Short, specific, and accurate to what this site actually does. Every processor named below is one we actually use.
This site runs no advertising technology, no tracking pixels, no cross-site tracking, and sets no cookies of its own. We count page views with one privacy-preserving tool, Vercel Web Analytics, which sets no cookie, stores no IP address, and cannot identify you or follow you to another site. We do not sell, rent, or share personal information with anyone for their own marketing. Beyond that page count, we collect information in exactly three places: a form you choose to fill in, a challenge game you choose to play, and a payment you choose to make.
| When | What | Why |
|---|---|---|
| You open a page every visit, automatically |
The page you opened, the site that referred you, your approximate location (country, region, city), and your device and browser type. No cookie, no IP address, no name. | To know whether anyone is reading the site and how they found it. This is the only item on this page you do not choose, which is why it is listed first. |
| You submit a form quote request, screening intake, briefing signup |
Name, organization, work email, and whatever you type in the message or model fields. Screening intake may include a Stripe receipt number. | To answer you, to scope and run the work you asked for, and to send the briefing if you asked for it. |
| You play Break the Banker | The messages you type in the game, which technique categories they matched, turn count, outcome, a random session id, and your browser's user-agent string. If you ask for the findings, the email and name you give. | Security research, and to send you the read-back you requested. The page says this before you play. |
| You buy a screening | Handled entirely by Stripe. We never see or store your card number. We receive your name, email, business name, the model you named, and a payment confirmation. | To take the payment and deliver the engagement. |
Our host keeps standard server logs — IP address, page requested, timestamp, user agent — as every web server does. We do not use them to build a profile of you.
The challenge game stores two values locally on your device (katana_unlocked and katana_done) so it remembers which levels you have beaten. They never leave your browser and are not cookies. Clearing your site data removes them.
We do not run an in-house data platform. These are the only third parties involved, and each acts on our behalf:
Material you provide during a paid engagement — model identifiers, configuration details, and the outputs we generate while testing — is treated as confidential and is governed by the engagement letter for that work, which takes precedence over this policy where the two touch. Evidence packs are retained so a finding stays verifiable; we can delete an engagement's working data on request once the deliverable has been accepted, except where we must keep records for tax or legal reasons.
Form submissions and correspondence: as long as needed to answer you and for our own business records. Challenge gameplay sessions: retained for security research, and not linked to you unless you gave us an email. Payment records: as required by tax and accounting rules.
Email joseph.cirello@potestasai.com and ask for a copy of what we hold about you, a correction, or deletion, and we will do it. Depending on where you live you may have formal rights of access, correction, deletion, portability, or objection — you do not need to cite a statute; just ask, and we will treat the request the same either way.
Every briefing email carries an unsubscribe link. You can also just reply and say stop.
This is a business-to-business service. It is not directed at anyone under 18 and we do not knowingly collect information from them.
If this policy changes materially we will change the date at the top and, where it affects something you have already given us, tell you directly.
Potestas AI · 10 Dorrance Street, Suite 700, Providence, Rhode Island 02903, United States
joseph.cirello@potestasai.com · 833-TEST-LLM