Cyberr
Join Cyberr
Join Cyberr

Data Protection — Privacy Policy

Last updated: October 16, 2026

Cyberr SA, a Luxembourg public limited company (société anonyme) ("Cyberr", "we", "us" or "our") processes your personal data in order to provide and operate a social networking platform dedicated to cybersecurity professionals (the "Platform") and Heelr, the audit-readiness service described in Section 7A, in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "General Data Protection Regulation" or "GDPR").

For most processing described in this Privacy Policy, Cyberr acts as data controller. Where Cyberr processes personal data on behalf of a business customer, it acts as a processor, as explained in Section 7A. In both roles, Cyberr must comply with its obligations under the GDPR and applicable Luxembourg data protection legislation.

Please find below the contact details of the data controller:

Cyberr SA (a Luxembourg public limited company — société anonyme)
16, rue Beck
L-1222 Luxembourg
E-mail: dataprivacy@cyberr.ai

For any question regarding the processing of your personal data carried out by Cyberr, please contact our Data Protection Officer (DPO):

Personal data processing activities carried out by Cyberr are described below. For each processing activity, detailed information is provided, including information regarding the exercise of your rights.

Retention periods mentioned within these notices correspond to the periods defined by Cyberr based on the principles of necessity and proportionality.

In this Privacy Policy, "Members" refers to registered users of the Platform, and "Visitors" refers to persons who visit the Platform without having created an account. The Platform is intended for persons aged 18 and over.

1. Account Registration and Profile Management

Management of Member accounts and profiles

Cyberr processes personal data to enable Members to create and manage their accounts and to build and maintain their professional profile on the Platform.

More information

  1. Purposes of the processing. Cyberr processes your personal data to:
    • allow you to register for and manage access to your Cyberr account;
    • enable you to create, complete and update your professional profile;
    • display your profile to other Members, Visitors and, where applicable, to enterprise customers of the Platform, in accordance with your settings;
    • provide the core functionalities of the Platform under our User Agreement.
  2. Personal data processed.
    • Registration data: name, email address, password, general location (e.g. city or country).
    • Profile data (provided by you): photo, current position, work experience, education, skills, certifications, endorsements, recommendations, contact details and any other information you choose to add to your profile.
    • Technical data: IP address, device identifier, browser type and version, operating system, language preferences.

    You are not required to provide any information beyond the mandatory registration data. However, a more complete profile will help you benefit fully from the Platform. Please do not post or add personal data to your profile that you would not want to be publicly available.

  3. Legal basis for the processing.
    • Performance of a contract with you [Article 6(1)(b) GDPR]: the processing is necessary to provide you with the services under our User Agreement.
    • Consent [Article 6(1)(a) GDPR]: for optional profile information and visibility settings that go beyond the core service.
  4. Categories of recipients of the personal data.
    • Other Members and Visitors of the Platform, in accordance with your profile visibility settings.
    • Enterprise customers using the Platform's recruitment or business tools, in accordance with your settings.
    • Cyberr staff responsible for Platform operations and support.
    • Technical service providers (hosting and infrastructure: Amazon Web Services (Paris, France) and Cloudflare; payment processing: Stripe; data enrichment: Mixrank; identity & biometric verification: Veriff OÜ (Tallinn, Estonia — EEA); analytics: Google Analytics, PostHog (EU); error monitoring: Sentry (EU); advertising: Google Ads, LinkedIn Insight Tag, Reddit; CRM and email marketing: HubSpot; transactional email: Resend). The full list of service providers is in Section 11B.
  5. Storage duration. Your personal data is retained for as long as your account is active. Upon account closure, your data is generally deleted within 30 days, except where longer retention is required by law (in particular accounting and tax records, retained for 7 years under Luxembourg law) or for the establishment, exercise or defence of legal claims.
  6. Rights of the data subject. You have the right to access your personal data and to obtain a copy (Article 15 GDPR), to obtain the rectification of inaccurate or incomplete personal data (Article 16 GDPR), to obtain the erasure of your personal data under the conditions set out in Article 17 GDPR, to obtain the restriction of processing under the conditions set out in Article 18 GDPR, to data portability (Article 20 GDPR), to object at any time, on grounds relating to your particular situation, to processing based on legitimate interest, and at any time to direct marketing (Article 21 GDPR), and, where processing is based on consent, to withdraw your consent at any time without affecting the lawfulness of processing carried out before such withdrawal. For any questions or requests regarding the exercise of your rights, please contact the DPO of Cyberr.
  7. Complaint. If you consider that the processing of your personal data by Cyberr infringes the GDPR, you can lodge a complaint with the National Data Protection Commission (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg (www.cnpd.lu).

2. Networking and Connections

Management of connections between Members

Cyberr processes personal data to enable Members to build and manage their professional network on the Platform.

More information

  1. Purposes of the processing. Cyberr processes your personal data to:
    • allow you to send, receive and manage connection requests;
    • suggest relevant connections based on your profile, contacts and activity on the Platform;
    • display your connections list to other Members, in accordance with your settings;
    • enable you to invite non-Members to join the Platform.
  2. Personal data processed.
    • Profile data (name, photo, position, location, skills).
    • Connections list.
    • Contact information uploaded or synced by you (e.g. address book imports).
    • Activity data related to networking (connection requests sent and received, invitations).
  3. Legal basis for the processing.
    • Performance of a contract [Article 6(1)(b) GDPR]: the networking functionality is a core element of the service provided under our User Agreement.
    • Legitimate interest [Article 6(1)(f) GDPR]: suggesting relevant connections to enhance your experience on the Platform. Cyberr has balanced its interest against your rights and considers that the limited impact and your ability to control your settings justify this processing.
  4. Categories of recipients of the personal data.
    • Other Members, in accordance with your settings.
    • Cyberr staff responsible for Platform operations.
    • Technical service providers (hosting on Amazon Web Services, Paris, France).
  5. Storage duration. Connection data is retained for as long as your account is active and deleted within 30 days of account closure.
  6. Rights of the data subject. You have the rights set out in Section 1(6) above. In addition, where processing is based on legitimate interest, you have the right to object to the processing under the conditions set out in Article 21 GDPR.
  7. Complaint. See Section 1(7) above.

3. Messaging

Management of messages between Members

Cyberr processes personal data to enable Members to communicate with each other through the Platform's messaging functionality.

More information

  1. Purposes of the processing. Cyberr processes your personal data to:
    • enable you to send and receive private messages to and from other Members;
    • provide message notifications;
    • detect and prevent abusive or harmful content in messages, in accordance with our Community Guidelines.
  2. Personal data processed.
    • Sender and recipient identification data (name, profile information).
    • Message content.
    • Metadata (date, time, read receipts where applicable).
  3. Legal basis for the processing.
    • Performance of a contract [Article 6(1)(b) GDPR]: messaging is part of the core service.
    • Legitimate interest [Article 6(1)(f) GDPR]: detecting and preventing abusive or harmful content to protect the safety of Members and the integrity of the Platform.
  4. Categories of recipients of the personal data.
    • The other party or parties to the conversation.
    • Cyberr staff, where necessary for moderation or support purposes.
    • Technical service providers (hosting on Amazon Web Services, Paris, France).
  5. Storage duration. Messages are retained for as long as the relevant accounts are active and deleted within 30 days of account closure.
  6. Rights of the data subject. See Section 1(6) above. Right to object (Article 21 GDPR) applies where processing is based on legitimate interest.
  7. Complaint. See Section 1(7) above.

4. News Feed and Content Sharing

Management of content published and shared on the Platform

Cyberr processes personal data to enable Members to publish, view and interact with professional content on the Platform.

More information

  1. Purposes of the processing. Cyberr processes your personal data to:
    • enable you to create, publish and share posts, articles, comments and other content;
    • display content in the news feed of other Members and, where applicable, to Visitors;
    • personalise your news feed based on your profile, connections, activity and stated interests;
    • enable social interactions (likes, comments, shares, follows);
    • notify your network of your activity, in accordance with your settings.
  2. Personal data processed.
    • Profile data (name, photo, position).
    • Content you publish (posts, articles, comments, images, videos).
    • Activity data (likes, shares, comments, follows, content views).
    • Technical data (device, browser, IP address).
  3. Legal basis for the processing.
    • Performance of a contract [Article 6(1)(b) GDPR]: content sharing is a core functionality of the Platform.
    • Legitimate interest [Article 6(1)(f) GDPR]: personalising your news feed and providing notifications to enhance the relevance and usefulness of the Platform.
  4. Categories of recipients of the personal data.
    • Other Members and, for publicly shared content, Visitors.
    • Cyberr staff responsible for moderation and Platform operations.
    • Technical service providers (hosting on Amazon Web Services, Paris, France).
    • Third-party search tools may index publicly available content.
  5. Storage duration. Content is retained for as long as your account is active. Upon deletion of content by you, it is removed from the Platform; however, copies made by other users or cached by third-party services are outside Cyberr's control. On account closure, residual content is deleted within 30 days.
  6. Rights of the data subject. See Section 1(6) above. Right to object applies where processing is based on legitimate interest.
  7. Complaint. See Section 1(7) above.

5. Job Postings and Recruitment

Management of job postings, applications and recruitment features

Cyberr processes personal data to enable Members to post and discover job opportunities and to submit and manage job applications.

More information

  1. Purposes of the processing. Cyberr processes your personal data to:
    • enable employers and recruiters to post job openings on the Platform;
    • enable Members to search for, view and apply for job opportunities;
    • enable Members to upload CVs/resumes;
    • match job seekers with relevant opportunities based on their profile and preferences;
    • enable recruiters and employers to search for and contact potential candidates, in accordance with Members' settings;
    • enable Members to signal that they are open to job opportunities.
  2. Personal data processed.
    • Profile data.
    • CV/resume data uploaded by the Member.
    • Job preferences and "open to work" status.
    • Job search activity (searches, applications, saved jobs).
    • Application-related data exchanged between the Member and the recruiter or employer.
    • Contact details provided to recruiters or employers in connection with a specific application.
  3. Legal basis for the processing.
    • Performance of a contract [Article 6(1)(b) GDPR]: job search and recruitment features are core functionalities of the Platform.
    • Consent [Article 6(1)(a) GDPR]: for making your CV/resume and "open to work" status visible to recruiters or employers.
    • Legitimate interest [Article 6(1)(f) GDPR]: matching job seekers with relevant opportunities to create economic opportunity for Members.
  4. Categories of recipients of the personal data.
    • Recruiters and employers using the Platform, in accordance with your settings.
    • Cyberr staff responsible for Platform operations.
    • Technical service providers (hosting on Amazon Web Services, Paris, France).
  5. Storage duration. CV/resume data and job application data are retained for as long as your account is active, unless you delete them earlier. On account closure, this data is deleted within 30 days.
  6. Rights of the data subject. See Section 1(6) above. Where processing is based on consent, you may withdraw your consent at any time. Right to object applies where processing is based on legitimate interest.
  7. Complaint. See Section 1(7) above.

6. Groups and Events

Management of groups and events on the Platform

Cyberr processes personal data to enable Members to create, join and participate in groups and events.

More information

  1. Purposes of the processing. Cyberr processes your personal data to:
    • enable you to create, manage and participate in groups;
    • enable you to create, manage, register for and participate in events;
    • display group memberships and event participations on your profile, in accordance with your settings.
  2. Personal data processed.
    • Profile data (name, photo, position).
    • Group membership and event registration data.
    • Content posted within groups.
    • Event-related data (registration, attendance).
  3. Legal basis for the processing.
    • Performance of a contract [Article 6(1)(b) GDPR].
    • Consent [Article 6(1)(a) GDPR]: for displaying group and event participation on your profile.
  4. Categories of recipients of the personal data.
    • Other group members or event participants.
    • Group administrators and event organisers.
    • Cyberr staff.
    • Technical service providers (hosting on Amazon Web Services, Paris, France).
  5. Storage duration. Group and event data is retained for as long as your account is active and deleted within 30 days of account closure.
  6. Rights of the data subject. See Section 1(6) above.
  7. Complaint. See Section 1(7) above.

7. Enterprise Services

Management of enterprise and B2B features

Cyberr offers tools for organisations (employers, recruiters) to search for candidates, manage talent and promote their activities on the Platform.

More information

  1. Purposes of the processing. Cyberr processes your personal data to:
    • enable enterprise customers to search for and contact Members matching their criteria;
    • provide enterprise customers with limited profile information (name, headline, current position, general location), in accordance with your settings;
    • enable enterprise customers to manage their interactions with candidates and contacts through the Platform.
  2. Personal data processed.
    • Profile data accessible to enterprise customers in accordance with your settings.
    • Activity data related to interactions with enterprise customers.
    • Data stored by enterprise customers about you within the Platform's enterprise tools.

    Cyberr does not provide your contact information to enterprise customers without your consent.

  3. Legal basis for the processing.
    • Performance of a contract [Article 6(1)(b) GDPR].
    • Legitimate interest [Article 6(1)(f) GDPR]: enabling enterprises to find talent and enabling Members to be discovered for professional opportunities.
    • Consent [Article 6(1)(a) GDPR]: for sharing contact information with enterprise customers.
  4. Categories of recipients of the personal data.
    • Enterprise customers, in accordance with your settings.
    • Cyberr staff.
    • Technical service providers (hosting on Amazon Web Services, Paris, France; data enrichment providers listed in Section 11B).
  5. Storage duration. Enterprise interaction data is retained for as long as your account is active and deleted within 30 days of account closure.
  6. Rights of the data subject. See Section 1(6) above.
  7. Complaint. See Section 1(7) above.

7A. Heelr

Heelr, a service provided by Cyberr SA, is a business service that helps organisations get ready for security and data protection audits (for example ISO 27001, NIS2, GDPR and DORA). It is provided to organisations under the Heelr Service Terms and the Data Processing Agreement. Heelr is not a certification body, does not certify organisations and does not provide legal advice.

The website heelr.com is operated by Cyberr SA for the Heelr service and is a collection point for the processing described in this Section 7A. Requests you submit through its free check form or its book-a-demo form are processed as described in A below. Applications to join Heelr's auditor network are processed as described in G below. On heelr.com, analytics and marketing tags load only after you give your consent; see Section 13 (Cookies).

Cyberr acts in two different roles for this service. For the activities in A, B, F and G below, Cyberr is the data controller. For the activities in C and D, Cyberr is a processor acting on behalf of the customer organisation, which is the controller; if your employer or a website you visit uses Heelr, please address requests about that data to that organisation first. We will help it answer you.

A. Free check and demo requests (Cyberr is controller)

  1. Purposes of the processing. To answer your request for a free check or a demo, run a snapshot of your organisation's public security posture when you request a free check (see E below), send you the results, arrange the demo you ask for, follow up about Heelr, and protect the forms against abuse.
  2. Personal data processed. Your name, work email address, the company domain you enter, the tools you select, any other details you enter in the form, your confirmations, the date of your request, and the follow-up status. To prevent abuse, your IP address and email address are used for rate limiting and the forms are protected by Cloudflare Turnstile. The company domain is checked against Cloudflare's threat intelligence.
  3. Legal basis for the processing.
    • Steps taken at your request before entering into a contract [Article 6(1)(b) GDPR]: preparing and sending your snapshot, and arranging the demo you ask for.
    • Legitimate interest [Article 6(1)(f) GDPR]: following up with you about Heelr as a business contact, and securing the forms. You can object at any time.
  4. Who can request a snapshot. You must be authorised by the organisation that owns the domain you enter. We send results only to an email address at that organisation's domain, and we may decline or verify a request before running it.
  5. Categories of recipients of the personal data. Cyberr staff; Amazon Web Services (hosting, Paris, France); Cloudflare (bot protection, threat screening); Resend (email delivery); HubSpot (CRM), if we follow up commercially.
  6. Storage duration. 12 months after our last contact with you, unless you become a customer, in which case B applies.
  7. Rights of the data subject. See Section 1(6) above.
  8. Complaint. See Section 1(7) above.

B. Customer accounts and contacts (Cyberr is controller)

  1. Purposes of the processing. To manage the contract, give access to the service, send alerts, digests and reports to the contacts the customer designates, provide support and invoice.
  2. Personal data processed. Names, business email addresses and roles of customer contacts (including any data protection or security officer the customer adds to reports), communications with us, and billing details.
  3. Legal basis for the processing. Performance of a contract [Article 6(1)(b) GDPR] with the customer organisation, our legitimate interest [Article 6(1)(f) GDPR] in communicating with its designated contacts, and legal obligations [Article 6(1)(c) GDPR] for accounting records.
  4. Categories of recipients of the personal data. Cyberr staff; Amazon Web Services (Paris, France); Resend (email delivery); Stripe (payments); HubSpot (CRM); Microsoft (our internal email and collaboration).
  5. Storage duration. For the duration of the contract and 3 years after it ends; invoices and accounting records for 10 years as required by Luxembourg law.
  6. Rights of the data subject. See Section 1(6) above.
  7. Complaint. See Section 1(7) above.

C. Data in connected customer systems (Cyberr is processor)

When a customer connects Amazon Web Services, Microsoft 365 or GitHub, Cyberr reads configuration settings to check them against security controls. Access is read-only: Cyberr does not change anything in these systems. Cyberr does not read email, files, chat messages, documents or source code, and does not read sign-in logs. The customer can revoke access at any time from its own system. Some providers only offer permissions that are broader than what our checks need (for example, GitHub requires read access to repository contents in order to read branch settings); Cyberr uses these permissions only for the checks described here.

Some checks identify the specific accounts that need attention, so the following personal data of the customer's staff and collaborators may be processed:

  • Microsoft 365: the sign-in names (user principal names) of accounts without multi-factor authentication, the names and sign-in names of administrators, and whether each account is enabled and registered for multi-factor authentication.
  • Amazon Web Services: the names of IAM users without multi-factor authentication or with old access keys.
  • GitHub: the usernames of outside collaborators, and repository and organisation settings.
  • Compliance records the customer enters: names of policy owners and approvers, and evidence and notes the customer uploads.

These results are shown in the customer's workspace, included in alerts and reports sent to the customer's designated contacts, and kept as audit evidence. Cyberr processes this data only on the customer's documented instructions, under the Data Processing Agreement. It is stored by Amazon Web Services in Paris, France. Check history is kept for 3 years so that the customer can show its auditor a track record, and all customer data is deleted within 30 days after the contract ends, unless the customer asks us to return it first. The subprocessors are listed in the Data Processing Agreement.

Cyberr does not use customer data to train artificial intelligence models, does not send it to AI providers, and does not sell it or use it for advertising.

D. Consent banner on customer websites (Cyberr is processor)

Customers can use a Cyberr consent banner on their own websites. When a visitor makes a choice, Cyberr records, on the customer's behalf, a random identifier, the categories accepted or refused, the banner version, the page address without query parameters, and the date. A first-party cookie named cyberr_consent stores the visitor's choice on that website for up to 13 months. Cyberr does not store the visitor's IP address or browser details in these records; the IP address is used only transiently by Cloudflare to limit abusive traffic. Records are deleted automatically after 25 months. The website operator is the controller and its own privacy policy applies.

E. Public security snapshot

The snapshot reads only information that any internet user can see: public DNS records (such as SPF, DMARC, DKIM and MX), the organisation's public website and its TLS certificate and security headers, the cookies and third-party services loaded by the homepage, and public certificate transparency logs (crt.sh). Our requests identify themselves with the user agent CyberrSnapshot/1.0 (+https://heelr.com). The snapshot does not attempt to log in, does not test for vulnerabilities, and does not look up breached accounts. It is designed to collect technical data about an organisation, not personal data; if a public record happens to contain a person's name or email address, it is included only as it appears in that record.

F. Checks in AI assistants (Cyberr is controller)

  1. Purposes of the processing. To run the Heelr checks you ask for in Claude, ChatGPT or another AI assistant (a public security snapshot of a domain, as described in E, or an estimate of whether an organisation falls under the NIS2 Directive), and to protect the service against abuse.
  2. Personal data processed. The domain name you ask us to check, or the sector, headcount, turnover, balance sheet total and country you give for a NIS2 estimate, together with the IP address of the request. We do not ask for an account and we do not receive your conversation with the AI assistant.
  3. Legal basis for the processing. Legitimate interest [Article 6(1)(f) GDPR] in providing the checks you request and securing the service.
  4. Categories of recipients of the personal data. Cyberr staff; Amazon Web Services (hosting, Paris, France); Cloudflare (network and security), which may keep short-lived security logs. The AI assistant you use receives the results under its own privacy policy.
  5. Storage duration. Results are kept in memory for up to 24 hours so that repeated checks are fast, and IP addresses are kept in memory for up to one hour for rate limiting. Neither is written to a database, and we do not use this data for marketing.
  6. Rights of the data subject. See Section 1(6) above. Because we keep no record beyond these periods, we can usually only confirm that nothing is stored. You can contact us at dataprivacy@cyberr.ai.
  7. Complaint. See Section 1(7) above.

G. Auditor applications (Cyberr is controller)

  1. Purposes of the processing. To assess applications from independent auditors and assessors who apply on heelr.com to join Heelr's auditor network, and to contact applicants about their application.
  2. Personal data processed. Your name, email address, country, LinkedIn profile if you give it, certifications, the frameworks you audit, years of auditing experience, availability, languages, day rate, whether you work for a certification body, and the date of your application.
  3. Legal basis for the processing. Steps taken at your request before entering into a contract [Article 6(1)(b) GDPR].
  4. Categories of recipients of the personal data. Cyberr staff; Amazon Web Services (hosting, Paris, France); Resend (email delivery); Cloudflare (Turnstile bot protection).
  5. Storage duration. 12 months after our last contact with you, unless we conclude an agreement with you.
  6. Rights of the data subject. See Section 1(6) above.
  7. Complaint. See Section 1(7) above.

8. Newsletter and Marketing Communications

Management of the newsletter and marketing emails

Cyberr delivers newsletters and marketing communications to inform Members about Platform updates, cybersecurity-related content, events and new features.

More information

  1. Purposes of the processing. Cyberr processes your personal data to:
    • send you newsletters about Platform updates, cybersecurity news, events and professional content;
    • send you marketing communications about Cyberr features and services;
    • measure the delivery and engagement with these communications (open rates, click-through rates).
  2. Personal data processed.
    • Email address.
    • Communication preferences.
    • Newsletter engagement data (delivery status, open/click data, unsubscription).
  3. Legal basis for the processing.
    • Consent [Article 6(1)(a) GDPR]: subscription to the newsletter requires your prior consent. You may withdraw your consent at any time.
    • Legitimate interest [Article 6(1)(f) GDPR]: for service-related communications (e.g. security notices, terms updates), which are necessary for the proper functioning of the Platform and which you cannot opt out of.
  4. Categories of recipients of the personal data.
    • Cyberr staff responsible for communications.
    • Email delivery service providers (HubSpot for marketing emails; Resend for service and account messages).
  5. Unsubscribe. You may unsubscribe from the newsletter at any time by clicking the unsubscribe link included in every email, by adjusting your communication preferences in your account settings, or by contacting the DPO. Your email address and associated data will be deleted from the mailing list within 30 days of your unsubscription.
  6. Storage duration. Newsletter subscription data is retained for as long as you remain subscribed and deleted within 30 days of unsubscription.
  7. Rights of the data subject. See Section 1(6) above.
  8. Complaint. See Section 1(7) above.

9. Contact and Support Requests

Management of information requests and support tickets

Members and Visitors may contact Cyberr for information, support or to report issues. Cyberr processes the personal data necessary to respond to such requests.

More information

  1. Purposes of the processing and legal basis. Cyberr processes personal data submitted through contact forms, support tickets or email in order to respond to your requests and provide customer support.
    • Performance of a contract [Article 6(1)(b) GDPR]: where the request relates to the use of the Platform by a Member.
    • Legitimate interest [Article 6(1)(f) GDPR]: where the request comes from a Visitor or relates to general enquiries.
  2. Personal data processed.
    • Mandatory: name, email address, subject matter of the request.
    • Optional: phone number, any additional information you provide in the body of your request.

    We recommend that you only provide information that is necessary for processing your request. In particular, sensitive personal data (within the meaning of Article 9 GDPR) should not be included unless indispensable.

  3. Categories of recipients of the personal data.
    • Cyberr staff responsible for support and operations.
    • Technical service providers (HubSpot for ticketing and CRM).
  4. Storage duration. Personal data contained in support requests is kept for a period of 24 months from the date of closure of the request.
  5. Rights of the data subject. See Section 1(6) above.
  6. Complaint. See Section 1(7) above.

10. Safety, Security and Investigations

Protection of the Platform and its users

Cyberr processes personal data to ensure the safety and security of the Platform and to detect, prevent and investigate fraudulent, harmful or unlawful activity.

More information

  1. Purposes of the processing. Cyberr processes your personal data to:
    • protect Members, Visitors and others from security threats, fraud, abuse, spam and other harmful activity;
    • enforce our User Agreement and Community Guidelines;
    • detect and prevent fake accounts, bots and inauthentic behaviour;
    • respond to legal requests from law enforcement or regulatory authorities, where required by law;
    • investigate violations of our policies.
  2. Personal data processed.
    • Account and profile data.
    • Activity data and usage logs.
    • Technical data (IP address, device identifiers, browser information).
    • Communications data, where necessary for investigation purposes.
    • Reports submitted by Members about other Members.
  3. Legal basis for the processing.
    • Legitimate interest [Article 6(1)(f) GDPR]: ensuring the safety, security and integrity of the Platform and protecting Members, Visitors and Cyberr.
    • Compliance with a legal obligation [Article 6(1)(c) GDPR]: where disclosure is required by law, court order or regulatory request.
  4. Categories of recipients of the personal data.
    • Cyberr staff responsible for trust and safety.
    • Law enforcement and regulatory authorities, where required by law.
    • Technical service providers (hosting on Amazon Web Services, Paris, France; anti-fraud and abuse-detection tooling (Cloudflare Turnstile, AbuseIPDB, GreyNoise); OpenAI, acting as our processor, for automated safety screening of content Members publish on the Platform — posts, comments, reviews, profiles, listings and pages. Private messages, marketplace proposals and proposal comments are never sent for screening. OpenAI does not use this data to train its models and retains it for up to 30 days for abuse monitoring). OpenAI also acts as our processor, only when a Member chooses to use these features, to read an uploaded CV and fill in profile fields (the text of the CV, or the CV file itself, is sent to OpenAI) and to rewrite a draft post (the draft text is sent to OpenAI).
  5. Storage duration. Safety and security records are retained in line with applicable legal limitation periods, typically up to 10 years where necessary for the establishment, exercise or defence of legal claims.
  6. Rights of the data subject. See Section 1(6) above. Note that certain rights (e.g. erasure, restriction) may be limited where processing is necessary for the establishment, exercise or defence of legal claims or for compliance with a legal obligation.
  7. Complaint. See Section 1(7) above.

11. Recruitment by Cyberr

Management of job applications to Cyberr

Cyberr processes personal data included in applications submitted to its human resources service in order to select candidates for vacancies within Cyberr or its partners.

More information

  1. Purposes of the processing. Cyberr processes the personal data contained in applications submitted to it in order to select candidates for vacant positions with a view to possible recruitment.
  2. Personal data processed.
    • Identification data (name, contact details).
    • Cover letter.
    • Curriculum vitae.
    • Copies of diplomas, certificates and any other documents provided by the applicant.
  3. Legal basis for the processing.
    • Pre-contractual measures [Article 6(1)(b) GDPR]: processing is necessary to take steps at the request of the data subject prior to entering into an employment contract.
  4. Categories of recipients of the personal data.
    • Cyberr management and human resources staff.
  5. Storage duration. Unsuccessful applications are deleted at the end of the recruitment process, save that, with the candidate's consent, applications may be retained for a period of up to 6 months to allow for reconsideration. Successful applications leading to recruitment are retained as part of the employee's personnel file in accordance with applicable Luxembourg labour law.
  6. Rights of the data subject. See Section 1(6) above.
  7. Contact details for the DPO. For any questions about the processing of your personal data by Cyberr in connection with the management of your application, you may contact the DPO at dataprivacy@cyberr.ai or by post at the address indicated at the top of this notice.
  8. Complaint. See Section 1(7) above.

11A. Identity Verification (ID document & biometric data)

Certain features of the Platform — including Premium membership, the Founding Member badge, hosting of live streams and other trust-sensitive functions — require Members to complete an identity verification check. This check is operated on our behalf by our verification partner Veriff OÜ (Tallinn, Estonia — EEA) acting as our processor.

More information

  1. Purposes of the processing. Verify the authenticity of your government-issued identity document, confirm that the person presenting the document is the same person creating or holding the Account (anti-impersonation / anti-fraud), and unlock features that depend on a verified identity (e.g. Founding Member badge, live-stream hosting, certain Premium gates).
  2. Personal data processed.
    • Image of a government-issued identity document (passport, ID card or driving licence) and the document data extracted from it (name, date of birth, document number, issuing country, expiry date).
    • Selfie / portrait image captured during the check.
    • Biometric data: facial geometry derived from the document photo and the selfie, used to compute a facial-similarity score (face matching).
    • Liveness signals used to confirm that a live person — and not a photo, mask or replay — is in front of the camera.
    • Technical metadata of the verification session (device, browser, IP address, timestamps, Veriff session ID).
  3. Legal basis for the processing.
    • Contract [Article 6(1)(b) GDPR]: processing is necessary to provide the Premium / verified-identity features you have requested under the User Agreement.
    • Legal obligation [Article 6(1)(c) GDPR]: where verification is needed to comply with applicable obligations (including DSA-related trader information and anti-fraud duties).
    • Explicit consent [Article 9(2)(a) GDPR] for the processing of biometric data (facial matching and liveness). You provide this explicit consent before the verification check starts and may withdraw it at any time, in which case verification cannot complete and features that require a verified identity will be unavailable. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
  4. Categories of recipients of the personal data.
    • Cyberr trust & safety and engineering staff strictly on a need-to-know basis.
    • Veriff OÜ, Tallinn, Estonia, acting as our processor and operating the verification service in the EEA.
    • Where required by law, competent authorities and CSIRTs (see Section 10).
  5. Storage duration. The ID-document image and biometric data (facial geometry and liveness signals) are processed and stored securely by our verification partner Veriff OÜ for 90 days in their active service, followed by a 3-year secure archive period before deletion. Cyberr itself retains only the verification outcome (pass/fail), the Veriff session ID and the verification timestamp, for the duration of your Account and for up to 3 years after closure for the establishment, exercise or defence of legal claims and for fraud-prevention purposes.
  6. International transfers. Verification is operated within the EEA by Veriff OÜ (Estonia). Any onward transfer outside the EEA by Veriff is governed by the safeguards described in Section 12 (in particular Standard Contractual Clauses).
  7. Automated decision-making. The facial-match score and liveness signals produce a recommendation that informs our decision to grant or refuse a verified-identity feature. The decision is always reviewable by a human; you can request human review and contest the outcome by writing to dataprivacy@cyberr.ai.
  8. Rights of the data subject. See Section 1(6) above (access, rectification, erasure, restriction, portability, objection, and the right to withdraw consent for the biometric processing at any time).
  9. Contact details for the DPO. dataprivacy@cyberr.ai.
  10. Complaint. See Section 1(7) above (CNPD in Luxembourg, or your local supervisory authority).
  11. Related policy. Good-faith security research on the verification flow is covered by our Coordinated Vulnerability Disclosure Policy.

11B. Service Providers

Cyberr uses the following service providers, acting as processors on our behalf or as independent controllers where you connect a third-party account. Each receives only the personal data needed for its function.

  • Hosting and infrastructure: Amazon Web Services (Paris, France), Cloudflare (content delivery, bot protection with Turnstile, threat screening, video with Cloudflare Stream, and the Heelr consent banner service).
  • Heelr: the providers listed in the subprocessor annex of our Data Processing Agreement.
  • Email: Resend (account and service emails), HubSpot (marketing emails and CRM).
  • Payments: Stripe.
  • Identity verification: Veriff OÜ (Estonia), see Section 11A.
  • Analytics and error monitoring: Google Analytics, PostHog (EU data region), Sentry (EU data region, Germany).
  • Advertising measurement: Google Ads, LinkedIn Insight Tag, Reddit Pixel and Conversions API, only with your consent.
  • Consent management: Cookiebot.
  • Data enrichment for recruitment and business features: Mixrank, ContactOut, RocketReach, Dropcontact, Clay.
  • Content safety: OpenAI, see Section 10.
  • AI features you choose to use: OpenAI, which receives your CV when you ask us to parse it into profile fields and your draft text when you ask us to rewrite a post, see Section 10.
  • Abuse prevention: AbuseIPDB and GreyNoise, which receive IP addresses to detect malicious traffic.
  • Video and live sessions: Mux, Cloudflare Stream, Daily.
  • Certification badges: Credly, when you add a badge to your profile.
  • Technical assessments: Airbus Cyber Range, when a recruiter invites you to a technical test.
  • Mobile notifications: Expo, for push notifications in our mobile apps.
  • Connected accounts: Google, LinkedIn and GitHub for sign-in; LinkedIn, X and Bluesky when you choose to share your posts to those networks. These providers process the data you share under their own privacy policies.

12. International Data Transfers

Cyberr is established in Luxembourg. Personal data may be transferred outside the EU/EEA where our service providers (in particular Stripe, Cloudflare, Resend, Mixrank, ContactOut, RocketReach, Clay, OpenAI, Google Analytics, Google Ads, LinkedIn Insight Tag, Reddit, HubSpot, Mux, Daily, Credly, Expo, AbuseIPDB and GreyNoise) host or process data outside the EU/EEA.

Where personal data is transferred outside the EU/EEA, Cyberr ensures that appropriate safeguards are in place in accordance with Chapter V of the GDPR, including:

  • transfers to countries benefiting from an adequacy decision by the European Commission;
  • Standard Contractual Clauses adopted by the European Commission;
  • any other appropriate safeguard under Article 46 GDPR.

You may obtain a copy of the relevant safeguards by contacting the DPO.

13. Cookies

Cyberr uses cookies and similar technologies on its website and mobile application. We use:

  • Essential cookies: required for authentication, bot protection and basic Platform functionality, and Cookiebot to record your consent choices.
  • Analytics: Google Analytics and PostHog, to understand Platform usage patterns. Google Analytics event data is deleted after no more than 14 months.
  • Advertising: Google Ads, LinkedIn Insight Tag and Reddit Pixel, for targeted recruitment campaigns.
  • Marketing: HubSpot, for email marketing and CRM.

You can manage cookie preferences through your browser settings. Disabling non-essential cookies will not affect core Platform functionality. For full details — including categories, providers, lifetimes and how to manage your preferences — see our Cookie Policy, or contact us at dataprivacy@cyberr.ai.

14. Changes to this Privacy Policy

Cyberr may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Platform or by other appropriate means before the changes become effective. Your continued use of the Platform after the effective date of the updated Privacy Policy constitutes your acknowledgement of the updated terms.

15. Contact

For any questions regarding this Privacy Policy or the processing of your personal data by Cyberr, please contact:

Cyberr SA (a Luxembourg public limited company — société anonyme)
16, rue Beck
L-1222 Luxembourg
E-mail: dataprivacy@cyberr.ai

Data Protection Officer:
Infuero (external Data Protection Officer)
E-mail: dpocyberr@infuero.lu

Supervisory Authority:
Commission nationale pour la protection des données (CNPD)
15, Boulevard du Jazz
L-4370 Belvaux, Luxembourg
www.cnpd.lu