Privacy Policy

1. Who We Are

Cybrshield ("we", "us", "our") operates the Cybrshield application control platform available at this website. We are the data controller for the personal information we collect about you.

If you have any questions about how we handle your data, please contact us.

2. Information We Collect

We collect information in the following ways:

• Account information: When you register, we collect your name, email address, and a hashed version of your password.
• Organisation data: Information about your organisation such as company name, country, and industry, which you provide when creating or editing a tenant.
• Endpoint telemetry: Data sent by the Cybrshield agent installed on managed devices, including application execution events, file hashes, and policy outcomes. This data is associated with your account.
• Usage data: We collect anonymised information about how you use the management portal, such as pages visited and features used, to improve the Service.
• Communications: If you contact us through the support form, we collect the information you provide in that message.

We do not collect payment card details directly; payments are processed by our third-party payment provider.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process and authenticate your account
• Enforce application control policies on your managed devices
• Send you service-related communications, such as security alerts and account notifications
• Respond to your support enquiries
• Improve and develop new features of the Service
• Comply with legal obligations

We do not sell your personal data to third parties or use it for advertising purposes.

4. Legal Basis for Processing

Under the UK GDPR and EU GDPR, we process your personal data on the following legal bases:

• Contract: Processing necessary to provide the Service you have signed up for.
• Legitimate interests: Processing necessary for our legitimate business interests, such as improving the Service and ensuring its security, where these interests are not overridden by your rights.
• Legal obligation: Processing required to comply with applicable law.
• Consent: Where we rely on consent (e.g. for marketing communications), you may withdraw that consent at any time.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required to retain it for legal or regulatory purposes.

Endpoint telemetry data is retained for a rolling period to support policy auditing and incident investigation. You may request deletion of specific telemetry data by contacting us.

6. Data Sharing

We do not sell or rent your personal data. We may share data with trusted third-party service providers who assist us in operating the Service, such as cloud hosting providers. These providers are contractually required to protect your data and use it only as directed by us.

We may disclose your data if required to do so by law or in response to a valid legal process (such as a court order or government request).

7. Cookies

We use only strictly necessary (essential) cookies — those required for the Service to function and to keep you signed in securely. Under the UK Privacy and Electronic Communications Regulations (PECR) and UK GDPR, essential cookies are exempt from the requirement to obtain consent. We do not use advertising, analytics, or third-party tracking cookies, and we do not track you across other websites.

The essential cookies we set are:

• session — keeps you signed in and maintains your session state (expires when your browser session ends).
• remember_token — set only if you choose "keep me signed in" at login, so you stay authenticated on return visits (persistent).
• csrf_token — protects against cross-site request forgery (session-scoped security cookie).
• __Secure-stripe_* — set by Stripe, our payment processor, for fraud prevention on billing and checkout pages only.

We also store a single flag in your browser's local storage to remember that you have seen our cookie notice, so it is not shown to you repeatedly. This flag is not a tracking identifier and is not shared with anyone.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Restriction: Ask us to restrict processing of your data in certain circumstances.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.

To exercise any of these rights, please contact us. We will respond within 30 days.

9. Security

We take the security of your data seriously. We use industry-standard measures including encrypted communications (TLS), hashed password storage, and access controls to protect your information.

No method of transmission or storage is 100% secure. If you believe your account has been compromised, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will notify you via email or via a notice in the management portal.

We encourage you to review this Policy periodically.