Privacy notice

What this notice covers

This is a notice about a website, not about our casework. It covers the personal data this site collects, and why we hold it. How long we keep it. Who else touches it on the way.

A signed engagement governs anything we are given inside it. That includes material handed to us during an investigation. Its terms set the confidentiality. This notice does not sit above them or weaken them.

Fulk Labs, in Muscat, Oman, decides why and how the data below is processed. Oman's Personal Data Protection Law calls that the controller. The role is ours.

What the forms collect

Two forms on this site send us anything. The emergency form, on the emergencies page. The booking form, on the book a call page. Each keeps what you type.

Name

So we know who we are answering. Required on both.

Organization

Who is affected, or who you are. Optional on the emergency form, required on the booking form.

Phone number

Emergency form only. A number that reaches you now. Required. An incident is a phone conversation, not a thread.

What is happening

Emergency form only. Your own account of it. Required. Write it the way you would say it.

Email

Booking form only. Where we reply with times. Required.

What prompted this, and preferred times

Booking form only. Both optional. They help us use the call well.

Two hidden fields travel with each form. One carries the language you were reading. The reply comes back in it. The other stays empty. A submission that arrives with it filled in came from a bot. We discard it.

Our server adds two things you did not type. The time the message arrived. The two-letter country code Cloudflare associates with the connection. Your IP address is not stored in the submission. Cloudflare keeps its own network logs under its own terms. Any host does.

Everywhere else on this site, contact is a plain mail link. Mail you send that way lands in our mailbox. Nowhere else.

Before we open

We are not taking engagements yet. Until we do, the emergency form and the booking form above are switched off. A short signup form is the only one left. It is on the get notified page, and at the foot of several pages.

It asks for four things. Your name, your organization, your work email and your role. We use them to send you one message, on the day we open, and to know who is waiting for it. That is their only use. No marketing list, nothing else.

The record we keep holds seven things.

Name

The name you type.

Organization

The organization you type.

Role

The role you type. CISO, head of IT, SOC lead, or whatever yours is.

Work email

The address you type. Where the one message goes.

Time of signup

When your address arrived. Our server adds it.

Language

The language you were reading. A hidden field carries it.

Wording version

Which version of the form and this section you saw. A hidden field carries it. With the language, the record shows what you agreed to.

No country code and no IP address go into the record. One address, one record. Sign up twice and there is still only one.

A third hidden field stays empty, as on the other forms. A signup that arrives with it filled in came from a bot. We discard it.

The lawful basis is your consent. Take it back whenever you like.

The record is stored in Cloudflare Workers KV. Each new signup sends one notification to our own mailbox. It goes through Resend and lands in Microsoft 365. Nothing is sent to you when you sign up. No service beyond the four named further down this page touches it.

We delete the record once the announcement is sent. Write to contact@fulklabs.com and we delete it sooner.

Why we hold it

To answer you. There is no second use. No profiling, no marketing list, no sale. No sharing with anyone not named further down this page.

For a general inquiry the lawful basis is your consent. You chose to write to us. Take that consent back whenever you like.

For an emergency submission it is consent and legitimate interest together. Someone reporting an attack in progress expects us to act. Acting means reaching them, and recording what was reported and when. That record is the first line of a timeline.

How long we keep it

A form submission is kept for 12 months from the day it arrives. Then deleted.

If a submission becomes part of a signed engagement, the engagement takes over. Its retention terms apply instead. The difference is deliberate. Evidence and case records have their own rules and their own clock.

Mail in our mailbox is kept as ordinary business correspondence. Deleted when it is no longer needed. Ask us to delete yours sooner and we will.

Who processes it

Four services touch this data. Each is named here. A privacy notice that says trusted partners has told you nothing.

Cloudflare Pages

Serves this site and runs the small function that receives the form. It sees every request made to this site.

Cloudflare Workers KV

The store a submission is written to. It lives there for its 12 months.

Resend

Sends one notification to our own mailbox for each submission. Nothing sits unread in a dashboard at three in the morning.

Microsoft 365

Our mailboxes. Anything you email us, and every notification above, ends up here.

One more service sees your visit, not your form. Cloudflare Web Analytics counts visits to this site. It sets no cookie and does not identify you. It sees the page, the page you came from, the browser type, the country and how fast the page loaded, and shows us only totals.

No advertising network, no chat widget, no embedded video, no social button. The content security policy this site sends blocks every other outside script. Blocks, not discourages.

Where it is stored

Not only in Oman. Cloudflare, Resend and Microsoft run networks that cross borders. A copy of a submission may sit on a server outside the country.

Each of the three publishes its own data protection terms. We chose them partly for that. The control that is entirely ours is how much we ask for. We keep it small. A few fields, a timestamp, a country code.

That is this website. Evidence and case files from an engagement are kept apart from it, and they stay in Oman.

The cookie

One cookie. It is functional, not tracking.

fulk_lang

Remembers whether you are reading English or Arabic. Set on your first visit, to the language of the page you opened. Set again when you use the language toggle or move between the two trees. The toggle then works without a query string. It lasts one year. It holds two letters and nothing else. It is sent only to this site, and only over an encrypted connection.

This site sets no other cookie. Nobody else sets one through it. The cookie statement covers it in full.

Your rights

Oman's Personal Data Protection Law gives you rights over data about you. They are easy to use here. There is very little of it.

• Be told what we hold and why.
• Get a copy of it.
• Have it corrected if it is wrong.
• Have it deleted.
• Withdraw your consent. For a form submission that means asking us to delete it.
• Object to what we are doing with it. Ask us to stop while a question is settled.

Write to contact@fulklabs.com and say which one you want. We will answer. If we cannot do what you ask, we will say why. We do not go quiet.

We may ask you to confirm who you are. An incident report handed to the wrong person is a breach of its own.

You can also complain to the Ministry of Transport, Communications and Information Technology. It oversees the law in Oman.

Changes to this notice

If this notice changes, the effective date at the top changes with it. A material change is described here. A new processor, or a new purpose. Described, not absorbed quietly.