Privacy policy
How SectraTEK handles personal information on this website, in the customer area and in the SectraTEK applications.
Version 1.0. Last updated October 21, 2026.
1. Who we are and what this policy covers
SectraTEK is a Prudential Associates company. SectraTEK is developed and distributed by Prudential Associates, and the SectraTEK website is operated by Prudential Associates & Cyber-Investigations Group ("Prudential Associates", "SectraTEK", "we" or "us"), 9200 Corporate Blvd, Suite 200, Rockville, MD 20850, United States.
This policy explains what personal information we collect, why we collect it, who receives it, how long we keep it, and what choices you have. It covers:
- our website, www.sectratek.com (the "Site"), including its forms, emails and privacy choices;
- the SectraTEK customer area (My Sectra) and customer support; and
- the usage and support information that the SectraTEK desktop applications send us (Section 9).
It does not cover the evidence you examine with SectraTEK. SectraTEK is designed so that evidence stays on your own workstation. Please never send evidence, case data or device extractions to us through the Site, My Sectra, a ticket or an email. If you do, tell us at once so that we can remove it.
2. At a glance
- We collect what our forms ask for, plus technical information when you visit the Site.
- We use it to answer you, to run demos and quotes, to support customers and to keep the Site secure.
- We do not sell personal information for money. Optional analytics and advertising technologies run only if you allow them, and advertising never runs while your browser sends a Global Privacy Control signal.
- You can ask to see, correct or delete your personal information, and you can change your privacy choices at any time (Sections 5 and 12).
- We keep information only as long as the Data Retention Schedule says.
3. Information we collect
3.1 Information you give us
We collect only what each form needs. No form asks for a government identifier, a date of birth, a payment card number or case data. A phone number is optional wherever it appears, and we never use it to sign you in.
| Form | What you give us | Why we use it |
|---|---|---|
| Schedule a demo | Your name, work email, organization, job title and organization type, and your country (with your state or province for the United States and Canada), type of demo, time zone, the time you choose, how you want to join, an optional phone number, and an optional note on what you want to see | To book and run the demo, send the confirmation, calendar file and reminders, and follow up |
| Request a quote | The same identity details, plus edition interest, offer, whether you want a tablet, number of seats, an optional band for devices per year, procurement method and timeframe, and an optional message | To prepare a quote and contact you about it |
| Contact | Name, work email, an optional phone number, whether you write for an organization or as an individual, organization and type, subject and message | To answer your message |
| Gated download | First and last name, work email, organization, organization type, and the document you asked for | To email you a single-use download link, and to keep a record of who received the document |
| Newsletter and status emails | Email address and the topics you choose | To send the emails you asked for after you confirm, and to honor your unsubscribe |
Please do not put case details or personal information about other people in a free-text field.
With every form we also keep: the version of the privacy consent text you accepted and the time; whether your browser sent a Global Privacy Control signal; any campaign reference carried in the page address (source, medium and campaign); the identifier of your cookie choice, if you made one; and your network address shortened to a prefix (the "/24" or "/48" form), which no longer identifies a single device.
Our team may check the details you give us, for example that an organization is genuine and eligible to buy, before we respond or sell. We may call a published number for the organization, or ask for proof that it exists. We keep the verification documents as the Data Retention Schedule says. We may decline a request.
3.2 Information collected automatically
- Server and delivery logs. The time of a request, the page, the response, your browser type and your network address. In our general logs the address is kept only as a prefix. A security log keeps the full address for a short time (see the Data Retention Schedule). We may also derive an approximate location, such as the country, from the address. We never use it to block a visit.
- Page performance measurements. Page speed and similar figures, sent back to our own servers. They carry no name, no email address and no identifier.
- Security and abuse protection on forms. A small computation run by your browser, a hidden field, a minimum time to fill the form, and rate limits. We operate all of them, and no outside service sees what you type into a form.
- Browser security reports. When your browser blocks a page from loading something, it can tell us the type of problem, the page path and a protected fingerprint of your network address.
- Your privacy choices (Section 5).
3.3 Information from your organization
If a colleague or an administrator of your organization invites you to My Sectra, we receive your name and work email from them. If you are a customer, we hold your organization's contacts, license and serial records, usage records, support tickets and download records.
3.4 Email and tickets
If you write to us, we keep your message, your contact details and our replies. Please do not attach case data.
3.5 Sensitive personal information
We do not ask for sensitive personal information on the Site, and we ask you not to send it. For customer accounts, the sign-in credentials you use are handled by our identity service provider, and we use them only to sign you in and to protect your account. We do not use them to infer anything about you.
4. How we use personal information
- To answer your messages and requests, and to run demos, prepare quotes and take orders.
- To verify organizations and buyers before we sell.
- To provide, license, support and secure SectraTEK and My Sectra, including the usage records described in Section 9.
- To send transactional emails (confirmations, reminders, download links and replies), and the newsletter and status emails if you subscribed.
- To keep the Site, our systems and our customers secure, and to detect and prevent abuse, fraud and misuse.
- To understand how our pages perform, using measurements that stay on our own servers.
- If you allow it, to measure which pages are useful and to measure and improve our marketing (Section 6).
- To meet legal obligations, to respond to lawful requests, and to establish or defend legal claims.
We do not use personal information from the Site to make automated decisions that have legal or similarly significant effects on you.
5. Your privacy choices, cookies and Global Privacy Control
Essential items stay on so that the Site works and stays secure. Optional analytics and advertising technologies run only after you allow them. We ask for your choice in a short banner on marketing pages when there is a choice to make, and you can open "Your Privacy Choices" from the footer of every page, and from the Cookie Statement, to change or withdraw it at any time.
Your choice is stored in a cookie named stk_consent that belongs to this Site only and lasts 180 days. We also keep a consent record: a random consent identifier, your choices, the version of the text you saw, the version of our vendor list, whether a Global Privacy Control signal was present, how you made the choice, the time, and your network address as a prefix. The record has no name and no email address. We keep it for 13 months.
Global Privacy Control is a browser setting or extension that tells websites you want to opt out of the sale or sharing of your personal information and of targeted advertising. We treat the signal as a valid request to opt out, for the browser or device that sends it. While the signal is on, advertising and conversion measurement stay off. This applies even if you chose to allow them earlier or choose to allow them in the privacy choices panel, and the panel tells you that the signal was honored. To allow them, turn off the signal in your browser.
Some browsers also offer a "Do Not Track" setting. There is no common standard for it, so this Site does not change how it works when it receives one.
6. Analytics, advertising and "sale" or "sharing"
The marketing pages of the Site may use analytics, advertising and conversion-measurement technologies from the vendors listed in our Cookie Statement. They run only on marketing pages and on the confirmation page shown after a form is submitted, and only if you have allowed the matching category. They never run on forms, on Trust or legal pages, in My Sectra, on sign-in pages or in the SectraTEK applications. They receive no customer, license, usage-record, evidence or staff data and no form entries. A conversion event carries only an event name and coarse campaign information. Where a vendor supports it, we send the event from our own servers instead of from your browser. We do not send your name, email address or phone number, in plain or hashed form, to advertising vendors.
We do not sell personal information in exchange for money. Some state laws define "sale" or "sharing" more broadly, so that making information such as a cookie identifier or a network address available to an advertising vendor can count. That is why advertising technologies are off until you allow them, never run while your browser sends a Global Privacy Control signal, and can be turned off at any time. We do not knowingly sell or share the personal information of anyone under 18.
7. Email
We send transactional emails and, if you subscribed, the newsletter or status emails. We deliver email through Amazon Web Services. The newsletter and status emails use double opt-in: we send a confirmation message first, and nothing more until you confirm within 48 hours. Every such email has a one-click unsubscribe, and we honor an unsubscribe promptly. Marketing emails carry our postal address. Links in our emails go directly to sectratek.com addresses, and we do not use click-tracking redirects.
8. Who receives your information
- Our staff who handle sales, support and security.
- Service providers that act on our instructions: Amazon Web Services, which hosts the Site and our services in United States regions and delivers our email; and a provider of business email and office tools that we use for correspondence. We operate our own CRM, support, scheduling and newsletter systems, and we do not use outside ticketing or CRM services.
- Analytics, advertising and conversion vendors listed in the Cookie Statement, for the information described in Section 6, only if you allow them.
- Your organization, if you use My Sectra: your organization's administrators can see your account details and your organization's usage records.
- Authorities and others, where the law requires it. We send legal requests to our counsel, we tell the affected customer unless the law forbids it, and we provide only the minimum required.
- A buyer or successor, if our business or part of it changes hands.
We do not disclose your personal information to others for their own direct marketing.
9. Customer service data: usage records and support bundles
This section applies to customers who use My Sectra and the SectraTEK applications.
Usage record (a condition of every license). For each case the application creates, it sends us this record and nothing else:
- Subscription ID
- Seat serial (the installer serial number)
- Event sequence number
- Case date and time (UTC): when the case was created and when it finished
- Action (a fixed value)
- Method (the type of evidence examined)
- Device serial number of the device examined (shown in plain form by default; a protected, hashed form is available under contract, called restricted reporting)
- Status: Success or Failed only. A cancelled case is recorded as Failed with the reason CANCELLED_BY_USER
- Comment: a reason code from a fixed list, never a typed note
- Application, engine and intelligence versions
- Duration in seconds
- Installation ID
The application also notes when a case starts, so that a case that never finishes is resolved as Failed with the reason INTERRUPTED after 24 hours.
Never sent: case names, case numbers, the names or paths of evidence files, findings, hashes of evidence, contact data, screenshots, or any content.
The usage record is designed to show when it has been changed (it is tamper-evident). It cannot prevent a change by someone who has access to the machine. We keep usage records for the life of the subscription plus 7 years.
Support bundles. Only when you choose to send one, the application builds a bundle of diagnostic information for a support ticket. It holds a system-readiness snapshot and recent operational logs, and it excludes case evidence, case databases, configuration and credentials. File paths, user names and device identifiers inside the logs are redacted. Nothing is sent until you attach the bundle to your message. A bundle is kept for 30 days after the ticket closes, and a bundle that is not attached to a ticket is removed after 7 days. The ticket text is kept for 7 years. Please do not attach case data to tickets or bundles (see our Acceptable Use Policy).
10. How long we keep information
The Data Retention Schedule lists every period. If this policy prints a period, the schedule prints the same one. We keep information longer where the law or a legal hold requires it, and where keeping a minimal record lets us honor your deletion request, as the schedule describes.
11. Security
We use administrative, technical and physical safeguards that are intended to protect personal information against loss, misuse and unauthorized access. No method of transmission or storage is perfectly secure, so we cannot promise absolute security. If you believe you have found a security problem, please follow our Vulnerability Disclosure Policy or write to security@sectratek.com.
12. Your privacy rights
12.1 Your rights
Depending on where you live, state privacy laws may give you these rights, and we extend them to everyone in the United States who asks, wherever they live:
- to know and to access the personal information we hold about you, and to receive a copy;
- to correct personal information that is wrong;
- to delete personal information we hold about you;
- to opt out of the sale or sharing of your personal information, and of targeted advertising (you can do this with the privacy choices panel or with a Global Privacy Control signal);
- to limit our use of sensitive personal information (we use it only to sign you in and protect your account, so there is nothing further to limit); and
- not to be treated worse for using these rights.
12.2 How to make a request
Email support@sectratek.com with the subject "Privacy request", or call 877.279.6700 (toll-free), or write to Prudential Associates & Cyber-Investigations Group, Privacy Requests, 9200 Corporate Blvd, Suite 200, Rockville, MD 20850. To stop newsletter and status emails, use the unsubscribe link in any of them. To change cookie choices, use Your Privacy Choices.
12.3 Verification and our response
We confirm that we received your request promptly and respond within the time the law requires. If we need more time, we tell you why and for how long. To protect you, we match your request to the email address or details we hold and may ask you to confirm by email. We do not need to verify you for an opt-out request. If we cannot honor a request, or can honor part of it, we tell you why. Where we must keep information for a period, for example a usage record kept for the life of a subscription plus 7 years, we explain what we keep and why.
12.4 Authorized agents
You can ask an authorized agent to make a request for you. We may ask for proof that you gave the agent permission, and we may ask you to confirm your identity with us.
12.5 Appeals
If we deny your request, you can appeal by replying to our answer or by emailing support@sectratek.com with the subject "Appeal". We respond within the time the law requires and explain our decision. If you are still not satisfied, you can contact your state attorney general.
12.6 California notice at collection
In the 12 months before the date at the top of this page, we collected the categories below. We did not sell personal information for money, and we do not use it for any purpose beyond those in Section 4. Retention periods are in the Data Retention Schedule.
| Category | Examples | Sources | Disclosed to |
|---|---|---|---|
| Identifiers | Name, work email, phone number, network address, consent identifier, installation ID | You, your browser, your organization | Staff, service providers, your organization's administrators |
| Customer records and contact details | Name, work email, phone number, organization | You, your organization | Staff, service providers |
| Professional information | Job title, organization, organization type | You | Staff, service providers |
| Commercial information | Quote requests, orders, licenses, support tickets, download records | You, your organization | Staff, service providers |
| Internet and network activity | Pages visited, server logs, performance measurements, browser security reports, usage records | Your browser, the SectraTEK applications | Staff, service providers |
| Approximate location | Country or state you enter, or derived from your network address | You, your browser | Staff, service providers |
| Sensitive personal information | Customer account sign-in credentials | You | Our identity service provider |
If you allow advertising technologies, identifiers such as your network address and cookie identifiers go to the advertising vendors listed in the Cookie Statement, which some state laws treat as "sharing" or "sale". California residents also have the rights in Section 12.1. We do not disclose personal information to third parties for their own direct marketing (California Civil Code section 1798.83).
13. Children
The Site is for businesses and professionals and is not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.
14. Where information is processed
SectraTEK is sold to customers in the United States, and our services are hosted in the United States. The Site can be visited from other countries, and a visitor from elsewhere may submit a form. If you do, your information is processed in the United States, where privacy laws may differ from those of your country.
15. Changes to this policy
The version number and the date of the last update are at the top of this page. If we make a material change, we post a notice at the top of this page for at least 30 days and, if we hold your email address because you are a customer or subscriber, we email you. A change to the privacy choices texts asks you for your choices again.
16. Contact
Prudential Associates & Cyber-Investigations Group, 9200 Corporate Blvd, Suite 200, Rockville, MD 20850, United States. Email: support@sectratek.com (subject "Privacy request" for privacy matters). Telephone: 877.279.6700 (toll-free) or 301.279.6700. Security reports: security@sectratek.com.