This notice explains what personal data CyberHacker.AI(“we”, “us”, CyberHacker.ai) collects when you use our platform, why we collect it, who we share it with, and the choices you have. It covers our marketing site, the customer application, and the security testing services we deliver.
Who we are
The data controller is CyberHacker.AI, Dallas, Texas, United States. For any privacy question or to exercise your rights, contact us at [email protected].
Data we collect
- Account & identity — name, work email, job title, phone number, company name and website, and the country you operate from, provided when you create an account.
- Authentication — a securely hashed password (we never store it in the clear), and, if you sign in with Google, LinkedIn or Microsoft, the basic profile and email released by that provider.
- Engagement data — the targets, scope answers, assets and supporting files you submit for testing, plus the findings, reports and certificates we produce.
- Support & communications — messages you send us, sales-chat and concierge conversations, and support tickets.
- Payments — billing records and the last four digits / card brand returned by our payment processor. We do not receive or store full card numbers.
- Technical — IP address and request metadata used to keep sessions secure and to rate-limit abuse. Our contact, quote and incident forms also check that a person, not a bot, is sending them: with a token from our own site and, where enabled, Cloudflare Turnstile, which looks at your IP address and browser signals for that purpose only.
- Website analytics — the pages you view on our site and app, how long you spend on them, how far you scroll and which parts of a page you look at, the buttons and links you click, and whether you start a form and the field you were last in (never what you type into it), how you reached us (the referring site and any campaign tags in the link), your approximate location (country, and region or city where available) derived from your connection, and your device type, browser, operating system, screen size, language and time zone. We also keep the IP address each visit came from, and the network it belongs to (for example, a cloud provider), for 12 months, to tell people apart from bots and automated link scanners, and then erase the address. If you create an account, this activity is linked to it.
How we use it
- To provide, secure and operate the platform and deliver the services you request.
- To authenticate you, including two-step verification by email or SMS.
- To take payment and issue invoices and receipts.
- To respond to your enquiries and provide support.
- To detect, prevent and investigate abuse, fraud and security incidents.
- To understand how visitors find and use our site, which campaigns and partners bring them, and where we can improve it.
- To meet our legal and regulatory obligations.
Our lawful bases are performance of our contract with you, our legitimate interests in running and securing the service, your consent (where asked), and compliance with law.
Sharing & sub-processors
We do not sell your personal data. We share it only with the service providers that make the platform work — payment, communications and AI providers among them. The current list, and what each one processes, is on our sub-processors page.
Cookies
We use a small number of first-party cookies. Essential cookies keep you signed in and protect forms and sign-in flows. Two analytics cookies, ch_vid (a random visitor identifier, kept for up to 13 months) and ch_sid (a visit identifier that expires after 30 minutes of inactivity), let us count visits and understand how people move through the site. They are set by us, contain no personal details, and the data they produce stays on our own systems — we do not use third-party advertising or analytics trackers. You can delete or block cookies in your browser settings at any time.
International transfers
Some sub-processors operate outside your country. Where personal data is transferred internationally, we rely on appropriate safeguards such as standard contractual clauses.
Retention
We keep account and engagement data for as long as your account is active and as needed to provide the services, then for the period required to meet legal, accounting and security obligations, after which it is deleted or anonymised. Website analytics records are kept for up to 25 months; the IP address on each visit is erased after 12 months.
Your rights
Subject to your local law, you may request access to, correction or deletion of your personal data, object to or restrict certain processing, and request portability. Contact [email protected] and we will respond within the timeframe the law requires. You may also complain to your local data protection authority.
Security
Passwords are hashed, sessions are signed and short-lived, transport is encrypted with TLS, and access to engagement data is scoped to your own company. No system is perfectly secure, but we work to protect your data in line with industry practice.
Changes
We will update this notice as the platform evolves and revise the “last updated” date above. Material changes will be communicated through the platform.