Privacy Policy

Last updated 8 November 2026

This policy covers CysecIn's sign-in and client portal at cysecin-desk.vercel.app: what we keep about you when you sign in, make an account or write to us, why we keep it, and what you can ask us to do with it. Questions go to info@cysecin.com.

What we keep

• Your account: your name, email, phone number and organization, as you give them.
• Your password, if you make one: only as a one-way hash, never as you typed it.
• If you sign in with Google, LinkedIn, Facebook or X: your name and email as that service gives them, that service's ID for your account there, and whether it confirmed your email. We ask only for that (Google and LinkedIn: openid, profile, email; Facebook: public_profile, email; X: users.read, users.email, and tweet.read, which X requires along with users.read to read your profile). We never post for you, never read your posts, contacts or connections, and we don't keep the access tokens these services give us.
• Your orders: what you bought, when, the amount, and Stripe's reference for the payment. Card details go to Stripe, never to us.
• If you write to us through the contact form on cysecin.com: what you write in it: your name, email, phone, organization, role, the topic and your message.

Why we keep it

To let you into your account, provide the services and orders you ask for, send you invoices, answer you, and keep the portal secure. We don't sell or rent your information, and we don't use it for advertising.

Who else handles it

• Vercel hosts the portal and stores the account records, privately.
• Stripe takes payments and keeps billing details.
• Google Fonts: your browser fetches the page's typeface from Google, which sees your IP address.
• Google, LinkedIn, Meta (Facebook) or X, only if you choose to sign in with them. Their own privacy policies cover what you do on their sites.

We may also share information when the law requires it.

Cookies

Only the ones sign-in needs; none of them follows you to other sites, and there are no advertising or analytics cookies.

• __Host-acct keeps you signed in to your account, for up to 7 days.
• __Host-oauth and __Host-oauth_new hold a sign-in with Google, LinkedIn, Facebook or X while it is under way, for 10 and 15 minutes.
• __Host-desk and __Secure-desk_device are for CysecIn's own staff only.

How long we keep it

While your account is open. When you ask us to delete it, we do so within 30 days, except records the law requires us to keep, such as invoices for paid orders.

Your choices

You can see and change your details in the portal. To get a copy of what we keep, or to have it deleted, write to info@cysecin.com from the email on your account; see Delete your data. If you signed in with Google, LinkedIn, Facebook or X, you can also remove CysecIn from that account's connected apps.

Security

The portal works over HTTPS only, passwords are kept only as hashes, sign-in cookies can't be read by scripts on the page, and account records are kept in private storage that only the portal's server reads.

Children

The portal is for organizations and the adults who act for them. It is not meant for children, and we don't knowingly keep information about anyone under 13.

Changes

When this policy changes, this page and its date change with it.