Privacy policy.

Matrix CR Studio is a security research and automation studio operating at matrixcr.ai. We provide quantum threat assessments, post-quantum cryptography migration, verifiable records of automated work, and related security research. Contact: [email protected]

We collect only what is necessary to provide our services:

• Contact information you provide voluntarily (name, email address) via our contact form or direct correspondence. • Usage data collected automatically when you visit matrixcr.ai, including IP address, browser type, pages visited, and time of visit, via standard server logs and analytics. • Information you provide when engaging our services, including project details and technical specifications required to perform an engagement. • Problem reports. If you use the report form, we receive what you write, the page it concerns, your browser type, and your email address if you choose to give one. If a script on the site fails in your browser, the page sends us the error message and the page it happened on, with nothing that identifies you, so we can fix it.

We do not collect sensitive personal data, financial data, or data from minors.

We use collected information solely to:

• Respond to inquiries and deliver services you have requested. • Send service-related communications (engagement status, deliverables, follow-ups). • Improve our website and service quality through aggregated usage statistics. • Comply with applicable legal obligations.

We do not sell, rent, or share your personal information with third parties for marketing purposes.

For visitors in the European Economic Area, we process personal data under the following lawful bases (GDPR Art. 6):

• Contractual necessity: to perform services you have engaged us for. • Legitimate interests: to operate and improve our website and services. • Consent: for any optional communications you explicitly opt into.

For visitors in Brazil, processing is conducted in accordance with Lei Geral de Proteção de Dados (LGPD, Lei 13.709/2018) under the same bases above.

For visitors in Chile, processing is conducted in accordance with Ley 19.628 sobre Protección de la Vida Privada and, as it enters into force on December 1, 2026, Law 21.719 on personal data protection.

You may withdraw consent at any time by contacting [email protected].

We retain personal data only as long as necessary for the purposes described above or as required by law. Contact inquiry data is retained for up to 24 months. Engagement data is retained for the duration of the engagement plus 3 years for legal and audit purposes.

Our website and services may interact with the following third-party processors:

• Vercel: website hosting and delivery, plus Vercel Web Analytics and Speed Insights, which count visits and measure page speed without cookies. • Google Analytics: counts page views. It runs in consent mode with all storage denied, so it sets no cookies, and Google's advertising features are turned off. • Cloudflare: network delivery and protection for the site, plus Cloudflare Web Analytics, which counts visits without cookies. • Ghost (self-hosted): blog content management, hosted on our own infrastructure.

Vercel, Google and Cloudflare are companies based in the United States, and may process the limited data described here there and in other countries where they operate.

Each third party is bound by their own privacy policies. We do not share identifiable personal data with these providers beyond what is technically necessary for service delivery.

Information you send us travels over encrypted connections, and access to it is limited to the people handling your inquiry or engagement. While no system is perfectly secure, we take the protection of your information seriously and apply appropriate technical and organizational measures.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you. • Request correction of inaccurate data. • Request deletion of your data. • Object to or restrict processing. • Data portability.

To exercise any of these rights, contact [email protected]. We will respond within 30 days.

matrixcr.ai does not set cookies for visitors in normal browsing, and its analytics are configured to set none. If Cloudflare challenges a request it suspects is automated, it may set a short-lived security cookie for that check. We do not use advertising or tracking cookies. If we ever need a cookie for the site to work, it will be listed here first. You may disable cookies in your browser settings; this will not affect your ability to use the site.

We may update this policy to reflect changes in our services or applicable law. Material changes will be noted with an updated effective date below. Continued use of our services after changes constitutes acceptance of the revised policy.

This Privacy Policy is governed by and construed in accordance with the laws of the Republic of Costa Rica. Any dispute arising from or relating to this Policy shall be subject to the exclusive jurisdiction of the courts of San José, Costa Rica, except where mandatory data-protection or consumer laws in your jurisdiction require otherwise.

For any privacy-related questions or requests:

Matrix CR Studio [email protected] matrixcr.ai