RightCyber keeps the hosted service narrow: Stripe handles payment, sign-in stays with your account, and Builder workspace content stays in local folders you control.
This notice covers rightcyber.co.uk accounts, purchases, downloads, desktop licensing and support. Updated 6 September 2026.
RightCyber Analysis is a separate hosted service. Submitted assessment answers and notes are stored online and may be sent to an AI provider for report wording. Read the RightCyber Analysis privacy notice before using that service. The local-storage description below applies to Workspace, not to hosted Analysis submissions.
Right Cyber UK Limited (company number 17307435, trading as RightCyber) is the controller for customer access, licence, support, and operational records created by this service. Send privacy requests to info@rightcyber.co.uk; include the checkout email only when it is needed to find the relevant customer record.
An account can exist without a purchase. We store your name, email address, verification status and, where supplied, profile image. You can use a password or a one-time email link or code; Google and Microsoft sign-in are available when enabled. A password account stores a password hash, not the password in readable form. Social sign-in can store the provider account identifier, profile information and encrypted provider tokens.
We also store verification and recovery records and sign-in sessions, including the IP address and browser user-agent for each session. When checking a new password against known data breaches, the server sends only the first five characters of its SHA-1 hash to Have I Been Pwned. It does not send your full password, full hash or email address in that request.
When the account downloads a licensed document (for example from the Cyber Essentials Policy Pack), RightCyber records which document and version was downloaded, when, the purchase or licence it was downloaded under, and a truncated hash of the requesting IP address rather than the address itself. The licence-stamped Policy Pack files include the account email address as the licensee; catalogue packs delivered from our download storage do not receive that per-account stamp. RightCyber intends to keep these download records for the life of the account plus 12 months, to enforce the single-organisation licence and investigate misuse.
Builder answers, notes, evidence and exports never leave your computer through the normal product flow; an account does not change that. To delete an account, email info@rightcyber.co.ukfrom the address on the account. Deletion is handled by request and does not remove Stripe's payment records or any local Builder folders and backups on your own devices.
We process the email used for checkout and sign-in, product entitlements, subscription and access dates, Stripe customer and subscription references, Better Auth session and verification records, and support details you choose to submit. The contact form collects your name, reply email, support topic, relevant product, subject and message. It does not accept attachments.
Operational records may include checkout and magic-link attempts, webhook results, access changes, rate-limit events, session clearing, and audited internal support lookups. The database may also retain limited progress identifiers and timestamps from earlier product use; these do not contain Builder answers or evidence.
To activate the Consultant desktop and enforce the device and active-client allowances of the purchased tier, the hosted service stores activation status, a public device identifier, a hash of the device secret, device label/platform/app version where supplied, and licence refresh timestamps.
For each registered client workspace, the registry may store a random public workspace identifier, an optional client display name, active or archived status, the registering device, timestamps, and account-level counts. It does not store the workspace contents.
Use a client reference or alias where a person's name is unnecessary. Do not put confidential assessment details into a device label or client display name: these labels are part of the hosted registry, not the local evidence files.
We process account, purchase, licence and requested support information where necessary to provide the service under a contract with you. Where you act for an organisation, rather than being personally party to that contract, we use relevant business contact and licence information for our legitimate interests in delivering and administering that organisation's service. Limited client registry information supports licence administration; it is not an assessment of the client.
Security controls, operational logs, fraud and abuse prevention support our legitimate interests in operating a reliable and secure service. We retain information required for legal and accounting obligations. Optional Google Analytics uses your consent, which you can withdraw in Cookie preferences. A purchase or support enquiry does not subscribe you to marketing.
RightCyber uses Stripe Managed Payments for checkout, tax, receipts, refunds, and billing; Neon for operational database hosting; Vercel for website and API hosting; Resend for sign-in and access email and delivery of support messages to the monitored mailbox; and Cloudflare R2 for installer and document files. Google or Microsoft receives sign-in requests when you choose that provider. Have I Been Pwned receives the limited password-check prefix described above. These providers can also process data for their own purposes under their notices. HubSpot receives the contact-form details listed above to create or associate a contact and support ticket. The integration is account-bound, limited to the approved support pipeline and retains Resend as a delivery fallback. Sentry monitoring is used only when configured. Google Analytics is an optional service used only after you accept analytics cookies.
The Community page includes YouTube Shorts. Their thumbnails are served through this website. A YouTube player connects to YouTube only when you choose to load it, using YouTube’s privacy-enhanced player. YouTube then receives information such as your IP address and browser details. Voting, quiz answers and comments take place on YouTube under Google’s privacy policy. Loading a video does not change your website analytics preference.
When enabled, Google Analytics helps us understand visits to our public website. It loads only after you accept analytics; rejecting analytics sends no requests to Google through this integration. It measures public page visits and browser/device information using pseudonymous cookie identifiers. Page URLs exclude query strings and fragments, and referring URLs are reduced to their website origin.
We do not send account identifiers, contact-form contents or Builder workspace data to Google Analytics. Account, sign-in, checkout-result and internal pages are excluded. This integration does not enable Google signals or advertising features.
Your choice is remembered in this browser for 180 days. If you accept, the _ga and _ga_ prefixed analytics cookies are set for up to 180 days without extending their expiry on each visit. You can change your choice using Cookie preferences in the footer. Withdrawing consent stops collection, clears these cookies and reloads the page when needed. It does not erase analytics data already received by Google.
Google may process analytics data outside the UK. See Google's Privacy Policy for information about its processing and international transfers.
Stripe acts as Merchant of Record for payment processing, applicable tax, invoices, and receipts. RightCyber receives the customer, subscription, and payment references needed to operate access, but does not receive or store full card numbers.
The Consultant desktop Builder stores client organisation details, answers, notes, evidence references, copied evidence files, pasted screenshots, gaps, actions, reports, Evidence Pack exports, and workspace backups locally on your computer or in customer-controlled folders. The hosted RightCyber service does not receive that material through the normal product flow.
Do not send full evidence packs, raw screenshots with secrets, passwords, keys, authentication links, device secrets, or private client records to support. Use redacted screenshots and safe descriptions when support context is genuinely needed.
Because the Builder is local-first, RightCyber cannot recover a lost workspace, overwritten local save, missing evidence file, deleted export, or backup you did not keep.
Customer, subscription, and licence records are retained while access is active and for as long as a continuing tax, refund, dispute, fraud-prevention, security, support, or legal need applies. RightCyber has not yet implemented an automated deletion schedule for those product records; deletion and minimisation requests are reviewed manually where the law and operational obligations permit. Our support retention policy requires at least quarterly reviews and deletion no later than 12 months after the last meaningful support activity unless an active dispute, security investigation, or legal obligation requires longer. Requests for access, correction, or deletion are handled within one calendar month. Rate-limit events are pruned by the operational cron using RATE_LIMIT_RETENTION_HOURS, which defaults to 24 hours. The support retention process applies to messages delivered through Resend and, when enabled, to HubSpot contacts and tickets, subject to a documented legal exception and the provider's own legal obligations.
Some of the providers above process data outside the UK — for example on United States infrastructure operated by Vercel, HubSpot, or Resend. Where they do, transfers rely on the UK-approved safeguards in each provider's data-processing terms, such as the UK International Data Transfer Addendum or an applicable adequacy decision. Contact info@rightcyber.co.uk for information about the safeguards applicable to your information and how to obtain a copy, subject to necessary protection of confidential details.
If you are unhappy with how your data has been handled, you can raise a data-protection complaint at info@rightcyber.co.uk. We will acknowledge it within 30 days, investigate appropriately, keep you informed and communicate the outcome without undue delay. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk. A complaint and a request to exercise your data rights follow separate handling timelines.
Depending on the processing and applicable conditions, you can request access, correction, erasure, restriction or portability of your personal information, and object to processing based on legitimate interests. You can withdraw consent for processing that relies on it; this does not change the lawfulness of earlier processing. Email info@rightcyber.co.uk and include the checkout email only if needed to identify the record. We will explain any lawful reason that limits a request. Deleting a RightCyber record does not delete independently retained Stripe payment records or local Builder folders and backups on your own devices.
