Privacy Policy

Effective September 3, 2026 · Version 2026-09-06

1. Information we handle

• Account and contact information, such as name, work email, organization, role, authentication and session information.
• Organization profile information, assessment answers, remediation status, notes, reports, and readiness history.
• Evidence files and information derived from evidence review when you choose to upload evidence.
• Operational and security information, such as device/session details, IP addresses, audit records, error records, and usage needed to secure and operate the service.
• Billing references and subscription status. Payment card details are collected and processed by the payment processor; Cyber Readiness Kit does not need the full card number to operate your workspace.
• Communications, support requests, and optional marketing consent where you choose to provide it.

2. How information is used

Information is used to provide and personalize the assessment, evaluate submitted evidence, generate recommendations and reports, manage accounts and billing, deliver transactional communications, secure and troubleshoot the service, prevent abuse, maintain audit records, and comply with legal obligations.

3. Service providers and AI-assisted analysis

We use service providers for infrastructure and hosting, database/storage, payment processing, email delivery, and other functions needed to operate the platform. When an evidence-analysis feature is run, relevant submitted material may be transmitted to the configured AI-processing provider for that analysis. Do not submit evidence that your organization is prohibited from sharing with such processors.

4. Billing

Payments are processed through Stripe or another disclosed payment processor. The processor handles payment credentials under its own privacy and security terms. Cyber Readiness Kit receives transaction, customer, subscription, and status information needed to provision and administer access.

5. Retention and cancellation

We generally retain workspace data after paid access ends so that an organization can return without starting over. We do not guarantee indefinite retention. We may delete inactive workspace data, including assessment history and evidence, when reasonably necessary for operational, security, legal, or business reasons. You may request deletion of account or workspace information, subject to records we must or reasonably need to retain for billing, security, fraud prevention, dispute handling, backup integrity, or legal obligations. If Cyber Readiness Kit is permanently discontinued, we may delete workspace data after reasonable notice and an opportunity to retrieve available information when practical. Backup copies may remain until they age out through normal backup cycles.

6. Security

We use administrative, technical, and access-control safeguards intended to protect platform information. No online system can be guaranteed completely secure, and customers remain responsible for protecting credentials and for deciding what evidence is appropriate to upload.

7. Organization-controlled information

If you use Cyber Readiness Kit through an employer, client, or other organization, that organization may control the workspace and may have rights to access, administer, export, retain, or delete information associated with it. Direct organization-specific requests to the organization administrator where appropriate.

8. Your choices and requests

You may update account information, cancel future renewal, revoke active sessions, and manage optional marketing consent where offered. Depending on applicable law, you may also have rights to request access, correction, deletion, or other handling of personal information. Requests may be sent to support@cyberreadinesskit.com.

9. Children

The service is intended for business use and is not directed to children under 18.

10. Changes

We may update this Privacy Policy as the service or legal requirements change. The current version and effective date will be posted here.