Legal
Privacy Policy
This policy describes website intake and browsing data separately from security evidence processed under a grantee agreement.
Scope and responsibility
This policy covers the ArtOfTheHack informational website, its contact form, and its grant application. The website describes grant-funded cybersecurity services for eligible nonprofit organizations; it does not provide a public AI analysis service, paid checkout, or subscription account.
ArtOfTheHack is the name used on this website. The legal entity responsible for website personal information, its contact address, and any jurisdiction-specific privacy representative require owner confirmation. This policy does not assert registration status or compliance with a particular law.
Information you submit
- Contact inquiries: name, email, organization, role, phone, country, organization website, topic, subject, message, and the form's consent response, where supplied.
- Grant applications: contact and organization details, nonprofit status and registration reference, organization type, approximate user count, mission focus, populations served, security staffing and environment, existing systems, primary challenge, desired workflow, deployment or data-residency needs, requested grant tier, buyer profile, message, and consent response.
- Both forms transmit their page URL, form label, and a CAPTCHA verification token. A page URL may include query parameters; do not put sensitive information in links used to submit a form.
- Do not include beneficiary identities, credentials, regulated records, classified material, or sensitive operational details. The forms are not a secure incident-evidence upload channel.
Purposes and submission recipients
Contact details and messages support responding to inquiries. Application details support eligibility review, grant coordination, and planning the requested cybersecurity workflow. Grant funding is described as funded by James Scott and administered by the Embassy Row Project.
Both forms send the entered information and verification token to the submission service at cbackend.jamesscott.tech. Grant applications also attempt to store an application record in Lovable Cloud. These are separate operations, so a record may reach one recipient even if the other operation fails.
CAP.js is loaded from jsDelivr and verification requests use captcha.jamesscott.tech. Those services receive the requests needed to load and complete the security check. Their operators, onward recipients, logging, and retention require confirmation. The grant administrator's involvement does not establish that every submitted field is automatically sent to it.
Browsing, external content, and diagnostic information
The website requests fonts from Google Fonts and includes an embedded YouTube video on the founder page. Fonts, embedded media, asset delivery, and hosting services can receive connection information such as IP address, browser details, and the requested address. External services apply their own policies.
The site's event code queues page paths and application-journey events in browser memory, without intentionally including form answers. This queue alone is not evidence that a third-party analytics service is enabled. Error logging and optional hosting error-reporting hooks are also present; the enabled recipients and retention have not been verified.
The Cookie and External Services Policy describes browser storage and external requests. No advertising-cookie or analytics-cookie deployment is asserted by this policy.
Retention, safeguards, and international processing
A verified retention schedule for inquiries, application records, verification logs, and diagnostics has not been supplied. No fixed deletion period, processing country, or international-transfer safeguard is asserted here. The owner must confirm those details and the service-provider agreements before treating this notice as legally finalized.
The configured form destinations use HTTPS. This alone does not verify recipients' access controls, encryption at rest, backups, or security compliance. Do not use public forms to transmit sensitive evidence.
Privacy requests and legal review
You may ask about access to, correction of, or deletion of information you submitted, or withdraw a consent you previously supplied. Use the contact page and identify the relevant submission without resending sensitive information. Verification of the request may be necessary. Applicable rights, exceptions, and response deadlines depend on the law that applies and must be confirmed by the responsible operator.
If relevant law gives you a right to complain to a data-protection authority, you may exercise that right. This notice does not identify an authority or governing jurisdiction without confirmation. The applicable legal bases for processing, sale or sharing practices, and any obligations concerning children must also be reviewed by the owner and legal adviser.
Grantee security evidence
Security evidence processed through an awarded KRYOS-XS overlay is separate from website intake. The website describes grantee ownership and contract-defined retention, regional processing, deletion, and key custody. Actual obligations, authorized data sources, roles, subprocessors, security measures, and transfer arrangements must be established in the applicable grantee agreement. The Trust Center is explanatory information, not a signed data-processing agreement.
Questions and requests
Use the existing contact page to ask about this statement or submit a request. Include the relevant page and enough context to explain your request, but do not include sensitive records or credentials.
Do not submit credentials, passwords, classified information, regulated records, security keys, exploit details, beneficiary identities, or other sensitive operational information through this public form.