Privacy notice

We collect your email address, organisation context intended to be non-identifying, report answers, optional notes, generated report content, payment status and Stripe identifiers, purchase-disclosure and contract acceptance records, IP-derived rate-limit data, and Cloudflare Turnstile verification results. Purchase records can include the terms and refund-policy versions presented, acceptance timestamps, and any express request or acknowledgement recorded for immediate digital supply. For a paid plan, they can also include the version, territory category and timestamp of your self-declaration that you meet the displayed minimum age and purchase-location conditions. We do not collect your date of birth or an address for that declaration. The assessment does not ask for your name or organisation name.

Cyber-security and data-protection answers can still be sensitive even when names are omitted. GDPR answers include activity and jurisdiction selections, reported practice, evidence availability and urgency flags. SOC 2 answers include a service alias and scope, reported control design and operation, and evidence metadata. The forms tell you not to submit credentials, keys, network identifiers, raw logs, configuration exports, personal data or exploitable incident detail. This service does not request evidence-file uploads.

We use this data to generate and send an assessment summary and, when purchased, a detailed action plan; operate their secure links; prevent abuse; respond to support requests; and improve output quality. The organisation-name-free activity and scope context is stored with the assessment so the boundary used for the answers remains clear in the report. Because it is linked to the delivery email, this service is data-minimised rather than anonymous.

You are responsible for removing names and identifying or sensitive technical details from free-text context and notes before submission. For the Cyber Essentials and NIST forms and optional paid refinements, an unfinished draft is kept only in that browser tab's session storage. A free draft can contain the work email, organisation-name-free context, answers and optional notes; a paid-refinement draft can contain optional follow-up answers and notes. The Cloudflare verification token is not stored. Drafts are cleared after successful generation and are not uploaded until you submit the relevant form.

SOC 2 and GDPR browser drafts are optional. If you choose to save one, assessment inputs remain in this browser across visits. The draft does not contain your delivery email or verification token. Use Clear draft to remove it; it is also removed after successful submission, and GDPR drafts older than 30 days are removed when you attempt to restore them. SOC 2 drafts remain until you clear them or submit successfully. Anyone with access to the same browser profile may be able to read it. SOC 2 and GDPR reports are produced within the application; these assessment answers are not sent to OpenAI.

Service emails for report delivery and access are sent because they are needed to provide the service. The assessment form does not subscribe you to marketing emails.

Scores, readiness classifications, priorities, dates and answer traceability are generated deterministically within the application. OpenAI may process a sanitised, identifier-minimised evidence packet to improve permitted summary, finding and action wording. That packet can include the organisation context, answers and optional notes you submit, plus the deterministic report scaffold. The application excludes the delivery email, explicit organisation-name field, payment data and report-access tokens, and redacts detected contact, network, credential and secret patterns. Names or other identifying details can still appear in free text, so remove them before submission. A one-way hash of the delivery email is sent as a stable safety identifier to support abuse detection. OpenAI requests use structured output, moderation and store: false, so the generated response is not stored for later retrieval through the API. If the enhancement is unavailable, refused or fails validation, the application uses the deterministic report instead.

Stripe processes your email and payment details in its hosted Checkout; the application stores only the payment identifiers, amount, currency, status and purchase-acceptance records needed to fulfil the contract, support a cancellation or refund request, and unlock or revoke access. Resend sends report and service emails. Cloudflare Turnstile checks whether a report request appears automated. Hosting and database providers process the data needed to run the site.

Report generation, Stripe checkout, report delivery, and support are processed to provide the requested service or take steps before providing it. Purchase acceptance, accounting and consumer-rights records are also processed where needed to perform the contract, comply with legal obligations or establish, exercise or defend legal claims. Abuse prevention, service security, product improvement, and proportionate record keeping are processed on legitimate interests.

Scoring, prioritisation and report generation use automated rules and may use the guarded OpenAI wording enhancement described above. The output is advisory preparation support: it does not make a legal, employment, credit, insurance, certification or similarly significant decision about you. You can contact info@rightcyber.co.uk if you believe an output is inaccurate.

Free readiness-summary links remain available for 30 days. A purchase unlock link remains available for 90 days from payment; once generated, the paid action-plan report link remains available for 90 days from generation. The underlying assessment answers, generated report and delivery record are deleted after a further 30-day recovery period. A pending payment is preserved until its Stripe Checkout Session is safely reconciled, so payment access cannot be revoked from a local timestamp alone. Once no assessment remains and no active or unresolved payment access depends on it, the associated lead record is anonymised. Processed Stripe webhook payloads are deleted after 180 days. Minimal payment and purchase-acceptance records may be retained longer where needed to provide support, prevent fraud, meet accounting or consumer-law obligations, or resolve disputes. Low-cardinality product events contain no email, token, answer, IP address or report text and are deleted after 400 days. Expired rate-limit records are deleted by the same scheduled cleanup process.

Some processors may process data outside the UK or EEA. Where this happens, the transfer is handled through the processor's published safeguards, such as standard contractual clauses or equivalent transfer mechanisms.

You can ask for access, correction, deletion, restriction, objection, or portability. You also have the right to complain to the UK Information Commissioner's Office if you are unhappy with how personal data is handled. Contact info@rightcyber.co.uk to exercise a right or ask a privacy question.