Privacy Policy

This policy explains what personal information CPRCyber collects, how we use it and who we share it with. It covers our website (cprcyber.com) and the CPRCyber app (app.cprcyber.com).

1. Our role

Organizations and managed service providers (MSPs) use CPRCyber to coordinate their own teams. The information an organization puts into CPRCyber about its people and contacts belongs to that organization, and we process it on the organization's behalf and under its instructions (our Terms of Service). If you are a user or contact of one of our customers, that organization decides what information about you is kept, and you can ask it to change or remove it.

2. What we collect

• Account information: your name, email address, password (stored only as a secure hash) and multi-factor authentication settings.
• Contact details: phone numbers (including mobile numbers used for alerts), email addresses, job titles, roles, groups and emergency contacts that you or your organization's admins add.
• Content you create: alerts and responses, incidents, playbooks, chats, meetings, files, compliance records and questionnaire answers.
• Usage and security records: sign-in events, an audit log of sensitive actions, delivery status of calls, texts and emails, and the technical logs (such as IP address and browser) that our hosting provider keeps to run and protect the service.
• Billing information: the plan, invoices and billing contact. Card details go directly to Stripe; we never see or store your card number.
• Website contact requests: the name, work email, company and message you send through our Contact support form.

3. How we use it

• To provide CPRCyber: signing you in, delivering alerts, calls, texts, emails and meetings your organization sends, and storing your organization's records.
• To keep CPRCyber secure: verifying identity, detecting misuse and investigating problems.
• To bill customers and to answer support and website contact requests.
• To tell customers about changes to CPRCyber, outages and their account.

We do not sell personal information, we do not use it for advertising, and we do not use customer content to train artificial intelligence models.

4. Mobile numbers and text messages

Mobile numbers are used only to deliver the alerts and calls your organization sends, and replies to them. We do not share mobile numbers or text message opt-in information with third parties or affiliates for their marketing or promotional purposes. Text messaging opt-in data and consent are never shared with any third party, except the service providers that deliver the messages for us. We record when each person agreed to alert texts and calls, for which number, and when they opted out, so we can show that alerts go only to people who agreed. See our SMS Terms for how to opt in and out.

5. Service providers we share with

We use these providers to run CPRCyber. Each receives only what it needs for its part:

• Vercel: hosts the website and app.
• Supabase: database, sign-in and file storage, in the United States.
• Twilio: delivers voice calls and text messages.
• Resend: delivers email.
• Daily: runs video meetings.
• Stripe: processes payments.

We may also disclose information when the law requires it, to protect the rights and safety of our customers or others, or as part of a sale or reorganization of our business, in which case this policy continues to apply.

6. Cookies

CPRCyber uses only the cookies needed to keep you signed in, and stores your light or dark mode choice in your browser. We do not use advertising or tracking cookies.

7. How long we keep it

We keep an organization's information while its account is open. When an account closes or is not paid, it goes through a 30-day grace period and a 90-day archive period and is then permanently deleted, as described in the Terms of Service. Backup copies are deleted as the backups expire, within 30 days. Demo requests are kept for up to two years unless you ask us to delete them sooner.

8. Security

We protect information with required multi-factor sign-in, database-enforced separation between customers, encryption in transit and at rest, and audit logging. See Security at CPRCyber.

9. Your choices and rights

You can view and update your own profile in the app. If you use CPRCyber through an organization, ask its admins to correct or remove information about you; we will help them do so. Depending on where you live, you may have rights to access, correct, delete or receive a copy of your personal information. To make a request or ask a question, email support@cprcyber.com.

10. Children

CPRCyber is a business service and is not meant for anyone under 16.

11. Changes

We will post changes here with a new date, and tell customers' admins before material changes take effect.