Privacy Policy

Effective date: 17 September 2026

1. Scope

This policy explains what personal information CyberFight (operated by Paige Nelson Strategy, Washington, DC) collects through cyberfight.app and related services, how it is used, and the choices you have.

2. What we collect

Account information: name, email address, organization, role, and the password you set (stored hashed; we cannot read it).

Subscription and payment information: your subscription tier, billing history and the last four digits and expiry of your card. Full card details are collected and stored by Stripe, our payment processor, not by us.

Requests you send us: the contents of the partner pricing, executive briefing and contact forms (organization, name, email, sector, notes) and any email you send us.

Usage information: pages viewed, features used, exports run, email opens and link clicks on assessment emails, the time zone you select, and standard technical data such as IP address, browser and device type. We use this to operate the Service, enforce seat limits, diagnose problems and understand which content is useful.

Watchlist terms: the supplier, technology or keyword terms your organization enters. These are used only to match events for your organization.

We do not collect special-category data and we ask you not to submit it.

3. How we use information

To provide and bill the Service; to send the assessments, alerts and account emails you subscribe to; to respond to requests; to run integrity, security and abuse checks; to enforce seat limits and these Terms; to improve the Service; and to comply with law. If you request a briefing or partner pricing we will contact you about that request. We do not sell personal information and we do not use it for third-party advertising.

4. Legal bases (where applicable)

Where GDPR or similar laws apply, we process information to perform our contract with you, for our legitimate interests in operating and securing the Service, with your consent where required (for example marketing email), and to comply with legal obligations.

5. Who we share information with

Service providers who process data on our behalf under contract: Supabase (database and authentication hosting), Lovable (application hosting and transactional email delivery), Stripe (payments), and the email delivery provider for assessment and account email. We share information when required by law, to protect the Service or others, or in a business transfer, in which case this policy continues to apply. Partner desks: if you access CyberFight through a partner, the partner can see seat-level usage for its own clients (last sign-in, email open status) but not your password or watchlist terms of other organizations.

6. Cookies and local storage

We use strictly necessary cookies and browser storage for sign-in, session security and your display preferences (theme, time zone, filters). We do not use third-party advertising or tracking cookies. Assessment emails contain an open-tracking pixel and tracked links so that seat owners can see delivery status.

7. Retention

Account and subscription records are kept for the life of the account and for seven years after closure for tax and audit purposes. Form requests are kept for 24 months. Usage logs are kept for 13 months. Watchlist terms are deleted when the organization is deleted. You can ask us to delete your account at any time; we will do so within 30 days except where retention is required by law.

8. Security

We use encrypted connections, hashed passwords, role-based access, row-level database security and automated integrity checks. No system is perfectly secure; if we learn of a breach affecting your information we will notify you as required by law.

9. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal information, to object to or restrict processing, and to withdraw consent. Email CyberFightHelpDesk@PaigeNelsonStrategy.com; we will respond within 30 days. You may unsubscribe from marketing email at any time; assessment emails are part of the paid Service and stop when the seat is removed or the subscription ends.

10. International transfers

We are based in the United States and process data there. If you access the Service from elsewhere, you understand that your information is transferred to and processed in the United States.

11. Children

The Service is for organizations and professionals and is not directed to anyone under 18. We do not knowingly collect information from children.

12. Changes

We will post changes here with a new effective date and notify paid accounts by email of material changes.

13. Contact

CyberFightHelpDesk@PaigeNelsonStrategy.com. Paige Nelson Strategy, Washington, DC.