Privacy Policy

1. Who is the controller

Cyber Security RO SRL

Address: TODO-owner: confirm the registered address to publish

Registration number: TODO-owner: confirm the registration/CUI number to publish

VAT identifier: TODO-owner: confirm whether a VAT identifier is displayed, and its value

Contact: TODO-owner: confirm the legal/support contact address

Jurisdiction: Romania

2. What this site handles today

This notice describes the site as it is currently built and deployed. Account data and credits are stored server-side as described below.

What you submit when you register

• Full name, as typed into the registration form
• Business email address, as typed into the registration form
• Password, transmitted to the registration endpoint and stored only as a password hash — never as the password itself

Account data stored in Postgres

• Full name, business email address, password hash, plan, terms accepted timestamp, terms version and intro-video-seen flag, stored in the account record in Postgres

Credits

• Credits, recorded in an append-only ledger in the same database

Your session cookie

• One HttpOnly session cookie containing only your account user ID

Still to be confirmed

• TODO-owner: confirm which request/server logs the hosting provider keeps on our behalf, including IP addresses, and for how long

Analytics: Analytics is disabled in this build: NEXT_PUBLIC_GA_ID is absent, so no analytics scripts or tracker load. If it is configured, Google Analytics loads only after an explicit Allow choice in the consent banner; rejecting or making no choice loads no tracker. The owner has decided not to enable analytics for now; removal of this optional loader is tracked as an owner item.

3. Why we process it, and on what basis

4. Processors and international transfers

The providers below are part of the platform stack. The status line says whether a provider serves the site today or has been designated for work that has not shipped.

International transfers: Some of the providers above are based outside the EEA. TODO-owner: confirm the transfer safeguard relied on for each provider (for example standard contractual clauses, or an adequacy decision) before this notice states one.

We do not publish compliance certifications for these providers.

5. How long we keep data

Account data:

TODO-owner: define the retention period for inactive accounts

Assessment reports:

TODO-owner: define how long assessment reports are retained

Deleted accounts:

TODO-owner: define the grace period before permanent deletion

Logs:

TODO-owner: define how long request, server and security logs are retained

6. Your rights

• Right of access: you can request a copy of the personal data we hold about you
• Right to rectification: you can ask us to correct inaccurate data
• Right to erasure: you can ask us to delete your data
• Right to restrict processing: you can ask us to limit how we use your data
• Right to data portability: you can ask to receive your data in a structured, machine-readable format
• Right to object: you can object to processing carried out on the basis of our legitimate interests
• Right not to be subject to automated decision-making: no automated decision-making or profiling with legal or similarly significant effects is carried out
• Right to lodge a complaint with a supervisory authority, in Romania with ANSPDCP or with the authority in your member state

To exercise a right, contact TODO-owner: confirm the legal/support contact address by Email to the contact address above.

Response time: TODO-owner: confirm the response commitment to publish (GDPR allows one month, extendable)

7. Data Protection Officer

TODO-owner: confirm whether a Data Protection Officer has been appointed or is required for this processing, and publish the contact details if so.

8. Security

TODO-owner: confirm which technical and organisational security measures may be described publicly — including credential handling, encryption at rest, access control, and any audit or testing programme. Nothing is claimed here until it is confirmed.

This draft makes no claim about encryption, credential handling, access control, audits or testing until those measures have been confirmed and can be described accurately.

9. Third-party links

This site links to third-party sites. We are not responsible for their privacy practices; please read their own notices.

10. Changes to this notice

TODO-owner: confirm how changes to this notice are communicated to registered users, and whether any advance-notice commitment is made.

11. Questions or complaints

• Us: TODO-owner: confirm the legal/support contact address
• Supervisory authority: in Romania, ANSPDCP, or the authority in your member state

12. Related policies

• Terms of Service
• Authorised Testing Policy