run advertising on our sites.

You can block or delete cookies in your browser settings, or install Google's Analytics opt-out add-on. The sites work without analytics cookies.

• Reply to your messages and requests
• Send the kit, newsletter, or product you asked for
• Take payment, issue and stamp licenses, and keep records of orders
• Understand which pages and resources are useful, and improve the sites
• Keep the sites and forms secure and prevent abuse
• Meet legal, tax, and accounting obligations

If you are in a place that requires a legal basis for processing, ours are: your consent (newsletter and kit signups), performing a contract with you (orders and licenses), our legitimate interests (running and securing the sites, replying to inquiries, basic analytics), and legal obligations.

We do not sell your personal information. We share it only with service providers that help us run the sites, and only for that purpose:

• Vercel: website hosting, the Redis database for download links, and Blob file storage
• Resend: sends the kit download emails and delivers contact-form messages to our mailboxes
• Buttondown: manages the newsletter and kit email lists
• Stripe: processes payments
• Google: Google Analytics
• Our email provider, which holds the mailboxes that receive your messages

We may also disclose information if the law requires it, to protect our rights or the safety of others, to our lawyers and accountants, or as part of a sale or reorganization of the business. We do not use your personal information to show you targeted advertising.

• Contact and license messages: as long as needed to handle your request and keep a reasonable business record, then deleted on request or when no longer needed.
• Newsletter and kit subscriptions: until you unsubscribe or ask us to delete your record. Buttondown may keep minimal records, as its own policy describes.
• Download-link records: they expire on their own after 7 days.
• Paid-order delivery records (download time, IP address, and browser): 12 months, then deleted.
• Order and license records: as long as tax, accounting, and legal rules require, and to support the license you bought.
• Analytics: for the period configured in our Google Analytics account.

The sites are served over HTTPS. Kit files are stored privately and released only through signed, expiring, limited-use links. Our forms use rate limiting and spam traps. Card data is handled by Stripe and not stored by us. No system is perfectly secure, and we cannot guarantee absolute security.

Depending on where you live (for example Texas, California, or the EU and UK), you may have the right to:

• Know what personal information we hold about you and get a copy
• Correct information that is wrong
• Delete your information, subject to records we must keep
• Opt out of marketing email (use the unsubscribe link in any email)
• Object to or limit certain processing, and receive your data in a portable format

To use any of these, email contact@carbene.ai from the address we have on file, or write to us at the address above. We respond within 45 days. If we decline a request, you may reply to ask us to reconsider. We do not discriminate against anyone for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising.

We are based in the United States, and our providers process information in the United States and other countries where they operate. By using the sites you understand your information may be transferred there.

Our sites and products are for business use and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you think we have, write to us and we will delete it.

Our sites link to other sites, such as GitHub, LinkedIn, YouTube, MITRE, NIST, and OWASP. We are not responsible for their privacy practices.

If we change this policy we will post the new version here and update the date at the top. If a change is significant we will say so on the sites or by email to subscribers.

Questions, requests, and purchase or download help: contact@carbene.ai, or the contact page. Cyber Defense Tactics is a practice of CarbeneAI, LLC, and inquiries for that practice use the same address.

CarbeneAI, LLC, 5900 Balcones Dr #29361, Austin, TX 78731. +1 (512) 270-0061.