RightCyber keeps the hosted service narrow: Stripe handles payment, sign-in stays with your account, and Builder workspace content stays in local folders you control.
This notice covers rightcyber.co.uk accounts, purchases, downloads, desktop licensing and support. Updated 27 October 2026.
RightCyber Analysis is a separate hosted service. Submitted assessment answers and notes are stored online and may be sent to an AI provider for report wording. Read the RightCyber Analysis privacy notice before using that service. The local-storage description below applies to Workspace, not to hosted Analysis submissions.
Right Cyber UK Limited (company number 17307435, trading as RightCyber) is the controller for customer access, licence, support, and operational records created by this service. Send privacy requests to info@rightcyber.co.uk; include the checkout email only when it is needed to find the relevant customer record.
An account can exist without a purchase. We store your name, email address, verification status and, where supplied, profile image. You can use a password or a one-time email link or code; Google and Microsoft sign-in are available when enabled. A password account stores a password hash, not the password in readable form. Social sign-in can store the provider account identifier, profile information and encrypted provider tokens.
We also store verification and recovery records and sign-in sessions, including the IP address and browser user-agent for each session. When checking a new password against known data breaches, the server sends only the first five characters of its SHA-1 hash to Have I Been Pwned. It does not send your full password, full hash or email address in that request.
When the account downloads a licensed document (for example from the Cyber Essentials Policy Pack), RightCyber records which document and version was downloaded, when, the purchase or licence it was downloaded under, and a truncated hash of the requesting IP address rather than the address itself. The licence-stamped Policy Pack files include the account email address as the licensee; catalogue packs delivered from our download storage do not receive that per-account stamp. RightCyber intends to keep these download records for the life of the account plus 12 months, to enforce the single-organisation licence and investigate misuse.
Builder answers, notes, evidence and exports never leave your computer through the normal product flow; an account does not change that. To delete an account, email info@rightcyber.co.uk from the address on the account. Deletion is handled by request and does not remove Stripe's payment records or any local Builder folders and backups on your own devices.
We process the email used for checkout and sign-in, product entitlements, subscription and access dates, Stripe customer and subscription references, Better Auth session and verification records, and support details you choose to submit. The contact form collects your name, reply email, support topic, relevant product, subject and message, plus any campaign tags and landing page, as described under Analytics and cookie preferences. It does not accept attachments. The Help button opens a Zoho Desk form that collects your name, email, subject, message and any attachments you choose to add.
If you book the free automation call through our calendar, we collect your name, email, the time you choose and anything else the booking form asks for. The booking is kept with a contact record in our HubSpot account and used to arrange and hold the call.
Operational records may include checkout and magic-link attempts, webhook results, access changes, rate-limit events, session clearing, and audited internal support lookups. The database may also retain limited progress identifiers and timestamps from earlier product use; these do not contain Builder answers or evidence.
To activate the Consultant desktop and enforce the device and active-client allowances of the purchased tier, the hosted service stores activation status, a public device identifier, a hash of the device secret, device label/platform/app version where supplied, and licence refresh timestamps.
For each registered client workspace, the registry may store a random public workspace identifier, an optional client display name, active or archived status, the registering device, timestamps, and account-level counts. It does not store the workspace contents.
Use a client reference or alias where a person's name is unnecessary. Do not put confidential assessment details into a device label or client display name: these labels are part of the hosted registry, not the local evidence files.
We process account, purchase, licence and requested support information where necessary to provide the service under a contract with you. Where you act for an organisation, rather than being personally party to that contract, we use relevant business contact and licence information for our legitimate interests in delivering and administering that organisation's service. Limited client registry information supports licence administration; it is not an assessment of the client.
Replying to a project enquiry and arranging a call you book are steps you ask us to take before any contract. Saving the campaign tags and landing page with an enquiry or booking supports our legitimate interest in knowing which campaigns and links bring enquiries.
Security controls, operational logs, fraud and abuse prevention support our legitimate interests in operating a reliable and secure service. We retain information required for legal and accounting obligations. Optional website analytics uses your consent, which you can withdraw in Cookie preferences. A purchase, project or support enquiry does not subscribe you to marketing.
RightCyber uses Stripe Managed Payments for checkout, tax, receipts, refunds, and billing; Neon for operational database hosting; Vercel for website and API hosting; Resend for sign-in and access email, delivery of support messages to the monitored mailbox and the confirmation email after a project enquiry; Zoho Desk for tickets submitted through the Help button and email notifications to our support mailbox; and Cloudflare R2 for installer and document files. The Zoho form loads only when you open Help. Google or Microsoft receives sign-in requests when you choose that provider. Have I Been Pwned receives the limited password-check prefix described above. These providers can also process data for their own purposes under their notices. HubSpot receives the contact-form details listed above to create or associate a contact and support ticket. The integration is account-bound, limited to the approved support pipeline and retains Resend as a delivery fallback. HubSpot also provides our free-call booking calendar, which keeps bookings in the same HubSpot account. Sentry monitoring is used only when configured. Google Analytics and Vercel Web Analytics are optional services used only after you accept analytics. We do not use advertising or remarketing services.
The Community page includes YouTube Shorts. Their thumbnails are served through this website. A YouTube player connects to YouTube only when you choose to load it, using YouTube’s privacy-enhanced player. YouTube then receives information such as your IP address and browser details. Voting, quiz answers and comments take place on YouTube under Google’s privacy policy. Loading a video does not change your website analytics preference.
When enabled, Google Analytics and Vercel Web Analytics help us understand visits to our public website. They load only after you accept analytics; rejecting analytics sends no analytics requests through these integrations. Google Analytics measures public page visits and browser/device information using pseudonymous cookie identifiers.
We do not use advertising cookies, Google Ads conversion measurement, remarketing or ad personalisation, and Google signals stay off. Google Analytics runs with every advertising consent signal set to denied.
Page URLs that we report to Google Analytics keep campaign tags (utm_ parameters such as utm_source and utm_campaign). Ad click IDs such as gclid, other query strings and fragments are removed from them, and referring URLs are reduced to their website origin.
Vercel Web Analytics provides aggregate statistics about public page visits, traffic sources, browsers and devices without using analytics cookies. We still apply your analytics choice before loading it, keep only campaign tags in reported page URLs, remove fragments, and exclude private pages.
We do not send account identifiers, contact-form contents, booking details or Builder workspace data to these analytics services. An enquiry or booking is reported only as having happened, with the page it came from and, for an enquiry, the type of service chosen. Account, sign-in, checkout-result and internal pages are excluded.
When you send a project or support enquiry through the contact form, the campaign tags from the page you arrived on (if any) and that page's path are saved with your enquiry so we know which campaign or link led to it. Ad click IDs are not saved. If you have accepted analytics, this browser tab keeps them until it is closed, so an enquiry sent from a later page still includes them; rejecting analytics removes them. After a project enquiry we email a confirmation to the address you gave.
On the free-call page, our HubSpot booking calendar loads only when you choose to open it. The same campaign tags are passed to it so a booking records its campaign too. HubSpot is our provider for the calendar: the booking details you enter go to our HubSpot account, as described under Account, purchase, and access data. See HubSpot's Privacy Policy for HubSpot's own processing.
Your choice is remembered in this browser for 180 days. If you accept analytics, the _ga and _ga_ prefixed analytics cookies are set for up to 180 days without extending their expiry on each visit. You can change your choice using Cookie preferences in the footer. Withdrawing consent stops collection, clears the _ga cookies this website set, and reloads the page when needed. It does not erase data already received by Google or Vercel. For about a day in late October 2026 this website offered an Accept all choice for Google Ads measurement. No Google Ads conversion tag was ever set up, but while it was offered, Accept all kept ad click IDs such as gclid in page addresses sent to Google Analytics and with an enquiry or booking you sent; any such ID is kept and deleted as described under Retention. Any such choice, and any _gcl_ or _gac_ cookies, your browser kept are cleared on your next visit.
Google may process analytics data outside the UK. See Google's Privacy Policy for information about its processing and international transfers. Vercel describes its analytics processing in its Web Analytics privacy information.
Stripe acts as Merchant of Record for payment processing, applicable tax, invoices, and receipts. RightCyber receives the customer, subscription, and payment references needed to operate access, but does not receive or store full card numbers.
The Consultant desktop Builder stores client organisation details, answers, notes, evidence references, copied evidence files, pasted screenshots, gaps, actions, reports, Evidence Pack exports, and workspace backups locally on your computer or in customer-controlled folders. The hosted RightCyber service does not receive that material through the normal product flow.
Do not send full evidence packs, raw screenshots with secrets, passwords, keys, authentication links, device secrets, or private client records to support. Use redacted screenshots and safe descriptions when support context is genuinely needed.
Because the Builder is local-first, RightCyber cannot recover a lost workspace, overwritten local save, missing evidence file, deleted export, or backup you did not keep.
Customer, subscription, and licence records are retained while access is active and for as long as a continuing tax, refund, dispute, fraud-prevention, security, support, or legal need applies. RightCyber has not yet implemented an automated deletion schedule for those product records; deletion and minimisation requests are reviewed manually where the law and operational obligations permit. Our support retention policy requires at least quarterly reviews and deletion no later than 12 months after the last meaningful support activity unless an active dispute, security investigation, or legal obligation requires longer. Requests for access, correction, or deletion are handled within one calendar month. Rate-limit events are pruned by the operational cron using RATE_LIMIT_RETENTION_HOURS, which defaults to 24 hours. The support retention process applies to messages delivered through Resend and, when enabled, to HubSpot contacts, tickets and booked calls, and to Zoho Desk tickets, subject to a documented legal exception and the provider's own legal obligations.
Some of the providers above process data outside the UK — for example on United States infrastructure operated by Vercel, HubSpot, or Resend. Where they do, transfers rely on the UK-approved safeguards in each provider's data-processing terms, such as the UK International Data Transfer Addendum or an applicable adequacy decision. Contact info@rightcyber.co.uk for information about the safeguards applicable to your information and how to obtain a copy, subject to necessary protection of confidential details.
If you are unhappy with how your data has been handled, you can raise a data-protection complaint at info@rightcyber.co.uk. We will acknowledge it within 30 days, investigate appropriately, keep you informed and communicate the outcome without undue delay. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk. A complaint and a request to exercise your data rights follow separate handling timelines.
Depending on the processing and applicable conditions, you can request access, correction, erasure, restriction or portability of your personal information, and object to processing based on legitimate interests. You can withdraw consent for processing that relies on it; this does not change the lawfulness of earlier processing. Email info@rightcyber.co.uk and include the checkout email only if needed to identify the record. We will explain any lawful reason that limits a request. Deleting a RightCyber record does not delete independently retained Stripe payment records or local Builder folders and backups on your own devices.
