Privacy Policy

This Privacy Policy explains how CyberLab LLC ("CyberLab," "we," "us") collects, uses, discloses, and protects information in connection with the Home Office Compliance Guard desktop application and the cyberlabcorp.com website and services (together, the "Services"). By using the Services you agree to this Policy.

1. Summary

We built the Services to be privacy-first. All network scanning happens locally on your device. We collect the minimum needed to operate your account, process payments, and issue verifiable compliance certificates. We do not collect your browsing history, file contents, or a full inventory of your devices.

2. Information We Collect

Account information

• Your email address and authentication credentials, managed by our authentication provider (Supabase). We never see or store your password in plaintext.

Payment information

• Subscriptions are processed by Stripe. We do not store your full card number or payment credentials; Stripe handles them. We retain limited billing metadata (plan, subscription status, seat quantity, renewal/cancellation dates, and a Stripe customer identifier).

Device & compliance information

• When you link a device to your account, we collect a machine identifier (a salted, one-way hash of a hardware/OS GUID — the raw hardware value never leaves your device), the device hostname, the operating system, and the name of the logged-in user account the scan runs under, plus a revocable device token (only a hash of the token is stored).
• When your device reports, we collect the compliance result only: your overall grade/score and the pass/fail verdict and summary for each check (for example Wi-Fi encryption, router/gateway exposure, device isolation, DNS & VPN integrity), the ruleset version, and timestamps.

Technical & security logs

• For security and dispute resolution we keep an audit log of significant account events (device linked/unlinked, certificate issued, subscription changes), including the event time, machine identifier, and the requesting IP address and user-agent.
• Aggregate counts such as the number of app downloads.

Cookies & local storage

• The website uses browser local storage for your login session, your light/dark theme preference, and your "keep me signed in" choice. We do not use third-party advertising or cross-site tracking cookies.

3. What We Do NOT Collect

The desktop application never uploads your browsing history, the contents of your files, your messages, or a general inventory of the devices on your network. Only the compliance result described above is transmitted, and only while your device is linked to a subscribed account. Unlinking the device stops all uploads.

4. How We Use Information

• To create and operate your account and authenticate you.
• To process subscription payments and manage seats/machines.
• To issue, update, and verify compliance certificates, and to show a certificate's current status to anyone you share its verification link with.
• To secure the Services, detect abuse, and resolve disputes (audit log).
• To communicate with you about your account, security, and service changes.

5. Sharing a Certificate With Your Employer

A core purpose of the Services is to let you prove your home-office compliance to an employer or other party. When you generate a certificate and share its verification link, the person who opens that link can see the certificate's grade/score, the per-check verdicts, the machine name and identifier it was issued for, and whether the machine has recently confirmed its status. You control whether to generate and share a certificate. Think carefully before sharing a link, as it reflects your home network's security configuration.

6. Service Providers

We share information with processors who help us run the Services, under their respective terms and safeguards:

• Supabase — authentication, database, and serverless functions.
• Stripe — payment processing and subscription billing.
• Our website hosting provider.

We do not sell your personal information.

7. Data Retention

We retain account, subscription, and compliance data while your account is active. If your subscription lapses, your certificates stop being verifiable immediately, and if you do not resubscribe within a grace period (currently 30 days) the associated certificates, device links, and live status data are permanently deleted. Unlinking a device immediately and permanently removes that machine's certificate and status. Audit-log records are retained for a longer period for security and dispute-resolution purposes.

8. Your Rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent.

California (CCPA/CPRA)

California residents may request disclosure of the categories and specific pieces of personal information we have collected, request deletion, and are entitled not to receive discriminatory treatment for exercising these rights. We do not sell personal information.

EEA/UK (GDPR)

If you are in the EEA or UK, our lawful bases for processing are performance of our contract with you (operating your account and issuing certificates), our legitimate interests (securing the Services, preventing abuse), and your consent where required. You may lodge a complaint with your local supervisory authority.

To exercise any right, contact us at support@cyberlabcorp.com. We will verify your request and respond as required by law.

9. Security

We protect data with measures including encryption in transit (HTTPS), row-level access controls so each account can only access its own data, server-side verification of privileged actions, device tokens stored only as hashes, and an audit trail. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Children

The Services are not directed to children under 16, and we do not knowingly collect their personal information.

11. International Transfers

We operate from the United States, and our providers may process data in the United States and elsewhere. Where required, we rely on appropriate safeguards for cross-border transfers.

12. Changes to This Policy

We may update this Policy from time to time. We will post the updated version here with a revised "Last updated" date, and for material changes we will take additional steps as required by law.

13. Contact

CyberLab LLC
Waxhaw, NC 28173, USA
Privacy: support@cyberlabcorp.com
Security: security@cyberlabcorp.com

This document is provided for transparency and does not constitute legal advice.