Last updated: November 12, 2026
Lightwork Security & GRC (“we”, “us”) respects your privacy. This policy explains what personal information we collect through this website, how we use it, and your choices.
Who we are
This website is run by Lightwork Security & GRC (LLC in formation), based in the United States, which is the controller for the personal information described here. Contact: privacy@lightworksecurity.com. We will add the postal address once the company is registered.
Information we collect
- Information you give us: when you submit a contact form, book a consultation, request a readiness assessment report or subscribe to our newsletter, we collect your name, email address, company, role and any details you choose to share.
- Usage information: we measure visits with Umami, an analytics tool we host ourselves. It uses no cookies, does not track you across sites and does not store your IP address. It records pages viewed, referring sites, country, device type and actions such as starting the readiness assessment, opening the chat or downloading a file. If your browser sends a Do Not Track signal, nothing is recorded.
- Company networks: when you load a page, our own server checks which organization owns the network your connection comes from, using a public registry table we keep on that server. If it is a company or institution network rather than a home, mobile, VPN or cloud provider, we attach that organization’s name to your visit. Your IP address is used for this lookup in memory only and is not stored or shared with anyone. Legal basis: our legitimate interest in knowing which organizations take an interest in our services (Art. 6(1)(f) GDPR). You can object at any time by emailing us, or by turning on Do Not Track.
- Linking visits to enquiries: when you submit the readiness assessment, the contact or newsletter form, or a workspace sign-in request, we attach to your website visit a reference derived from your email address, the company you entered and the name of the form. This shows us which pages you looked at before getting in touch. Your email address itself is not stored in our analytics. Legal basis: Art. 6(1)(f) GDPR; you can ask us to remove this link at any time.
- AI assistant: if you use the “Ask Lightwork” chat, your questions and the conversation are sent to Anthropic, our AI provider in the United States, to generate an answer. We don’t store the content of your questions; we only keep anonymous usage counts. Please don’t enter confidential or personal information in the chat.
Workspace accounts
If you create a workspace, we store your email address, the workspace name, the names and emails of members you invite, the tool states you save (control statuses, Statements of Applicability, risk registers, audit rehearsal reports, questionnaire drafts, AI system records) and who last changed them. Sign-in uses one-time email links; we keep no passwords. Sign-in links expire after 20 minutes and sessions after 90 days. Data stays until you delete your account; when the last member leaves, the workspace and everything in it is deleted. You can export everything from the workspace page at any time.
Trust pages and document requests
If a workspace publishes a trust page, the information on it is public by design. When someone requests documents through a trust page, we store their name, email, company, message, the documents requested, the time they accepted the confidentiality terms and their IP address, and we email the request to the workspace members and the decision to the requester. The workspace that owns the page decides on the request and is responsible for the documents it shares; we host the page and the request record only. Requesters can ask us or the workspace to delete a request.
Tools
The questionnaire helper, bulk questionnaire drafting and audit simulator send the text you enter to Anthropic (United States) to generate answers, in the same way as the chat. The policy generator, AI system register and Statement of Applicability export send your form entries to our server, which builds the document in memory and returns it; nothing is written to storage except a count. The GitHub spot check sends your token from your browser directly to api.github.com and never to us. The readiness assessment adds one anonymous row to our benchmarks per completed run: company size band, AI use and scores, with no answers, email or company name.
Service providers
We use Hostinger for hosting and for our own servers that run the workspace, assistant and tools, Apple (iCloud Mail) for email, Cal.com for scheduling and video calls, Anthropic for AI answers, and GitHub only when you choose to run the spot check.
How we use it
- To respond to inquiries and provide our services
- To send the newsletter you subscribed to (you can unsubscribe at any time)
- To improve and secure this website
- To comply with legal obligations
Sharing
We do not sell your personal information. We share it only with service providers that help us run this website and our business (such as hosting, email and scheduling providers), under appropriate confidentiality and security obligations, or when required by law.
International transfers
We are based in the United States, and our providers Apple, Cal.com and Anthropic process data there. If you contact us or use the AI tools from the EU or the UK, your information is transferred to and processed in the United States.
Retention
We keep personal information only as long as needed for the purposes above or as required by law, then delete or anonymize it. Workspace data stays until you delete it, as described above. Newsletter addresses are kept until you unsubscribe or ask us to remove them. Inquiries and the correspondence that follows are kept while we are in contact with you, and you can ask us to delete them at any time.
Your rights
Depending on where you live, you may have the right to access, correct, delete or restrict use of your personal information, or to object to certain processing. To make a request, email privacy@lightworksecurity.com or use our contact page.
If you are in the EU or the UK, you can also complain to your local data protection authority.
Security
We protect personal information with administrative, technical and physical safeguards, including encryption and access controls. See our Trust Center.
Changes
We may update this policy from time to time. The date above shows when it was last changed.