Privacy Policy

Your privacy is important to us. We are committed to processing only the minimum personal data required to operate our service securely and effectively. This policy explains what information we collect, how we use it, how it is protected, and your rights regarding your data.

Data Collection

We collect only the personal data necessary to provide and support our services. This includes account identifiers (such as email addresses), authentication tokens, and usage data needed for security, troubleshooting, and support. We do not collect unnecessary personal information.

How Data is Used

Your data is used solely to authenticate users, maintain account access, ensure system security, and provide customer support. Uploaded files remain your property and are stored encrypted in Amazon S3. Authentication is managed securely through Amazon Cognito.

Mobile App

The CyberVault mobile app uses the same account as the web app and shows the same activity. To send push notifications, it registers a push token for your device, with its platform (iOS or Android), and notifications are delivered through Expo and through Apple or Google. A notification on your lock screen says only what kind of event happened, never the client, project or content. Turning notifications off or signing out removes your device's token. The app does not track you across other apps or websites and shows no advertising.

Data Sharing

We do not sell or rent your personal data. Data may be shared with trusted third-party providers (such as Amazon Web Services) only as necessary to deliver and secure the service. All third parties are required to maintain strict confidentiality and data protection standards.

Security

We use industry-standard security measures to protect your data, including encryption in transit and at rest, access controls, and regular security reviews. Uploaded files are encrypted and securely stored. Only authorized personnel have access to your data.

Data Retention

We retain your personal data only as long as necessary to provide our services and comply with legal obligations. When you ask us to delete your account, by email or from the mobile app, we close it and securely delete your personal details from our systems within 30 days. Records that belong to an assessment, such as evidence, answers, comments and reports, are kept for as long as that assessment's retention obligations require, attributed to a former user.

Your Rights

You have the right to access, correct, or delete your personal data, as well as to object to or restrict certain processing. To exercise data rights or request deletion, email cybervault@247cyberlabs.com, or in the mobile app use Settings › Request account deletion.