Privacy Notice

CyberBit collects information you submit directly through forms, email, service workflows, and support conversations. The fields vary by the action you choose.

• Contact information, such as your name, email address, phone number if provided, and support messages.
• Business information, such as company name, website or domain, industry context, service requested, deadline, and intake details.
• Website, hosting, CMS, vendor, platform, email provider, Microsoft 365 or Google Workspace, DNS, form, access, and project details you choose to provide for a service request.
• High-level Pentest qualification information, such as the organization, application URL, ownership context, application type, authentication model, user-role count, API context, data categories, business reason, timing, and authorization confirmations.
• Personal Cybersecurity request information, such as contact details, selected service, high-level account or device category, concern, urgency, and safety confirmations.
• Growth Systems fit-review information: name, work email, business name, website, role or decision-making context, current booking or inquiry platform, optional CRM, principal website-to-booking problem, staff follow-up ownership, desired timeline, budget band, and permission to respond. You may optionally provide approximate traffic, inquiry, and transaction-value bands; do not provide individual customer or patient details.
• Domain, website, email, and public-signal details submitted for the Free Website, Email & Domain Check or another review request.
• Request notes, questionnaire context, scan IDs, report or checklist context, and other non-secret details you choose to provide.
• Newsletter information, such as email address, signup source, subscription status, unsubscribe status, and delivery events.
• Limited payment and order information CyberBit receives from Stripe, such as payment status, checkout references, receipt context, amount, and transaction identifiers.
• For an Instant Signal Brief purchase, the exact sanitized completed Free Check snapshot, integrity and methodology versions, opaque order and access references, purchaser delivery email, payment state, and report-fulfillment status.

The Growth fit-review form collects business-level prospect information only. It does not request patient names, medical details, customer lists, CRM exports, raw conversations, credentials, or payment details. Please describe the business process without identifying your customers or patients.

Normal website operation generates limited technical information used for delivery, diagnostics, security, anti-abuse controls, and aggregate understanding of website use.

• Page path, referring page, sanitized campaign or query information, interaction events, timestamps, and form-submission metadata.
• Browser, device, operating-system, user-agent, and basic site-performance or error information.
• Approximate city, region, country, or time-zone information supplied by hosting or network headers. This is not precise GPS or device location.
• Basic anti-abuse and security signals, including request timing, rate-limit information, and honeypot or bot indicators.
• Random pseudonymous browser and session identifiers used to understand repeat visits and navigation. These identifiers do not themselves contain your name or email address, but related visit and campaign records are not necessarily anonymous.
• An IP address may be processed transiently to deliver and protect the site. Where the website visit tracker creates a durable visit record, it stores a masked IP and a one-way salted hash rather than the raw address. A successfully completed, user-initiated IP & Connection Check may also include the returned IP, IP version, available coarse network or location details, browser summary, browser-reported page protocol and secure-context status, timestamp, route, and opaque execution reference in a minimized internal operational email. Opening the connection tool alone does not display these check results or create a tool-use email.
• A successfully completed, user-initiated WebRTC Check sends only an aggregate browser-reported completion summary for a separate internal operational email: candidate counts by public, private/local and mDNS-obscured category, a bounded result classification, completion status, timestamp, route and opaque execution reference. Raw candidate strings, candidate addresses and mDNS names stay in the browser tab and are not included in this completion request, email, email-ledger metadata or browser analytics.
• Email operations may retain a versioned keyed recipient fingerprint, masked address, opaque workflow or request reference, provider message or event identifier, delivery status, timestamps, and sanitized failure or suppression categories. The email ledger does not store message bodies, submitted form content, raw webhook payloads, or a raw recipient address.
• Free-tool infrastructure performs passive public DNS lookups. When a valid MTA-STS marker is found, the Business Email Trust Check may request only the fixed canonical public policy file at the submitted domain's mta-sts hostname. That public host receives a standard server request and may retain ordinary access logs under its operator's practices.
• A successfully completed, user-initiated Free Scan or Business Email Trust Check may create a minimized internal operational email containing the normalized public domain, high-level result status, timestamps, route, and opaque execution reference. Tool-use alerts exclude cookies, authentication values, complete request headers, session identifiers, and unrelated visitor history.

CyberBit performs defensive, authorized work. Do not submit secrets or unrelated sensitive personal information through website forms, email, scan flows, or request notes.

• Passwords or passphrases
• MFA, recovery, or backup codes
• Private keys, seed phrases, access tokens, or API keys
• SSNs, identity documents, bank details, or full account numbers
• Full payment card numbers
• Private admin links, customer records, medical records, or unrelated sensitive personal information
• Screenshots or attachments that expose private credentials or records

If an agreed service later requires account access, evidence, or test accounts, CyberBit will arrange a safer method after scope and authorization are confirmed, such as screen share, delegated access, customer-controlled entry, or a separately agreed secure transfer process.

• Provide requested services, including public-facing checks, advisory reviews, reports, checklists, website or account-baseline work, authorized testing qualification, and scoped support.
• Respond to requests and support questions, assess fit, confirm scope, and coordinate an authorized handoff.
• Review Growth Systems qualification details, respond to your inquiry, and prepare a possible written scope. Permission to respond to that inquiry does not subscribe you to marketing or authorize access to your business systems.
• Prepare Website, Email & Domain Security Snapshots, Free Website, Email & Domain Check follow-ups, service checklists, and other customer-facing materials.
• Create and deliver a paid automated Instant Signal Brief from the exact completed Free Check snapshot without running another scan.
• Send transactional emails, such as request confirmations, payment or order updates, report delivery notes, checklist emails, and minimized internal operational tool-use messages.
• Send newsletter emails only when you subscribe or otherwise opt in, with an unsubscribe option.
• Process payments and reconcile service requests with payment and order status.
• Improve the website, services, forms, internal workflows, and support experience.
• Protect against spam, abuse, fraud, unauthorized requests, security issues, and misuse of CyberBit services.

Stripe collects payment-card and checkout information directly under its own terms and privacy notice. CyberBit receives limited order and payment-status information needed to reconcile the purchase and deliver the service, but does not store full payment card numbers.

For an Instant Signal Brief, Stripe-confirmed payment creates a durable report entitlement tied to the exact completed Free Check snapshot. CyberBit stores the public-signal snapshot and minimum order, delivery, integrity, and access information needed to provide the secure web report and PDF. The report process does not rerun the scan or add IP Check, location, cookie, request-header, or card data.

Optional booking and third-party resource links take you to another provider. Information you choose to submit there is processed under that provider's terms and privacy practices.

CyberBit uses the following verified providers to operate the current website and service workflows. Each provider processes information under its own terms and privacy practices.

• Vercel hosts and delivers the website and may provide request, network, performance, and security information.
• Google Public DNS may receive a queried public domain when a free tool uses its DNS-over-HTTPS fallback after local DNS resolution fails.
• Airtable supports request, order, Free Check, newsletter, and website-visit workflow records.
• Neon hosts the minimized email delivery ledger and the durable Instant Signal Brief scan snapshot, order, entitlement, Stripe-event, and fulfillment records.
• Resend sends transactional and newsletter email and provides delivery-event information.
• Stripe hosts payment checkout and processes payment information. CyberBit does not receive or store full payment card numbers.
• A configured booking provider processes information you choose to submit after following an optional booking link.
• Professional service providers may process limited information when reasonably needed for business records, tax, accounting, safety, or legal obligations.

Growth fit-review requests use the existing website hosting, request tracking, and transactional email systems: Vercel, Airtable when configured, and Resend. Qualification details are not sent to a prospective client's booking platform, CRM, email, or SMS system just because a form was submitted.

CyberBit's prospect information is distinct from information a future client may process about its own customers in a Growth implementation. Any client-operated booking, CRM, email, SMS, or returning-visitor workflow depends on that client's systems, permissions, and separately agreed scope. Before such work, the parties must define authorized access, necessary data, responsibilities, and any applicable data processing agreement or other required agreement in the written scope. This website inquiry does not establish that those client integrations or customer-data processing are active.

• CyberBit does not sell personal information.
• CyberBit shares information with service providers only as needed to operate the website, process payments, send email, track requests, schedule meetings, deliver services, and protect the business.
• CyberBit may share information when required by law, legal process, tax or accounting obligations, security needs, dispute prevention, fraud prevention, or safety concerns.
• CyberBit may coordinate with a customer-authorized vendor, IT provider, developer, broker, insurer, website host, email provider, or similar party when the customer asks CyberBit to help with a handoff or response.

CyberBit uses browser local storage for a random pseudonymous visit identifier and session storage for a session identifier and session state. The identifiers themselves do not contain your name, email address, submitted domain, form message, or payment data. They can link visits from the same browser; they do not establish the identity of the person using it.

Visit records can include page paths, referring pages, sanitized campaign information, browser or device summaries, approximate network-derived location, and non-sensitive interaction events. Campaign links may include a business-domain attribution value (such as prospect_domain) and a prospect reference, which can be retained with the visit to understand outreach sources. Because these records can be associated with an intended business prospect, CyberBit treats them as pseudonymous, not necessarily anonymous. Sensitive query values are redacted before visit data is stored. CyberBit does not use this system to collect passwords, private credentials, precise GPS location, or form-message contents.

Domains submitted to a tool and tool results, including scan findings, are not attached to browser analytics events. This is separate from business-domain campaign attribution described above. Raw recipient addresses, email message content, and provider message identifiers are also excluded from browser analytics. Standard hosting, database, and provider systems may still retain ordinary operational request logs under their own practices.

CyberBit retains information as needed for service delivery, records, customer support, security, dispute prevention, payment reconciliation, tax or accounting needs, and legal or business obligations. Different records, including minimized email delivery and suppression evidence, may be kept for different periods based on those purposes.

Instant Signal Brief snapshots, orders, entitlements, and fulfillment evidence are retained as needed for digital delivery, support, payment reconciliation, dispute prevention, accounting, and legal or business obligations. CyberBit does not promise permanent hosting; customers should download their PDF. Refunded, disputed, expired, or revoked entitlements may no longer provide report access.

CyberBit uses reasonable safeguards for information it handles. No website, email system, workflow tool, payment provider, or internet transmission can be guaranteed 100% secure.

• You can unsubscribe from marketing or newsletter emails using the unsubscribe option in those emails.
• You can choose not to submit optional form fields.
• You can control cookies and browser storage through your browser settings, although some site functions may not work correctly if those features are disabled.
• You can contact CyberBit to ask privacy questions or request correction or deletion where applicable and operationally possible.
• Some information may need to be retained for records, service delivery, payment reconciliation, security, dispute prevention, tax, accounting, or legal or business obligations.

CyberBit services are not directed to children under 13. Personal Cybersecurity services may involve family context, but service requests should be submitted by an adult or authorized representative.

CyberBit operates from the United States. If you use the website or services from outside the United States, you understand that information may be processed in the United States.

CyberBit may update this Privacy Notice as services, tools, providers, or business operations change. The updated version will be posted on this page with a new version and last updated date.

The Terms of Service explain website and service terms. The Security Disclosure Policy explains how to report a possible security concern about CyberBit's public website.

For privacy questions, correction requests, deletion requests, or support questions, contact CyberBit: