Privacy Policy

This policy explains how Cyber Spartans Limited, trading as Cyberspartans ("we", "us", "our"), collects and uses personal data when you use BreachForge, and the rights you have over that data. It should be read alongside our Terms of Service.

1. Who we are

Cyber Spartans Limited is the data controller for the personal data described here. Registered office: Unit 1, Derwent Business Centre, Clarke Street, Derby DE1 2BU, United Kingdom. Company number 13735278. You can reach us about privacy at [email protected].

2. What this policy covers

This policy covers the BreachForge platform and the account, billing and support around it. BreachForge is a business tool sold to organisations, so most of the data we hold relates to the people who administer an account rather than to consumers.

3. The data we collect

Category	What it includes
Account data	Your name and work email, your organisation, and the login credentials used to access the service.
Environment data	The estate, crown jewels, controls and other configuration you enter to model your environment. This is information about your organisation. It should not contain personal data, and we ask that you do not enter personal data into it.
Billing data	Subscription status and the identifiers our payment processor returns. We do not see or store full card details; those are handled by the payment processor.
Technical data	Session cookies that keep you signed in, and standard server logs such as IP address, browser type and request times, used to run and secure the service.

4. How we use your data, and our lawful basis

• To provide the service, create and manage your account, and let you sign in. Lawful basis: performance of our contract with you.
• To take payment and manage subscriptions. Lawful basis: performance of our contract, and compliance with our legal obligations such as tax records.
• To keep the service secure, prevent abuse, and diagnose problems. Lawful basis: our legitimate interests in running a safe and reliable service.
• To respond to your support requests and to send service messages about your account. Lawful basis: performance of our contract and our legitimate interests.

5. Cookies

We use a small number of strictly necessary cookies to keep you signed in and to operate the gate that protects the application pages. These are essential to the service and are not used for advertising or cross site tracking.

6. Who we share data with

We do not sell your data. We use a small set of trusted service providers who process data on our behalf, under contract, only to deliver the service:

Provider	Purpose
Cloudflare	Hosting, content delivery and the database that stores account and configuration data.
Supabase	Authentication and identity, used to sign you in.
Stripe	Payment processing and subscription billing.
Resend	Sending transactional email such as account and service messages.

We may also disclose data where the law requires it, or to protect our rights, property or safety.

7. International transfers

We aim to keep account and configuration data in the United Kingdom or the European Union. Some of our providers may process data outside the UK. Where that happens, we rely on appropriate safeguards, such as the UK International Data Transfer Agreement or the UK addendum to the European Commission standard contractual clauses.

8. How long we keep data

We keep account and configuration data for as long as your account is active, and for a reasonable period afterwards to meet legal, accounting and security needs. We then delete or anonymise it. You can ask us to delete your account at any time.

9. How we protect data

Access to the application requires a login, secrets and keys are held in encrypted storage and never in our code, and data is held with established providers that maintain their own security controls. No service can be completely secure, but we take reasonable steps to protect your data.

10. Your rights

Under UK data protection law you have the right to access your data, to have it corrected or deleted, to restrict or object to how we use it, to data portability, and to withdraw consent where we rely on it. To exercise any of these, contact us at [email protected]. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, although we would welcome the chance to address your concern first.

11. Children

BreachForge is a business tool and is not intended for or directed at children. We do not knowingly collect data from anyone under 18.

12. Changes to this policy

We may update this policy from time to time. We will change the effective date above and, for material changes, let account holders know.

13. Contact

Cyber Spartans Limited, trading as Cyberspartans. Registered office: Unit 1, Derwent Business Centre, Clarke Street, Derby DE1 2BU, United Kingdom. Company number 13735278. Privacy questions: [email protected].