Privacy Policy

Cybrology (“Cybrology”, “we”, “us”) provides a cybersecurity posture-assessment, security-awareness training, and tools platform for individuals and organizations. This policy explains what personal data we process and your rights over it. For business customers, Cybrology acts as a data processor for the assessment and member data you upload, and as a data controller for your account and billing data.

We collect only what we need to run the service:

• Account data — your name, email address, password (stored only as a salted Argon2 hash, never in plain text), locale, and, for company accounts, your organization name, industry, and size.
• Authentication data — if you sign in with Google or LinkedIn, we receive your verified email, name, and the provider’s user identifier; we never receive your provider password.
• Assessment & training data — the answers you give in risk assessments, your risk scores, course progress, and phishing-simulation results.
• Tool inputs — values you enter into our free tools (for example a domain or email address you check). These are processed to return a result and are not used to build a profile of you.
• Billing data — subscription plan and payment status. Card details are handled by our payment processor and are never stored on our servers.
• Technical data — IP address, device/browser information, and audit logs of security-relevant actions (sign-in, permission changes), used to keep your account secure.

• Provide, secure, and operate the platform and your account.
• Generate your risk assessments, scores, reports, and training.
• Authenticate you and prevent fraud, abuse, and unauthorized access.
• Send transactional emails (verification, password reset, notifications).
• Process subscriptions and payments.
• Improve our products and diagnose problems using aggregated, non-identifying data.
• Comply with legal obligations and enforce our terms.

Where the GDPR applies, we process personal data under the following legal bases: performance of a contract (to deliver the service you signed up for), legitimate interests (to secure and improve the platform), consent (for optional communications and non-essential cookies), and legal obligation (for accounting and compliance).

We do not sell your personal data. We share it only with vetted service providers who process it on our behalf under contract:

• Google Cloud Platform — hosting and databases (primary region Doha, me-central1; encrypted backups in the EU).
• Postmark — delivery of transactional email.
• Stripe — payment processing.
• Have I Been Pwned — breach-exposure lookups for the email/dark-web tools.
• Google & LinkedIn — optional social sign-in (OAuth).
• Sentry — error and performance monitoring.

We may also disclose data where required by law, or to protect the rights, safety, and security of Cybrology, our users, or the public. A full, current sub-processor list is available in our Data Processing Addendum.

Your data is primarily processed in our Doha (me-central1) region, with backups stored in the European Union. Where data crosses borders, we rely on appropriate safeguards such as Standard Contractual Clauses.

We use a small number of strictly necessary cookies to keep you signed in and to secure your session (for example our refresh-session cookie). We do not use advertising cookies. See our Cookie Policy for details.

We keep personal data for as long as your account is active and as needed to provide the service. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must retain it for legal, accounting, or security reasons. Tool inputs entered without an account are not retained beyond returning your result.

Security is our product and our practice. We encrypt data in transit (TLS) and at rest, hash passwords with Argon2id, enforce strict tenant isolation (row-level security) so one organization can never see another’s data, support multi-factor authentication, and log security-relevant events. No system is perfectly secure, but we work continuously to protect your data.

Depending on your location, you may have the right to access, correct, delete, export, or restrict processing of your personal data, to object to processing, and to withdraw consent. You can exercise most of these from your account settings, or by emailing us. You may also lodge a complaint with your local data-protection authority.

Cybrology is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy as our service evolves. We will revise the “Last updated” date above and, for material changes, notify you by email or in the app.

For any privacy question or to exercise your rights, email privacy@cybrology.io.