Privacy Policy

This Privacy Policy explains how 786 Cyber ("786 Cyber", "we", "us", or "our") collects, uses, stores, and protects personal data when you use our platform at https://786cyber.com ("Services"). We are committed to protecting your privacy and processing personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read this policy carefully. By using our Services, you acknowledge that you have read and understood this Privacy Policy.

---

1. Data Controller Information

The data controller responsible for your personal data is:

For any queries relating to this Privacy Policy or your personal data, please contact us at the email address above.

---

2. What Personal Data We Collect

2.1 Account Data

When you register for an account, we collect:

• Full name and email address
• Mobile phone number (verified by a one-time SMS code when you sign up)
• Password (stored as a secure hash — we never store passwords in plain text)
• Profile photo (if provided)
• Account creation date and last login date
• Authentication method (email/password, Google Sign-In or Microsoft sign-in)

2.2 Company / Organisation Profile Data

• Organisation name, industry sector, employee count and device count
• Geographic regions of operation, website URL, company logo
• Contact name, email address, and phone number
• Internet services and cloud providers in use
• Existing compliance certifications (e.g. ISO 27001, Cyber Essentials)
• Known vulnerabilities and risk concerns (as self-reported)
• Date of last penetration test
• How your organisation first found our website (first page, referring website and campaign tags), if the person who signed up accepted analytics cookies (section 2.7)

2.3 Usage Data

• IP address, browser type, operating system
• Pages visited and features used within the platform
• Session duration, timestamps, errors, and diagnostic information

2.4 Compliance and Security Data

• Compliance questionnaire responses
• AI-generated compliance roadmaps and recommendations
• Policy documents you create or upload
• Security controls and their implementation status
• Audit evidence and supporting documentation

2.5 Payment Data

• Billing name and address
• Payment card details (processed and stored by Stripe — we do not store card numbers)
• Transaction history, invoice records, and VAT number (where applicable)

2.6 Communications Data

If you contact us, including through the support chat on our website and platform, we collect your name, email address, and the content of your communication.

2.7 Website Visit Data

When you visit our website (786cyber.com, including the documentation and the sign-up page), our own analytics tool, Umami, records:

• The pages you view, the page you arrived from (referrer) and any campaign tags in the link (UTM parameters)
• Your approximate location (country, region and city, worked out from your IP address; the IP address itself is not stored), browser, operating system, device type, screen size and language
• Clicks on sign-up, pricing, contact and download links, form submissions (not what you typed) and links to other websites
• On the sign-up page only: that sign-up was started and completed. We never send your name, email address or account details to the analytics tool

For every visitor, this works without cookies: nothing is stored on your device, and visits are counted using a one-way code made from your IP address and browser details mixed with a secret value that is replaced every month, so your visits cannot be linked together over a longer period and the code cannot be turned back into your IP address. If you accept analytics cookies, we also set one cookie with a random ID so that we can tell when someone comes back, and one that remembers how you first found us (below and section 7). Umami runs on our own server in the UK; no third party receives this data, and we do not use it for advertising.

How you first found us. If you accept analytics cookies, we also remember the first page you landed on, the website that sent you (its domain only) and any campaign tags in that first link, together with the date. If you later create an account, send us a form (for example a framework guide request, a partner or Advisory Panel enquiry, or a contact form) or start a chat with us, we add those details to the record created for you or your organisation in our customer relationship system. We do this to understand which pages and campaigns bring people who go on to contact us or sign up. We don't add your browsing history, only how you first found us. If you don't accept analytics cookies, none of this happens.

2.8 Data We Process on Behalf of Our Customers

When an organisation uses 786 Cyber, it may bring in data about its own staff and devices — for example by connecting Microsoft 365 or Google Workspace, connecting a cloud account, importing a CSV or adding records by hand. This can include staff names, work email addresses, phone numbers, job titles, departments, managers, devices, sign-in and MFA status, and whether a work email address appears in a known data breach. For this data the organisation is the controller and 786 Cyber is its processor: we process it only on the organisation's instructions, under our Data Processing Agreement (DPA). If you are a member of staff at one of our customers, please contact your employer about this data; we will pass any request we receive to them.

---

3. How We Use Your Personal Data

Purpose	Description
Service delivery	To provide, operate, and maintain the 786 Cyber platform
Account management	To create and manage your user account and organisation
AI-assisted features	To generate compliance roadmaps, policy suggestions, and security recommendations using the Claude API
Billing and payments	To process subscription payments and manage invoices
Customer support	To respond to your queries, support requests, and feedback
Security and fraud prevention	To detect, prevent, and investigate security incidents or misuse
Platform improvement	To analyse usage patterns and improve our Services (using aggregated/anonymised data where possible)
Website analytics	To measure how many people visit our website, how they find it, which pages and links they use and how many go on to sign up, so we can improve the site and our marketing (section 2.7)
Marketing attribution	To see which website pages and campaigns bring people who sign up or contact us, using how you first found us (section 2.7), only if you accepted analytics cookies
Legal compliance	To comply with our legal obligations under applicable law
Communications	To send service-related notifications, security alerts, and (where consented) marketing communications

---

4. Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

• Contract (Article 6(1)(b)): Processing necessary to perform our contract with you — including account creation, service delivery, and billing.
• Legitimate Interests (Article 6(1)(f)): Processing for platform security, fraud prevention, product improvement, customer support, and cookieless website analytics (counting visits and measuring how the website is used, without storing anything on your device).
• Legal Obligation (Article 6(1)(c)): Processing required to comply with applicable law, including tax records and lawful authority requests.
• Consent (Article 6(1)(a)): Where we rely on consent (e.g. marketing emails, the analytics cookies described in section 7, and adding how you first found us to your record, section 2.7), you may withdraw consent at any time.

---

5. Data Retention

Data Category	Retention Period
Account data	Duration of account + 30 days after deletion
Organisation and compliance data	Duration of subscription + 30 days after termination
Payment and billing records	7 years (UK tax law requirement)
Server and diagnostic logs	30 days rolling
Cloud infrastructure audit logs (administrative actions on our systems)	400 days
Database backups	Overwritten on a rolling basis, within 30 days
Support communications	3 years from date of last contact
Marketing consent records	Until consent is withdrawn + 1 year
Website analytics (section 2.7)	26 months, then deleted
First-touch details on your record (section 2.7)	For as long as the record is kept (account data: duration of account + 30 days; enquiries and chats: 3 years from last contact), or until you ask us to remove them

After the applicable retention period, data is securely deleted or anonymised. You may request early deletion subject to our legal retention obligations.

---

6. Your Rights Under UK GDPR

To exercise any right, contact us at privacy@786cyber.net. We will respond within one calendar month. There is no charge except for manifestly unfounded or excessive requests.

6.9 Right to Complain

You have the right to lodge a complaint with the Information Commissioner's Office (ICO):

We would appreciate the opportunity to address your concerns before you contact the ICO.

---

7. Cookies

7.1 What Are Cookies?

Cookies are small text files stored on your device when you visit our platform. We use cookies to ensure the platform functions correctly and to understand how it is used.

7.2 Types of Cookies We Use

Cookie Type	Purpose	Duration
Essential / Strictly Necessary	Required for the platform to function (e.g. authentication session cookies)	Session / up to 1 year
Functional	Remember your preferences (e.g. dark/light mode) and run the support chat widget	Up to 1 year
Analytics (_786a)	Set only if you accept analytics cookies. Holds a random ID that lets our own analytics tool recognise you when you return to the website. Not shared with anyone and not used for advertising	13 months from your last visit
Analytics (_786ft)	Set only if you accept analytics cookies. Remembers the first page you landed on, the referring website and any campaign tags, so they can be added to your record if you later sign up, send a form or start a chat (section 2.7). Not shared and not used for advertising	13 months from your last visit

7.3 Analytics Without Cookies

Whether or not you accept analytics cookies, our website counts visits using Umami, our self-hosted analytics tool, in a mode that stores nothing on your device (section 2.7). Its visit code is reset every month, so it cannot link your visits over a longer period. Accepting analytics cookies adds the two analytics cookies above.

7.4 Managing Cookies and Opting Out

We show a cookie notice on your first visit and respect your choice. You can change it at any time with the Cookie Settings link at the foot of every page; withdrawing consent deletes both analytics cookies straight away and stops first-touch details being added to any record from then on. To have first-touch details removed from a record that already holds them, email privacy@786cyber.net. To stop all website analytics on a device, including the cookieless counting, open any page of our website with ?notrack=1 at the end of the address (for example 786cyber.com/?notrack=1); ?notrack=0 turns it back on. You can also object by emailing privacy@786cyber.net, or control cookies in your browser settings. Disabling essential cookies may affect platform functionality.

---

8. Third-Party Services and Sub-processors

We use the following service providers to run 786 Cyber. Each processes personal data only to provide its service to us, under a written contract.

8.1 Systems we operate ourselves

Our customer-relationship (CRM), email-marketing and support-chat systems (Twenty, Mautic and Chatwoot) run on a server we operate. They hold the contact details of people who sign up, buy, enquire or chat with us, and the content of those conversations. They do not hold the staff, device or scan data that customers bring into the platform.

8.2 Security intelligence services

To scan our customers' internet-facing systems we send domain names, public IP addresses and vulnerability identifiers — not personal data — to security intelligence services including Shodan, Censys, VirusTotal, AbuseIPDB, AlienVault OTX, abuse.ch, APIVoid, crt.sh, Qualys SSL Labs, Mozilla Observatory, domain registration (RDAP/WHOIS) services and NIST's National Vulnerability Database.

Business customers can request our Data Processing Agreement and full sub-processor list at privacy@786cyber.net. We do not currently use any analytics or error-monitoring services.

---

9. Google Workspace Integration & Limited Use of Google User Data

If you choose to connect your organisation's Google Workspace to 786 Cyber, we access a limited, read-only set of administrative data through Google APIs in order to provide our Environment & People features — your people directory and asset inventory. This integration is optional — the platform is fully usable without it — and is initiated by a Google Workspace administrator who grants consent on behalf of their organisation.

9.1 Google API scopes we request

Scope	Why we request it
admin.directory.user.readonly	Read-only access to the Workspace user directory (name, email, department, organisational unit, suspension/archive status, last sign-in, 2-Step Verification enrolment) to build your people directory and surface joiner/mover/leaver and MFA-coverage gaps.
admin.directory.device.mobile.readonly	Read-only access to the managed phones and tablets used with your organisation's accounts (model, OS version, management status, last sync) to populate your asset inventory and assess device security posture.

We request read-only scopes only. 786 Cyber cannot modify, create, or delete any data in your Google Workspace.

9.1a Optional: full device inventory (domain-wide delegation)

If your administrator wants laptops and desktops (Windows, Mac, Linux, ChromeOS) and company-owned phones in the asset inventory as well, they can separately authorise 786 Cyber's service account in the Google Admin console (Security → API controls → Domain-wide delegation). This is not requested through the sign-in consent screen, happens only if your administrator adds it, and can be removed there at any time.

Scope

Why we request it

cloud-identity.devices.readonly

Read-only access to your organisation's device inventory (device type, model, OS version, serial number, company-owned or personal, management, encryption and compromise status, last sync, and the email of the user signed in on each device) to populate your asset inventory and link each device to its owner. We act only as the administrator who connected your Workspace, and only for your organisation.

9.2 How we use Google user data

• To display your own users and devices back to your administrators within the 786 Cyber platform.
• To generate compliance and security-posture insights (e.g. identity coverage, MFA enrolment, device patch status) for your organisation.
• Data is stored only for as long as your Workspace connection remains active and is deleted in line with Section 5 (Data Retention) when you disconnect the integration or close your account.

9.3 Limited Use commitment

786 Cyber's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the user-facing features described above.
• We do not transfer or sell Google user data to third parties, data brokers, or for advertising, ad-targeting, or credit-assessment purposes.
• We do not use Google user data to train, develop, or improve generalised or non-personalised AI / machine-learning models. (Our AI features process compliance content only and are not fed Workspace directory or device data for model training.)
• We do not allow humans to read Google user data unless: (a) we have your specific consent for a support request; (b) it is necessary for security purposes (e.g. investigating abuse); (c) it is required to comply with applicable law; or (d) the data has been aggregated and anonymised for internal operations.

---

10. International Transfers of Personal Data

Our platform data is stored in Google Cloud in London, with database backups in the European Union. Some of the service providers in Section 8 process personal data outside the UK — in the European Union (Mailgun, Stripe), the United States (Anthropic, Stripe, and Google's sign-in services) and Australia (Have I Been Pwned). Where a transfer is to a country without UK adequacy regulations, we protect it with:

• the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses
• the UK Extension to the EU-US Data Privacy Framework, where the US recipient is certified
• transfer risk assessments, where required

---

11. Data Security

We implement a range of technical and organisational security measures to protect your personal data, including:

• Encryption of data in transit (TLS/HTTPS)
• Encryption of data at rest (Google-managed encryption for our database, file storage and backups)
• Data stored in the UK (London), separated by organisation and checked on our servers for every request
• Role-based access controls within the platform
• Phone verification at sign-up, and sign-in with Google or Microsoft so your organisation's own multi-factor authentication applies
• Read-only access to connected Microsoft, Google and cloud accounts
• Regular review of security practices and sub-processor security assessments
• Incident response procedures for data breaches

In the event of a personal data breach likely to result in risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals without undue delay. Where we process data for a business customer, we notify that customer as set out in our Data Processing Agreement.

---

12. Children's Data

Our Services are intended for business use by adults aged 18 and over. We do not knowingly collect personal data from children under the age of 18. If we become aware that we have collected data from a child, we will delete it promptly.

---

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by email or via an in-app notice. The "Last updated" date at the top of this page will always reflect the most recent revision.

We encourage you to review this policy periodically.

---

14. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or your personal data:

This Privacy Policy was last reviewed and updated on 13 October 2026.