How we handle your data.

CYPHWARD TECHNOLOGIES LTD (“Cyphward”, “we”, “us”) runs the Cyphward security platform at cyphward.com. This policy explains what we collect, why, and what you can ask us to do about it. It follows Nigeria's Data Protection Act (NDPA 2023) and comparable rules in the countries where we operate.

Questions? Email privacy@cyphward.com — a real person replies.

Account details: your name, work email, and an encrypted (hashed) version of your password. We never see or store your password in plain text.

What you point us at: the domains and websites you add, and everything our scans discover about them — open ports, TLS certificates, DNS records, headers, and security findings.

How you use the product: sign-in times, pages visited, and actions like starting a scan — used to keep your account secure and to fix bugs.

Payment details: handled by our payment provider; we only keep billing status and receipts.

If you choose “Continue with Google”, we receive your Google account ID, name, and email address. We use them for one thing only: to sign you in and keep your account matched to the right email address.

We do not use your Google data for advertising, and we do not sell it or share it with anyone else. This follows Google's Limited Use rules and the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google sign-in at any time by setting a password and signing out, or by removing the app from your Google account's “Third-party access” page.

All product email — welcome notes, email verification codes, password reset links, scan reports — is sent through Brevo, our email provider. Brevo processes your name, email address, and the message content solely to deliver it on our behalf. We never rent or sell mailing lists, and we don't send marketing email unless you opt in.

We use a small set of processors to run the platform:

• Supabase — hosts our database (your account and scan data)
• Brevo — sends transactional email
• Google — optional sign-in only
• Cloud AI providers — when you ask CyphBot or an “explain finding” action to summarise a finding, the relevant finding text is processed to generate that answer
• Hosting & CDN — serves the app and blocks abuse

Each processor is bound by contract to use your data only for our instructions. We do not sell your personal data. If a regulator in another country requires it, we may disclose data we are legally compelled to hand over — never otherwise.

We keep account data while your account is open. Scan history and findings stay while the account is active so your reports remain complete.

Ask us to delete your account and we remove your profile, domains, and scan data within 30 days, keeping only the minimum records the law requires (for example, billing invoices). Password reset links expire after 30 minutes and work once.

Passwords are stored with argon2id (one-way). Sessions are signed JWTs with rotating refresh tokens you can revoke. Traffic is encrypted in transit (HTTPS). Access inside the company is limited to the people who need it to run the service, and org data is isolated per tenant with role checks on every request.

If we ever learn of a breach that affects your personal data, we will tell you and the relevant regulator as the law requires.

Under the NDPA 2023 (and similar laws) you can ask us to:

• give you a copy of the personal data we hold about you
• correct anything that is wrong
• delete your data (“right to be forgotten”)
• stop or restrict how we use it
• hand your data to another provider in a portable format

Email privacy@cyphward.com. We respond within the time the law allows (and aim for 7 days). You may also complain to your national data protection authority — in Nigeria, the NDPC.

We don't run advertising trackers. We use essential browser storage only: to stay signed in, remember your theme (light/dark), and keep your workspace preferences on your device.

Cyphward is built for businesses. It is not directed at children under 16, and we do not knowingly collect their data.

When we make a material change, we will update the date at the top and, for significant changes, notify you by email or in the product before the change takes effect.

CYPHWARD TECHNOLOGIES LTD — Data protection questions: privacy@cyphward.com

See also our Terms of Service.