Privacy policy

This is the privacy policy for cybertoolbox.io (the marketing site) and app.cybertoolbox.io (the platform), operated by Cyber Toolbox Ltd (“we”, “our”, “us”). Cyber Toolbox is a New Zealand company. This policy is written under the New Zealand Privacy Act 2020 with awareness of the EU General Data Protection Regulation (GDPR).

1. What we collect

The marketing site collects nothing beyond standard server access logs (IP, user agent, timestamp, requested URL) retained for 30 days for security and aggregate analytics. No marketing cookies, no email-capture forms, no third-party advertising trackers.

The platform collects only what you give it: the email address you sign in with, the assets you register, the cases you open, and the content you capture inside cases. Authentication uses passkeys, TOTP, or magic-link email — your password (if you set one) is hashed and never stored in plaintext.

2. Why we collect it

To run your account, deliver the service, and produce the case records that are the product's output. We do not sell, rent, or share your data with advertisers or data brokers. Service providers (Stripe for billing, our hosting provider for infrastructure) process data on our behalf under their own privacy commitments.

3. Your rights

Under the NZ Privacy Act 2020 and GDPR you have rights to access, correct, and erase your data. Email privacy@cybertoolbox.io and we will respond within 20 working days (NZ Privacy Act statutory window) or 30 days (GDPR Art. 12 statutory window), whichever is shorter for your case.

4. Data residency

Data is hosted on infrastructure in Aotearoa New Zealand and the United States via Cloudflare and our database provider. Cross-border data transfers (NZ ↔ EU, NZ ↔ US) are covered under standard contractual clauses.

5. Cookies

The marketing site uses one functional cookie (theme preference: light or dark) stored in your browser's localStorage. No analytics cookies, no tracking cookies. The platform uses an HTTP-only session cookie that expires when you log out.

6. Security disclosure

If you find a vulnerability, please follow the disclosure process at /.well-known/security.txt.

7. Changes

We will update this policy when we change our data practices. The version date at the top is the source of truth. Material changes will be flagged inside the platform.

8. Contact

Cyber Toolbox Ltd, Aotearoa New Zealand. General contact: hello@cybertoolbox.io. Privacy contact: privacy@cybertoolbox.io.

This page is a plain-English summary written for v1 launch. It will be replaced with a formally-reviewed policy before paid billing goes live; the substantive commitments above are committed in good faith and will not be weakened in the formal version.