Privacy Policy

1. Introduction

Cyber Arcanum ("we", "us", "our") operates the cyberarcanum.com platform. This Privacy Policy explains how we collect, use, and protect your personal information when you use our cybersecurity education platform.

2. Information We Collect

Account Information

When you create an account, we collect your username, email address, and password (stored securely using industry-standard hashing).

Usage Data

We collect information about your interactions with the platform, including lab progress, game scores, learning path completion, and session data to provide a personalised experience.

Authentication Data

We use Authentik for identity management. Authentication sessions are managed via secure, HTTP-only cookies.

3. How We Use Your Information

We use your information to:

• Provide and maintain the platform
• Track your learning progress and achievements
• Authenticate your identity and secure your account
• Improve our educational content and user experience
• Communicate important updates about the service

4. Payment Information

If you subscribe to a paid plan (e.g. Super User), your payment is processed securely by Stripe, our third-party payment processor. We do not store your credit card number, expiry date, or CVC on our servers.

Stripe collects and processes your payment details in accordance with their own privacy policy and PCI DSS compliance standards. We receive only a limited set of information from Stripe, including:

• Your Stripe customer ID (used to link your subscription to your account)
• Subscription status (active, cancelled, etc.)
• Billing email address

We store the mapping between your Stripe customer ID and your Cyber Arcanum username to manage your subscription. This data is kept for as long as your account is active or as required for financial record-keeping.

5. Data Storage and Security

Your data is stored securely on our servers. We implement appropriate technical measures including encrypted connections (TLS), secure authentication, Content Security Policy headers, and regular backups to protect your personal information.

6. Cookies

We use essential cookies for authentication and session management. These are strictly necessary for the platform to function. We do not use third-party tracking or advertising cookies. For more details, see our Cookie Policy.

7. Third-Party Services

We use the following third-party services:

• Cloudflare — DNS, CDN, and DDoS protection. Cloudflare may process limited request data (IP address, headers) in accordance with their privacy policy.
• Stripe — Payment processing for paid subscriptions. Stripe processes your payment information in accordance with their privacy policy. We do not store card details on our servers.

We do not sell, rent, or share your personal data with any other third parties for marketing purposes.

8. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Export your progress data

9. Data Retention

We retain your account data for as long as your account is active. If you request account deletion, we will remove your personal data within 30 days, except where retention is required by law.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of significant changes via email or an in-platform notice.

11. Contact

If you have questions about this Privacy Policy or your personal data, please contact us at [email protected]