Privacy notice

Information we handle

• Account and preferences: your email, sign-in information, name, selected role, country, jurisdiction, interests and preferred answer level.
• Questions and audit records: question text, your account ID, answer mode, outcome, source identifiers, model information, timestamps and reasons an answer was withheld. Questions can be logged even when you do not save an answer.
• Saved work: workspace titles, notes, action descriptions, owner labels, priorities, dates and status. When you choose Save answer, we store a snapshot of the question, answer, original status, sources and generation time.
• Access and service records: your preview entitlement and operational records used to maintain the service and investigate failures.

Action owner names are labels for your own records. They do not invite or notify anyone.

How information is used

We use account information and preferences to provide and personalize CyberGuide, questions to generate guidance, and saved work to provide workspace and export features. Audit and operational records help us diagnose failures, review answer quality and protect the service.

Providing an account and processing your requested questions and saved work supports delivery of the service. Security and quality review supports our legitimate interests in operating a reliable service, subject to your applicable data-protection rights.

Service providers and AI processing

Supabase provides account and database services. Vercel hosts the application. OpenAI processes question content for interpretation, source discovery and answer generation when those features are used. Requests may also contain retrieved source material or a draft answer for review. Source discovery can use web search.

Workspace notes and action plans are not automatically included in AI requests. Information you paste into a question is part of that question. Do not submit passwords, access tokens or personal or confidential information you are not authorized to share.

Service providers may process information outside Nigeria. Their operational logs, backups and retention arrangements are separate from the application's audit cleanup. Contact us for questions about these arrangements.

Opening a source link takes you to an external site with its own privacy practices.

Retention and deletion

In this preview, Ask audit records become eligible for deletion after 30 days. An hourly cleanup removes eligible records on its next successful run. An interruption can delay cleanup.

Saved workspaces, notes, actions and answer snapshots remain until you delete them or your account is deleted. Expiry of Pro access does not delete your work: you can still read, export and delete it.

Deleting a workspace removes its saved answers and actions. It does not remove the separate Ask audit records, which follow the audit retention period. Profile information remains associated with your account until it is updated or the account is deleted.

Database deletion does not immediately remove copies from provider logs or backups, or files you have already downloaded. An exported brief remains on your device until you remove it.

Sign-in and access controls

CyberGuide uses cookies to maintain your sign-in session. Workspace access is restricted to its account owner through application and database controls. Saved answers are signed to detect changes to their contents; this signature is not encryption.

Your choices and requests

You can update supported profile fields in Profile, delete individual saved answers and actions, delete a workspace and export a workspace brief. A workspace brief is not a complete export of all account information.

To request access, correction, deletion, a copy of your information, or to raise an objection or restriction request, contact privacy@stratasec.org. Requests are handled subject to applicable data-protection law.

When account deletion is available in Profile, you can confirm deletion there using your current password. Otherwise, or if additional verification is needed, email an account-deletion request from your registered address. We may need to verify your identity before acting. Never send your password or sign-in codes. Sending the email does not automatically delete your account.

You may also raise a privacy concern with the Nigeria Data Protection Commission or the relevant authority for your jurisdiction.

Changes to this notice

We will update this page when the service's data practices change. The date above identifies this version.