Account data online. Case data on your device.

Who is responsible for your information

The Waldrep Company LLC, an Alabama limited liability company, operates DFIR Toolkit. Privacy requests can be sent to info@thewaldrepcompany.com.

Information the hosted service processes

When you sign in, the hosted service processes your email address, display name, a salted password hash, authentication state, account consent records, and basic account identifiers. Raw passwords are not stored. Necessary session cookies keep you signed in. If you subscribe, it also processes your selected plan, subscription status, renewal date, and Stripe customer and subscription identifiers. We process correspondence and diagnostic details you provide when you request support. If you request the documentation pack or Team Licensing, we process the contact information, organization details, request notes, communication consent, and consent timestamp submitted through that form.

Case content stays in the local vault

DFIR Toolkit is designed so that case records and completed forms are encrypted in a device-local browser vault. The hosted account database is not designed to receive case numbers, evidence descriptions, examiner notes, signatures, form values, audit history, or exported reports.

Encrypted backup files remain wherever you save or copy them. The Waldrep Company LLC does not receive the vault passphrase or maintain a server-side recovery key.

Payments

Stripe processes payment information through its hosted checkout and billing portal. DFIR Toolkit receives billing status and identifiers, but does not receive full card numbers. Stripe handles payment data under its own privacy terms.

How information is used

• Authenticate customers and provide licensed product access.
• Administer subscriptions, invoices, refunds, and customer support.
• Maintain security, prevent abuse, diagnose failures, and meet legal obligations.
• Improve product reliability using operational data that is not intended to contain case content.
• Deliver requested resources, respond to Team Licensing inquiries, and send product or publication updates when you have expressly requested them.

The application also keeps daily aggregate counts for completed signup, login, checkout, subscription activation, payment failure, and cancellation events. These counters do not contain case content, email addresses, IP addresses, or device identifiers.

Service providers and disclosure

We use service providers for hosting and infrastructure, transactional email through Resend, and payment processing through Stripe. They may process account data only as needed to provide those services, maintain security, or meet legal obligations. We may also disclose information when required by law, to protect rights or safety, or as part of a business transaction subject to appropriate safeguards.

We do not sell personal information or use case content for advertising. The product does not intentionally collect case content through the hosted account layer.

Retention and deletion

Account records are retained while the account is open and afterward only as reasonably necessary for security, disputes, accounting, tax, and legal obligations. Login sessions expire after 30 days. Verification links expire after 24 hours, password-reset links after 30 minutes, and abuse-prevention counters after no more than one hour. Hosting and email providers may retain request and delivery logs under their own operational policies. Stripe retains payment records under its policies and applicable law. Device-vault content remains under your browser-profile and backup control.

Resource-request and marketing-consent records are retained while needed to provide the requested communications, document consent, and honor opt-out requests. Team inquiries are retained as reasonably necessary for follow-up, procurement, support, and business records.

After a subscription has ended, you can delete eligible hosted account information from the account page or request assistance by email. Some billing, fraud-prevention, or legal records may need to be retained after account closure.

Your choices and rights

You can export your encrypted local vault and case reports from the product. Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, or portability for hosted personal information. We may need to verify your identity before completing a request.

You may withdraw marketing consent at any time by using an unsubscribe option in a marketing message or emailing info@thewaldrepcompany.com. Withdrawing consent does not affect necessary account, transaction, security, or legal communications.

Security and international processing

We use access controls, encryption, request validation, and data minimization to protect hosted information. No system can guarantee absolute security. Service providers may process information in the United States or other locations where they operate, subject to their contractual and legal safeguards.

Children and changes

DFIR Toolkit is a professional service and is not directed to children under 18. We may update this notice as the service changes and will post a new effective date when we do.

Important support boundary