Privacy Policy

1.1 Information You Provide

We collect information you voluntarily provide when creating an account, interacting with the Platform, or contacting us, including:

• Account Information: Name, email address, OAuth identity-provider account identifier, organization name (if applicable), and any information you submit during registration.
• Support Communications: Any feedback, bug reports, or support requests you submit.
• Billing Information: Stripe processes all payment information. We do not store full credit card numbers or bank account details.

1.2 Information Collected Automatically

When you access the Platform, we automatically collect:

• Authentication Metadata: OAuth tokens, session identifiers, login timestamps, and related Supabase authentication metadata.
• Usage Data: Pages visited, modules accessed, time spent, features used, and interaction logs.
• Device & Technical Data: IP address, browser type, operating system, device identifiers, and similar technical information.
• Range Telemetry: Activity logs generated within cyber range environments, including command execution logs, system interactions, and assessment outputs.
• Assessment Data: Scores, completion status, automated grading results, and performance analytics.

1.3 Information from Third Parties

We may receive limited information from:

• OAuth Identity Providers: Basic profile information necessary for authentication.
• Stripe: Payment status, billing history, and subscription metadata.
• Hosting Providers: Diagnostic or error information from Hetzner, Vercel, or Supabase.

We do not receive or store any sensitive OAuth-provider account data beyond what is required for authentication.

We use collected information for the following purposes:

• Account Creation & Authentication: To register users, authenticate logins, and maintain secure access.
• Service Delivery: To provide training modules, cyber ranges, assessments, and Platform functionality.
• Performance Tracking: To generate assessment scores, progress tracking, and analytics.
• Platform Security: To detect unauthorized access, enforce session limits, prevent abuse, and maintain system integrity.
• Billing & Subscription Management: To process payments, manage subscriptions, and communicate billing updates.
• Product Improvement: To analyze usage patterns, improve content, enhance features, and develop new offerings.
• Compliance: To comply with legal obligations, enforce our Terms of Service, and respond to lawful requests.

While U.S. federal law does not require a specific legal basis framework, we process personal information under the following principles:

• Contractual Necessity: To provide the Services you subscribe to.
• Legitimate Interests: To secure the Platform, prevent fraud, and improve functionality.
• Consent: For optional features or communications where consent is required.
• Legal Compliance: To meet obligations under applicable U.S. federal and state laws.

We do not sell personal information.

We may share information with:

4.1 Service Providers

Trusted third-party vendors who assist in operating the Platform:

• Stripe (billing and payment processing)
• Supabase (authentication and database services)
• Vercel (hosting and frontend delivery)
• Hetzner (cyber range infrastructure)

These providers process data only as necessary to deliver their services.

4.2 Organizational Accounts

If you access the Platform through an employer, school, or organization, we may share:

• Assessment results
• Progress reports
• Usage analytics
• Account status

4.3 Legal Requirements

We may disclose information when required to:

• Comply with applicable law, regulation, subpoena, or court order
• Protect the rights, property, or safety of Company, users, or others
• Investigate violations of the Terms of Service or Acceptable Use Policy

4.4 Business Transfers

If Company undergoes a merger, acquisition, or asset sale, user information may be transferred as part of the transaction.

We retain information only as long as necessary for:

• Providing the Services
• Maintaining accurate records
• Complying with legal obligations
• Enforcing our Terms

Retention periods include:

• Range Telemetry: Up to 30 days unless required for security investigations.
• Assessment Data: Retained for the duration of your subscription and organizational reporting requirements.
• Account Information: Retained while your account is active and for a reasonable period thereafter for compliance and recordkeeping.

You may request deletion of your account as described in Section 9.

We use cookies and similar technologies to:

• Maintain sessions
• Enable authentication
• Improve performance
• Analyze usage patterns

You may disable cookies in your browser, but certain features may not function properly.

We implement commercially reasonable administrative, technical, and physical safeguards to protect personal information, including:

• OAuth-based authentication
• Encryption in transit (TLS)
• Access controls
• Session management
• Monitoring for unauthorized access

No system is completely secure, and we cannot guarantee absolute protection.

The Platform is strictly for adults 18+.

We do not knowingly collect personal information from children under 13, nor do we permit minors under 18 to use the Platform.

If we discover that a minor has created an account, we will:

• Immediately terminate the account
• Delete associated personal information
• Notify the registered email address

Parents or guardians who believe a minor's information has been collected may contact us at privacy@defensivecyberacademy.com.

Depending on your jurisdiction, you may have rights regarding your personal information, including:

• Access to your personal information
• Correction of inaccurate information
• Request deletion of your account
• Request a copy of your data
• Opt-out of marketing communications
• Restrict certain processing activities

To exercise these rights, contact us at privacy@defensivecyberacademy.com.

We may require verification of your identity before processing requests.

The Platform is operated from the United States.

If you access the Platform from outside the U.S., you consent to the transfer and processing of your information in the United States, which may have different data protection laws than your jurisdiction.

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or prominent in-Platform notice at least 30 days before taking effect, unless required sooner by law or security needs.

Your continued use of the Platform after the effective date of any changes constitutes acceptance of the updated Privacy Policy.

Defensive Cyber Academy LLC
5753 Highway 85 North, Box #3666
Crestview, FL 32536
Website: https://www.defensivecyberacademy.com/