Layered Protection Privacy Policy

Effective November 7, 2026

This Privacy Policy explains how Spectrum Protection Group, LLC ("SPG," "we," "us," or "our") collects, uses, shares, and protects information in Layered Protection™, our physical security risk and vulnerability assessment application, on the web (iPhone and iPad versions are planned) (the "App"). Our website, consultation form, and text messaging program are covered by our separate Privacy Policy.

Layered Protection is a business application. It is licensed to organizations, and their authorized personnel use it to conduct security assessments. When an organization licenses the App, that organization decides what assessment information is entered, and SPG handles that information on the organization's behalf under its license agreement.

Information We Collect

Account information. When the administrator creates your account or you request access, we collect your name, business email address, telephone number (for access requests), company or agency, relationship to SPG or the licensed organization, role, business need, sponsor or contract reference, and the confidentiality agreement on file. Passwords are never stored in readable form; the App keeps only a salted, one-way hash. If your organization uses Microsoft 365 sign-in, Microsoft verifies your sign-in and provides the App your name, email address, and assigned App role.

Electronic signature records. When you accept the Electronic User Agreement or sign another agreement in the App, we record your typed name, the date and time, the agreement version, a digital fingerprint of the agreement text, and your browser or device type.

Assessment information. Authorized users enter facility profiles, threat and hazard information, criticality and risk ratings, observations, corrective actions, plans, reports, and photographs. This information belongs to the licensed organization. Photos are taken or chosen only when you act, and the App re-saves each photo, which removes embedded location data.

Activity records. The App keeps an activity log of sign-ins, changes, exports, uploads, and administrative actions, with the user's email, role, date, and time, for security and accountability.

Technical information. Our hosting providers automatically receive standard technical information, such as IP address, browser and device type, and the date and time of requests, to deliver and secure the App. The web App loads its fonts from Google Fonts, which receives your IP address and browser information when it delivers them.

Payment information. If your organization pays SPG online, payment is handled by our payment processor, Stripe, on its own secure page. SPG does not receive or store card numbers.

What We Do Not Collect or Do

• No advertising, no ad tracking, and no tracking across other companies' apps or websites
• No sale or sharing of personal information for targeted advertising
• No analytics or marketing software inside the App
• No precise location collected by the App
• No biometric data. If you use Face ID or Touch ID on iPhone or iPad, the comparison happens on your device within Apple's systems, and SPG never receives your face or fingerprint data.

Where Information Is Kept

Web App. In the web App, assessment work is held in your browser's memory while you work. It is not saved by the web App on SPG servers. You keep work by exporting it, saving reports, or uploading files to your organization's approved Microsoft SharePoint or OneDrive location when your administrator has connected one. The offline-ready copy saves only the App's own program files on your device, not assessments, photos, or account information.

iPhone and iPad App. If you use the iOS App, assessments in progress may be saved on your device in encrypted storage protected by iOS Data Protection, so your work survives closing the App. You can share reports and files through the iOS Files app, AirDrop, or other approved destinations you choose.

Accounts and signatures. Account records, password hashes, and signature records are kept by SPG and your organization's administrator to control access.

How We Use Information

• To create and manage accounts, verify identity, and control access by role
• To provide the App's assessment, planning, reporting, and document features
• To record agreements and electronic signatures
• To secure the App, investigate misuse, and keep activity records
• To provide support your organization requests
• To meet legal, contractual, and government requirements, and to enforce our agreements

We do not use assessment information for any other purpose, and we do not use it to train artificial-intelligence models.

How Information Is Shared

We share information only:

• With the licensed organization that owns the assessment and its authorized users, according to the access their administrator grants
• With service providers that host, secure, or support the App on our behalf (such as our web host, Microsoft for sign-in and file storage when your organization uses Microsoft 365 or Azure, and Stripe for payment), who may use it only to provide those services to SPG
• When required by law, subpoena, court order, or government contract, or to protect the rights, property, or safety of SPG, our clients, or others
• In a merger, acquisition, or sale of all or part of our business, subject to this policy
• At your direction or with your consent

Government and Protected Information

Licensed organizations are responsible for marking and handling Controlled Unclassified Information (CUI), For Official Use Only (FOUO) material, and other government information as the law and their contracts require, and for using only an App edition and hosting approved for that information. Never enter classified information in the App. The hosted demonstration version uses synthetic data only; do not enter real facility, CUI, or FOUO information in it.

Data Retention

Account and signature records are kept while access is active and afterward as needed for security, contract, legal, and audit requirements. Activity records are kept as long as security and contract obligations require. Assessment information is kept by the licensed organization under its own records rules; when a license ends, the organization may export its data for 30 days, and then we delete any copies we hold, unless the law requires us to keep them.

Data Security

We use administrative, technical, and physical safeguards suited to security assessment work, including encrypted connections, salted password hashing, multi-factor sign-in when your organization uses Microsoft 365, role-based access, automatic sign-out after inactivity, activity logging, and signed confidentiality agreements for everyone with access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we confirm unauthorized access to your organization's information through the App, we will notify the organization as its agreement and the law require.

Your Privacy Choices

You may ask us to confirm whether we process your personal information, give you a copy, correct it, or delete it. If your information is part of a licensed organization's assessment records, we will refer your request to that organization and help it respond. We extend these choices to all individuals, including Virginia residents. Contact hlwillis@spectrumprotectiongroupllc.com or (833) 773-2477. We will verify your request and respond within 45 days. If we decline, we will explain why, and you may appeal by replying to our response; we will respond to an appeal within 60 days. We will not discriminate against you for exercising these choices.

To close your account, ask your organization's administrator or contact us. Closing an account ends access; signature and activity records may be kept as described under Data Retention.

Children

The App is for businesses, government organizations, and their personnel. It is not directed to children under 13, and we do not knowingly collect their personal information.

Changes to This Policy

We may update this policy as the App or our practices change. The effective date above shows the latest version, and material changes will be noted in the App.

Contact Us

Spectrum Protection Group, LLC
Fredericksburg, Virginia
Email: hlwillis@spectrumprotectiongroupllc.com
Telephone: (833) 773-2477
Support: Contact Us