Who we are
Shorward is operated by Media Yard LLC, PO Box 73, Pennsauken, NJ 08110, USA. We are the controller of the personal data described here. For data that a customer uploads to the service, we act as that customer's processor under the Data Processing Addendum. UK and EU details are on UK & EU. Contact: [email protected].
What we collect
| Data | Source | Examples |
|---|---|---|
| Waitlist details | You, through the sign-up form | Work email, company domain, who is asking about your post-quantum plan, sign-up time, and the country your request came from (derived by Cloudflare from your IP address; the IP address itself is not stored) |
| Account details | You, when you're invited | Name, work email, organization, login records |
| Scan results | Our scanner, from public endpoints | Hostnames, protocol versions, key exchange groups, certificate details. These are mostly technical data, but certificates can contain names or email addresses |
| Uploaded evidence | You (Pro plan) | CBOMs, configuration exports, roadmaps. May contain staff names or emails |
| Support messages | You | What you write to us and our replies |
| Billing details | You, when paid plans open | Billing contact and invoices. Card details are handled by our payment provider, never by us |
| Technical logs | Cloudflare, when you visit | Security and delivery logs kept by our hosting provider. We don't run analytics or tracking on this site |
Why we use it, and our legal basis
- To run the waitlist and invite you: our legitimate interest in running the beta, or steps you asked us to take before a contract.
- To provide the service and support: performance of our contract with you or your organization.
- To keep the service secure and prevent abuse: our legitimate interest in security.
- To bill and keep records: contract, and our legal obligations.
- To send product news: only if you opt in. You can opt out at any time.
We don't sell personal data, use it for advertising, or make decisions about people that have legal or similarly significant effects on them. Reports rate organizations' systems, not individuals.
Who we share it with
We share personal data only with the providers listed on Subprocessors, who process it for us under written contracts. We also share it when the law requires, or as part of a merger or sale, in which case this notice keeps applying.
International transfers
Some of our providers process data in the United States and other countries. When personal data from the UK, EEA or Switzerland is transferred, we rely on an adequacy decision (including the EU-US Data Privacy Framework and its UK extension, where the provider is certified) or on the European Commission's Standard Contractual Clauses with the UK Addendum. Details are on UK & EU.
How long we keep it
- Waitlist details: until you join or ask to be removed, and at most 24 months.
- Account details, scan results and reports: while your account is active, then 12 months, so you can come back to your history. You can ask us to delete them sooner.
- Uploaded evidence: deleted within 30 days of account closure, or sooner on request.
- Billing records: as long as tax law requires, usually 6 to 7 years.
- Support messages: 24 months after the conversation ends.
Your rights
Depending on where you live, you can ask to access, correct, delete, restrict or move your personal data, and to object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time. Residents of California and other US states have similar rights, and we honor them the same way. We don't sell or share personal data for cross-context behavioral advertising.
Email [email protected]. We reply within one month. We may need to confirm your identity first. If you're in the UK or EU, you can also complain to your data protection authority. See UK & EU.
Cookies
This site sets no cookies and runs no analytics or tracking scripts. Our fonts are served from our own domain. Our hosting provider may set strictly necessary security cookies to block attacks. When accounts open, we'll use a strictly necessary sign-in cookie, and we'll update this section.
Security
Data is encrypted in transit and at rest by our providers, and access is limited to the people and systems that need it. See Security.
Children
The service is for businesses and isn't directed at children under 16.
Changes
We'll post updates here with a new date, and email account holders about material changes.