Snapshot 38444
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Skip to content Privacy Policy Effective 28 September 2026 · What we collect, why, and your choices The short version: we collect what's needed to run your security program — your contact details, your domain, scan results about your public systems, and the documents we generate for you. We don't sell your data. Your documents are yours. 1. What we collect Account data: company name, contact name and email, domain, industry, plan. Program data: scan results for your domain's public footprint, generated policies, readiness state, action items, vendors you record, usage of metered features. Billing data: handled by our payment processor, Stripe; we never store card numbers. Free-scan leads: the email and domain you submit to receive your report. 2. How we use it To deliver the Service: generate documents, run scheduled scans and monitoring, send your setup link, monthly recap, renewal notices, and alerts. AI-assisted features process your program data with our AI provider solely to produce your deliverables. Optional integrations (breach monitoring, phishing simulation) process only what you enable. 3. Sharing We share data only with processors needed to run the Service, under their respective terms: our hosting provider, our payment processor (Stripe), our email delivery provider, Anthropic for AI document generation (see the AI subprocessor disclosure), and Have I Been Pwned for breach lookups if breach monitoring is enabled. We do not sell personal data. Your trust page, if you enable it, shares only what the page displays, via a private link you control and can rotate. Where we process personal data on your behalf, our Data Processing Addendum (DPA) applies. Managed-plan customers receive it with their contract; self-serve customers can request it at signup or at any time from [email protected]. 4. Retention & deletion Program data is retained while your account is active and for backup cycles thereafter. Email us to delete your account data; we will remove it within 30 days except records we must keep for legal or billing reasons. 5. Security Data is encrypted in transit, access is authenticated and audit-logged, and sensitive actions are recorded. No provider can promise absolute security; we notify affected customers of incidents without undue delay. 6. Your choices You can download your documents at any time, opt out of non-essential emails, rotate or disable your trust page, and request access, correction, or deletion of your data at the address below. CyberComply is a product of DigComply Solutions Private Limited (in association with CA4CPA Global LLC). © 2026 DigComply Solutions Private Limited. Questions: [email protected]