Privacy Policy

1. Who we are & scope

PARADOX INFRASTRUCTURE GROUP (“PRDX Infra,” “we,” “us”) is a data hosting, disaster recovery, business intelligence, and cybersecurity provider based in Little Rock, Arkansas. This policy explains how we handle personal information collected through prdxinfra.com, our client, admin, and owner sign-in portals, and related email correspondence (together, the “Site”).

It does not cover data our clients store on, or process through, infrastructure we manage for them. That data is governed by each client’s service agreement — see Client data we host.

2. Information we collect

Information you give us

• Contact & assessment requests: your first and last name, email address, company, the service you are interested in, and anything you write in your message. The contact form opens a pre-filled email in your own mail program; nothing is sent until you send that email.
• Email and phone correspondence: whatever you include when you contact us directly.
• Portal accounts: your work email address, a password (stored only as a one-way hash), multi-factor authentication secrets, and, if you register a hardware security key, that key’s public credential. We never receive a security key’s private key.

Information collected automatically

• Sign-in security log: for every portal sign-in, sign-in failure, and sign-out we record the time, IP address, browser user-agent string, the email address entered, and the authentication method used.
• Server and hosting logs: our hosting provider records standard request data such as IP address, requested URL, referrer, browser type, and timestamps, to deliver the Site and protect it from abuse.

Information we do not collect

• The 60-second risk assessment quiz runs entirely in your browser. Your answers are not transmitted to us or stored.
• We do not use analytics, advertising, or social-media tracking scripts, and we do not build advertising profiles.

3. How we use it

• To respond to your enquiry, schedule an assessment, and provide quotes.
• To provide, secure, and support the portals and services you have contracted for.
• To detect, investigate, and prevent unauthorized access, fraud, and abuse — including rate-limiting repeated failed sign-ins.
• To send service and incident notifications related to your account or tickets.
• To comply with legal obligations and enforce our Terms of Use.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

4. Cookies & local storage

We use only what the Site needs to function. There are no advertising or analytics cookies, so there is nothing to opt out of.

Web fonts. The Site loads typefaces from Google Fonts. When it does, your browser connects to Google’s servers, which receive your IP address. See Google’s Privacy Policy.

Do Not Track & Global Privacy Control. Because we do not track visitors across sites or sell personal information, we treat every visitor as opted out by default, whether or not a DNT or GPC signal is sent.

5. How we share it

We share personal information only with service providers that process it on our behalf under contractual confidentiality and security obligations:

• Vercel — website and API hosting.
• Neon — managed database for portal accounts and the sign-in security log.
• Upstash — short-lived authentication challenges, session revocation, and rate limiting.
• Resend — delivery of ticket and incident notification emails.
• Google Fonts — font delivery, as described above.

We may also disclose information when required by law, subpoena, or court order; to protect the rights, property, or safety of PRDX Infra, our clients, or others; or as part of a merger, acquisition, or sale of assets, in which case the recipient will be bound by this policy.

6. Client data we host

When we host, back up, monitor, or analyze systems on a client’s behalf, we act as that client’s service provider (or “processor”). We access and use that data only as the client’s written agreement instructs, including any Business Associate Agreement under HIPAA. If you are a client’s customer or employee and have a question about your data, please contact that organization directly; we will assist them in responding.

7. Retention

• Enquiries and correspondence: up to 3 years after our last contact, unless they become part of a client relationship.
• Portal account data: for as long as the account is active, then deleted within 90 days of closure unless the law requires us to keep it longer.
• Sign-in security logs: up to 1 year, or longer when needed to investigate a specific security incident.

8. Security

We protect personal information with measures appropriate to its sensitivity, including TLS encryption in transit, AES-256 encryption at rest, hashed passwords, phishing-resistant multi-factor authentication for privileged accounts, strict HTTP security headers, rate limiting, and logged administrative access. No system is perfectly secure, however. If a breach affects your personal information, we will notify you and the relevant authorities as required by the Arkansas Personal Information Protection Act (Ark. Code Ann. § 4-110-101 et seq.) and other applicable laws.

9. Your choices & rights

You can ask us to tell you what personal information we hold about you, to correct it, to delete it, or to provide a copy of it. Depending on where you live — for example California, Virginia, Colorado, Texas, or the European Economic Area — you may have additional rights under local law, including the right to appeal a decision we make about your request. We will not discriminate against you for exercising these rights.

To make a request, email legal@prdxinfra.com with the subject line “Privacy Request.” We will verify your identity, for example by confirming control of the email address on file, and respond within 45 days. An authorized agent may submit a request on your behalf with your written permission.

10. Children

The Site is intended for businesses and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

11. Changes to this policy

We may update this policy as our services or the law change. When we do, we will revise the “Last updated” date above, and for material changes we will provide additional notice on the Site or by email to portal account holders.

12. Contact us