Privacy policy

Cyber Guys provides a cyber-risk assessment, training, phishing simulation and evidence platform to Australian businesses and IT providers.

Registered legal entity name, ABN and registered address — to be confirmed

Privacy enquiries:use the contact form — a dedicated address has not been published yet

This distinction determines who is responsible for what, so it comes first rather than buried in a later clause.

• Information we collect for ourselves. When you visit this website, enquire, book a demo, or hold an account with us, we decide what to collect and why. We are responsible for that information.
• Information a customer puts into the platform. When an organisation uploads its employee list, records assessment answers, runs a simulation or issues training, that organisation decides what goes in. We process it on their instruction. If you are an employee of one of our customers and want your information changed or removed, your employer is the right first point of contact — though you are welcome to contact us and we will help you reach the right place.

When you enquire or book a demo: your name, work email address, and optionally your organisation, phone number, which audience you fall into and which plan you were looking at, plus whatever you write in the message.

When you hold an account: your name, email address, a securely hashed password (never the password itself), your role, the organisation you belong to, and your activity in the platform.

Training and assessment records: modules assigned and completed, quiz scores and attempts, competencies demonstrated, badges earned, certificates issued, and assessment answers and evidence recorded by your organisation.

Simulation records: covered separately and in more detail on employee data and phishing simulations.

Security and audit logs: consequential actions in the platform are logged with the acting user, the organisation, an IP address, a user agent and a timestamp. Exports are logged separately, recording what left the platform, when and by whom. These logs exist so that a customer can answer “who did that, and when” — including about us.

Technical information: standard server request information needed to operate and secure the service, including for rate limiting and abuse prevention.

• We do not store your passwords. Only a bcrypt hash is kept, and password reset tokens are stored hashed as well.
• We do not store credentials, API keys or secrets for your other systems anywhere in the schema.
• We do not collect payment card details. Card capture is not implemented in the platform.
• We do not collect age, gender, ethnicity, tenure or performance data, and the risk model is built so that such data cannot be introduced as an input.
• We do not sell personal information to anyone, in any circumstance.

• To provide the platform and the features an organisation has subscribed to.
• To produce the records the product exists to produce — certificates, assessments, decisions, risk acceptances and reports.
• To keep accounts and tenants secure, and to detect and prevent abuse.
• To respond to your enquiries.
• To meet our own legal and record-keeping obligations.

The platform sets a session cookie when you log in, and a token used to protect forms against cross-site request forgery. Both are strictly necessary for the service to function and to be secure. We do not currently run third-party advertising or tracking cookies on this site.

Within a customer organisation, access is determined by role — not everyone with an account can see everything. Across organisations, nobody can see anybody else’s data: every scoped record carries an organisation identifier and access resolves through a single chokepoint, described on the security overview.

We use third-party service providers to host the application, run the database and send email. The categories are listed on the trust centre, with named providers published once those providers are contracted for production.

Subprocessor list and hosting region — to be confirmed

We may disclose information where we are required to by law. We do not otherwise share customer data with third parties.

We are not publishing a data location or data sovereignty claim until the production hosting region is fixed and can be verified by a customer who asks. If data location matters to your procurement or regulatory position, please raise it with us before you buy rather than inferring it from this page.

Data location statement — to be confirmed

• Account and organisation records — for as long as the subscription is active. If a subscription ends, records remain readable for 30 days so you can export the certificates, reports and risk acceptance records you need, after which the organisation is deactivated.
• Evidence and compliance records — retained longer where they are the artefact a customer needs for an insurer, board or auditor. That is the point of them.
• Simulation data — on the schedule set out on the simulations privacy page: raw technical metadata for 30 days by default, simulation events for 730 days by default.
• Enquiries — kept while we are in contact with you and for a reasonable period afterwards.

You can ask us what personal information we hold about you and ask us to correct it if it is wrong. If your information is in the platform because your employer put it there, we will usually need to route the request through them — they control that data, and it is not ours to alter on request.

Access and correction requests:use the contact form — a dedicated address has not been published yet

If you think we have mishandled your personal information, please tell us first and we will investigate and respond. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner.

If we change this policy in a way that materially affects you, we will tell account holders rather than quietly updating the page. The effective date will be shown at the top once the policy is finalised.