Legal Center · Version 2026-10-29

Privacy Policy

How CyberNet handles account data, submitted evidence, AI processing, connected API keys, browser storage, billing records, legal acceptance, retention, export, and deletion rights.

Effective: 4 September 2026 · Last updated: 29 October 2026Contact: [email protected]Service: cybernetai.app

1. Scope, controller, and legal operator

This Privacy Policy explains how CyberNet processes personal information when you visit the website, use the CyberNet AI iPhone app, create or use an account, submit content for analysis, connect an API key, purchase or manage a subscription, save reports, use support, or interact with current and planned features.

The data controller is Marks Events FZ LLE, registration number 20116/2025, which operates CyberNet AI. Privacy requests, access requests and complaints may be sent to [email protected].

The CyberNet AI iPhone app is listed on Apple’s App Store under the name of its developer, Walid Zeineddine. Marks Events FZ LLE operates the app and is the data controller for it too. This Policy covers the app, and the same address, [email protected], handles the app’s privacy and support requests.

2. Information CyberNet may collect

Account and identity information

first name, last name, full name, email address, user ID, account status, authentication timestamps, and profile metadata; if you use Sign in with Apple in the iPhone app, the name you choose to share (on first sign-in only) and your email address or the private relay address Apple creates for you;
email-verification, password-reset, sign-in, session, and security-event information handled through Supabase;
plan, subscription status, billing interval, daily usage, feature access, and account preferences.

Submitted Content and analysis information

messages, text, URLs, screenshots, images, QR codes, email headers, filenames, and other evidence you choose to submit;
local analysis signals, AI prompts derived from the submission, risk scores, verdicts, evidence, limitations, recommended actions, reports, history, and feedback about results.

Technical and usage information

IP address, approximate network location, browser and device type, operating system, page URL, timestamps, language, request identifiers, function logs, error records, security events, and rate-limit information;
feature interactions, selected plan, analyses used, report actions, legal-document views, support category, and website-performance data.

Billing and support information

Stripe customer, checkout, subscription, invoice, payment status, refund, cancellation, and dispute identifiers; CyberNet does not intentionally store complete card numbers;
support form details, contact email, message, category, page URL, submission time, and browser information; for a problem reported with a result in the iPhone app, the kind of result and its reference number (what you checked is not attached unless you type it in).

Legal-acceptance records

user ID, acceptance type, document versions, server timestamp, page URL, billing cycle when relevant, and limited user-agent information.
in the iPhone app, your “Allow AI analysis?” choice: the version of the notice you saw, when you allowed or withdrew it, and the app’s user-agent text (the app version and the iOS version).

3. How specific features handle information

Quick Scan and Analysis AI

Submitted evidence is processed in the browser and may be sent over HTTPS to Netlify Functions. When AI is enabled, relevant content may be sent to OpenAI to generate the requested analysis. CyberNet does not promise that all processing stays on the device.

Link and QR-code previews

On Pro and Business accounts on the website, and in the iPhone app for any signed-in account that taps Show a picture of this page, a link you check, including a link found inside a message or a QR code, can come with a picture of the page, so you can see where it leads without opening it. To make the picture, CyberNet sends that web address to GetScreenshot, a service of Rasterwise, and, if it is slow or unavailable, to Microlink. Their computers open the page and send back a screenshot, so the page never runs on your device. They receive the full web address, including anything written inside it, but not your name, email address, or account details. CyberNet shows the screenshot in your result and does not store it on its servers; the providers may keep the address and the picture for a short time under their own terms. If a link carries private details, such as a password-reset or invitation link, those details reach the preview service too.

Recovery Mode

Incident descriptions, quick-answer signals, and optional screenshots you submit to Recovery Mode are processed to generate a recovery case, plan, and task checklist stored in Supabase under your account. CyberNet attempts to detect and redact common secrets (such as passwords, OTPs, and card numbers) before they are stored or sent for AI processing, but automatic redaction is not guaranteed — never submit passwords, one-time codes, recovery codes, full card numbers, seed phrases, or private keys.

Saved reports and history

Some Quick Scan reports may be stored in browser local storage. Pro AI history, Recovery Mode cases, and account information may be stored in Supabase. Screenshot bytes may be excluded from browser-saved history or kept only for the active session, depending on the feature. Browser data can be removed by the user or browser and is not guaranteed to be recoverable.

User-provided OpenAI API keys

A validated key is stored only in the current browser tab’s session storage. It is temporarily transmitted over HTTPS to a Netlify Function for validation and to send the requested analysis to OpenAI. CyberNet does not intentionally store the key in Supabase, the user profile, logs, or saved reports. Closing the tab or selecting “Forget Key” removes the browser copy. OpenAI may process or temporarily retain API data under its own terms and controls.

Business team accounts — your activity is visible to your team owner

If you join a CyberNet AI Business team, the team owner can see what you do on that team. This is the single most important privacy consequence of accepting a team invitation, so it is stated plainly here rather than buried elsewhere.

Specifically, the owner of the team you belong to can view, for every Quick Scan, Analysis AI, and Recovery Mode use you make while you are a member: your name and the email address on your account, the date and time, which feature you used, what you submitted, and the full stored result — including the verdict, risk score, threat type, the full explanation, the warning signs found, the recommended actions and the limits of the check, and for Recovery Mode the case title, incident type, risk level, urgency, status, the recovery plan, your checklist progress, and the plan’s update history.

What is kept from your submissions (updated 17 September 2026). While you are a member of a team, CyberNet stores the text, links, and decoded QR-code contents you submit to Quick Scan and Analysis AI, and the description you write when you open a Recovery Mode case, so that the team owner can read them in the team activity log. Quick Scan normally runs only in your browser; for team members its result and the submitted text or link are also sent to CyberNet for this log. Before anything is stored, payment-card numbers, private keys, and secret-key-style tokens are removed, and Recovery Mode descriptions additionally have one-time codes and recovery phrases removed. Pictures and screenshots you upload are not stored — only what was read from them, such as a QR code’s contents. Treat anything you run on a team account as visible to the team owner.

This applies only to members of a Business team. The team owner’s own activity is not shown to anyone and its submitted content is not stored, and submissions from personal Free and Pro accounts are not added to saved history.

Activity from before you joined a team, and activity after you are removed from it, is not shown to that owner. If you do not want an owner to see your activity, do not accept the invitation and use a separate personal account instead. You are shown this consequence on the invitation screen before you join.

The CyberNet AI iPhone app

Checks on your iPhone. Quick Scan, QR-code scanning and “Share to CyberNet AI” (the app’s share-sheet extension) run on your iPhone. They work without an account, and what you check with them is not sent to CyberNet or to anyone else. The camera is used only when you choose to scan a QR code or take a photo; QR codes are read on the iPhone. A photo leaves the iPhone only if you send it for an AI explanation or attach it to a Recovery Mode case.

AI analysis, only with your permission. Before the app sends a message, link, screenshot or Recovery Mode description to CyberNet’s server for an AI explanation, it asks “Allow AI analysis?” and explains that the content is passed to OpenAI, a third-party AI provider, to write the explanation. Nothing is sent for AI analysis until you choose Allow, and CyberNet’s server refuses AI requests from the app without that permission. CyberNet keeps a record of your choice (see section 2). You can withdraw it at any time in Account → Privacy & data; the app then stops sending content for AI analysis. Withdrawing does not undo an analysis already done.

Sign in with Apple. If you choose it, Apple confirms who you are and shares with CyberNet your name (only the first time, and only if you allow it) and either your email address or a private relay address that forwards to you. When you delete your account, CyberNet asks Apple to revoke the app’s Sign in with Apple access.

Sign in with Google. If you choose it, Google confirms who you are and shares with CyberNet your name, email address, and profile picture. CyberNet does not receive your Google password.

Kept on the iPhone. Your sign-in session is kept in the iPhone’s Keychain. Recovery Mode reminders are scheduled on the iPhone as local notifications: nothing is sent to CyberNet to schedule them, and they contain no case details. An item you share to the app waits on the iPhone until you use it, or for up to 24 hours. Signing out removes the session and the reminders; deleting your account also removes any waiting item.

Saved explanations. In the app, the AI explanations of every signed-in account are saved to that account’s history, which you can clear in Account → Privacy & data.

Business team members. If your account belongs to a Business team, the Analysis AI and Recovery Mode results you create in the app are added to the team owner’s activity log, as described below. Checks that run only on your iPhone are not.

Analytics. The app uses Google Analytics only if you allow tracking when the app asks, as described in section 9.

No purchases or advertising. The app has no purchases and shows no advertising. Apple handles your App Store account and the download under Apple’s own privacy policy; CyberNet does not receive your Apple payment details.

Payments

Stripe processes payment details and returns customer, subscription, invoice, and status information needed to unlock, renew, cancel, refund, or troubleshoot Pro or Business access. For a Business team, billing information belongs to the team owner's account; members do not have access to it.

Error diagnostics

When part of the website or one of CyberNet’s server functions fails, CyberNet records a short technical report so the problem can be found and fixed: the error message, where in the code it happened, which page it was on (without the parts of the address that can hold private details), the browser, its main version number and the operating system (for example, Safari 26 on iOS), the site version, and the time. CyberNet collects these reports itself; no outside error-tracking company is involved. The reports are designed to contain no personal data: anything you typed or scanned, page content, cookies, and stored data are never included, and email addresses, sign-in codes, access tokens, IP addresses, and long numbers are removed before a report is kept. Your connection address is used only in scrambled (hashed) form, to limit how many reports one connection can send. Reports from the iPhone app also say that they come from the app, and which version. Reports are kept in CyberNet’s hosting logs and in alert emails sent to CyberNet’s support inbox.

4. Why CyberNet uses information

CyberNet may process information to:

create, authenticate, secure, and support accounts;
provide text, link, image, QR, and report functions;
enforce Free and Pro limits, save eligible history, and provide downloads;
validate and route optional BYOK requests;
process subscriptions, invoices, renewals, cancellations, refunds, and payment failures;
record legal acceptance and demonstrate payment authorisation or compliance;
detect abuse, fraud, attacks, unauthorised access, and service misuse;
debug errors, maintain availability, measure performance, and improve safety and usability;
respond to support, privacy, security, and legal requests; and
comply with law, enforce agreements, and protect users, CyberNet, providers, and third parties.

CyberNet does not sell personal information. CyberNet does not use OpenAI API submissions to train CyberNet’s own public model. Third-party processing is governed by provider terms.

5. Legal bases

Depending on location and context, CyberNet relies on:

contract: to provide accounts, analyses, reports, subscriptions, billing, and requested support;
legitimate interests: to secure, prevent abuse, troubleshoot, improve, and operate the Services while considering user rights;
consent: where law requires it for a particular optional activity or communication, and for AI analysis and analytics in the iPhone app, which you can withdraw at any time;
legal obligation: for accounting, tax, sanctions, fraud prevention, consumer, security, and lawful-request duties; and
vital or public interests: only where applicable and legally permitted.

Accepting the Privacy Policy acknowledges this notice; it is not blanket consent for unrelated marketing or advertising.

6. Service providers and recipients

CyberNet may disclose limited information to providers that process it for the purposes described above, including:

Supabase: authentication, profiles, usage, saved history, legal-acceptance records, database services, and the sign-up confirmation and password-reset emails;
Netlify: website hosting, serverless functions, security, logs, deployment, and support forms;
Cloudflare: the network in front of cybernetai.app, which delivers the site and protects it from attacks, so it handles your IP address and the requests your browser makes; and routing of email sent to CyberNet’s cybernetai.app addresses, such as [email protected];
Stripe: checkout, recurring billing, invoices, payment methods, refunds, disputes, fraud prevention, and billing portal services;
OpenAI: AI analysis requested by CyberNet or by a user through BYOK; from the iPhone app, only after you allow AI analysis. OpenAI processes submissions under its API terms, does not use them to train its models, and may keep them for up to 30 days to monitor for abuse (longer where the law requires, or where reasonably necessary to protect against harm);
Resend: sending CyberNet’s own emails, such as Business team invitations, Recovery Mode check-in reminders, and, to CyberNet’s own inbox, error alerts and the encrypted weekly backups; it receives the recipient’s email address and the message;
GetScreenshot (Rasterwise) and Microlink: link and QR-code previews (Pro and Business accounts on the website; on request in the iPhone app); they receive the web address being previewed, as described in section 3;
Apple: distributes the iPhone app through the App Store and, if you choose Sign in with Apple, confirms who you are and shares your name and your email or relay address with CyberNet, as described in section 3;
Google (Google sign-in): only if you choose Continue with Google on the website or Sign in with Google in the iPhone app; Google confirms who you are and shares your name, email address, and profile picture with CyberNet, and Google knows that you signed in to CyberNet;
Google (Google Analytics): only if you accept analytics cookies on the website, or allow tracking in the iPhone app; visit and app-use statistics as described in section 9;
Google (Gmail): hosts the inbox that receives email sent to CyberNet’s cybernetai.app addresses, including support requests, error alerts, and the encrypted backups described in section 10;
jsDelivr: on the website, your browser downloads some of the site’s code libraries directly from this network (the iPhone app carries its own copies and does not download them), so, as with any website, it receives your IP address and basic browser details, but nothing you type or scan. The site’s typefaces are served from CyberNet AI’s own servers;
professional advisers and authorities: where reasonably necessary for legal, security, fraud, accounting, insurance, or compliance purposes; and
business successors: in a merger, financing, acquisition, restructuring, or sale, subject to appropriate safeguards.

CyberNet does not permit providers to use information for unrelated purposes except as allowed by their direct relationship with the user, their terms, or applicable law.

CyberNet shares personal information with these providers only where they are bound, by contract or by their published data-processing terms, to protect it with safeguards at least equal to those described in this Policy.

7. International processing

CyberNet and its providers may process information in the United Arab Emirates, the European Economic Area, the United States, and other countries where providers operate. Those countries may have different data-protection laws.

Where required, CyberNet will use contractual, legal, organisational, or provider safeguards for cross-border transfers and will provide additional information upon a valid request.

8. Retention schedule

CyberNet keeps information only for the periods reasonably necessary for the stated purposes, security, disputes, and legal obligations. Current target periods are:

Category	Typical retention
Active account and profile	For the life of the account, then deletion from active systems generally within 30 days after a valid deletion request, subject to exceptions below.
Unsaved analysis input and output	CyberNet does not intentionally add it to saved history; temporary function, security, or provider processing may continue for up to 30 days, unless a shorter provider setting applies or an incident requires longer preservation.
Business team activity (submitted text, links, QR contents, Recovery descriptions, and full results of team members)	While the member’s account remains active or until the member deletes their data or account; deletion from active systems generally within 30 days and residual backups for up to 8 weeks. Removal from a team stops new activity being shown to that owner; past activity stays in that team’s log.
Pro saved history and reports	While the account remains active or until the user deletes it; deletion from active systems generally within 30 days and residual backups for up to 8 weeks.
Browser local or session storage	Until the user clears it, the browser removes it, the tab closes for session data, or the feature’s “Forget/Clear” control is used.
BYOK API key	Current browser tab only; removed when the tab closes or “Forget Key” is used. It is not intentionally retained in the CyberNet account or database.
Security, access, and rate-limit logs	Normally up to 90 days; up to 12 months where needed to investigate abuse, fraud, attacks, or service incidents.
Support and feedback records	Normally up to 24 months after the matter is closed, unless a dispute or legal duty requires longer.
Billing, tax, invoice, refund, and dispute records	Normally up to 7 years after the relevant transaction or account closure, or longer where law requires.
Legal-acceptance records	Normally up to 7 years after account closure or the last relevant transaction, or longer where needed for a legal claim or mandatory obligation.
AI analysis permission (iPhone app)	For the life of the account, with the dates it was given or withdrawn; deleted with the account.
Backups	Weekly encrypted backups are kept for 8 weeks and then deleted, so deleted data can remain in a backup for up to 8 weeks, unless a backup is isolated for security or legal reasons.

CyberNet may shorten these periods as systems improve. Information may be retained longer when necessary for fraud prevention, security investigations, payment disputes, legal claims, sanctions, tax, accounting, lawful requests, or protection of rights.

9. Cookies and browser storage

CyberNet may use essential cookies, local storage, and session storage for authentication, navigation, preferences, plan state, legal acceptance, temporary API-key handling, saved browser reports, and security. Essential storage is required for core functionality.

Optional analytics cookies (Google Analytics)

Only if you choose Accept in the cookie bar, CyberNet uses Google Analytics, a service provided by Google, to count visits and see which pages help people. If you choose Decline, or have not chosen yet, the Google Analytics script is not loaded, nothing is sent to Google Analytics, and no Google Analytics cookies are set.

If you accept, Google receives: the pages you open on cybernetai.app, with private details such as invite links and sign-in codes removed from the address; how you arrived, for example from a search engine or an ad; your device and browser type; your approximate location, which Google works out from your internet connection; and how long you spend on each page.

Google does not receive anything you scan or type: not your messages, links, pictures, QR codes, or Recovery Mode descriptions, and not your account details or email address.

Google Analytics sets two cookies, _ga and _ga_<ID>, which Google keeps for up to 2 years. Google signals and ad personalisation are turned off. Declining keeps every CyberNet feature working. Your choice itself is saved in your browser’s local storage.

You can change your choice at any time with “Cookie settings” at the bottom of the CyberNet site or with the button below. If you switch to Decline, Google Analytics stops and its cookies are deleted from your browser.

Google Analytics in the iPhone app (only if you allow tracking)

Before the iPhone app uses Google Analytics, it asks through Apple’s tracking prompt whether CyberNet AI may track your activity across other companies’ apps and websites. Only if you choose Allow does the app load Google Analytics, to count how the app is used: which screens are opened and when, the app version, your device type and iOS version, and your approximate location, which Google works out from your internet connection. Google is a separate company that may combine this with other information, so Apple’s rules treat it as tracking and the app asks you first.

If you choose Ask App Not to Track, Google Analytics is never loaded in the app and nothing is sent to it. The Share extension never uses it. Google does not receive anything you scan, share or type in the app, and not your account details or email address. You can change your choice at any time in the iPhone’s Settings → Privacy & Security → Tracking.

10. Security measures

CyberNet uses measures intended to reduce risk, including HTTPS, server-side secret storage, authenticated Netlify Functions, Supabase Row Level Security, access controls, request limits, input and file-size validation, security headers, restricted browser permissions, provider authentication, and separation of public and private keys.

Encrypted backups. Once a week, CyberNet makes a backup of its account database so that accounts and saved data can be restored after a technical failure. The backup holds the stored account data and the sign-in account details, but never passwords or sign-in tokens. It is compressed and encrypted (AES-256) before it leaves CyberNet’s server function, is delivered by email to the operator’s support inbox, and is kept there for 8 weeks before it is deleted. It can be opened only with a passphrase that the operator keeps.

No method of transmission or storage is completely secure. Users must protect their devices, passwords, email accounts, API keys, recovery methods, and downloaded reports.

11. Privacy rights and account controls

Depending on applicable law, you may have rights to access, receive a copy of, correct, delete, restrict, object to, or transfer personal information; withdraw consent; request information about recipients and international transfers; ask for review of automated output; and complain to a regulator.

CyberNet’s Account area may provide controls to export available account data, clear saved reports, and request account deletion. Browser-saved information must also be removed through CyberNet’s clear controls or browser settings. Deleting your account also cancels any paid plan immediately (see section 12). In the iPhone app, you can also withdraw your permission for AI analysis in Account → Privacy & data, and change your tracking choice in the iPhone’s Settings.

CyberNet may verify identity before completing a request. It may refuse or limit a request where law permits, including when necessary to protect another person, preserve security, collect a debt, prevent fraud, or retain legally required records.

12. Account deletion and residual records

You can delete your account at any time from the Account area of the website or of the iPhone app. Deletion takes effect immediately. If the account has a paid plan, including a Business team you own, the deletion cancels it with Stripe at the same time: paid access ends at once, and no refund is given for the unused part of the billing period unless the Refund and Cancellation Policy or applicable law provides otherwise. If the plan cannot be cancelled, the account is not deleted and you are told so. For an account that uses Sign in with Apple, CyberNet also asks Apple to revoke the app’s access.

Deletion removes the CyberNet authentication user and active account data according to the retention schedule. Saved local browser information is cleared on the requesting browser where technically possible; in the iPhone app, the sign-in session, scheduled reminders and any waiting shared item are removed from the app.

Deletion does not require Stripe or other providers to erase records they must retain for payment, fraud, accounting, or legal purposes. CyberNet may retain de-identified information and records necessary for legal acceptance, billing, disputes, security, or compliance.

13. Automated analysis and human review

CyberNet uses automated rules and AI to classify submitted content and generate cybersecurity information. These results may influence a user’s decision but are not intended to make legally binding decisions about credit, employment, insurance, eligibility, or legal rights.

Users should apply independent judgment and may contact support to report an incorrect or concerning result. CyberNet may use submitted feedback to investigate and improve the service.

14. Children

CyberNet is not directed to children under 13 and does not knowingly permit them to create accounts. Users below the legal age of majority should use CyberNet only with a parent or guardian. Contact support if you believe a child’s information was collected without appropriate permission.

15. Security incidents

If CyberNet becomes aware of a personal-data incident, it will investigate, take reasonable containment measures, preserve relevant evidence, and provide notifications required by applicable law. Users should promptly change affected passwords, revoke exposed API keys, enable multi-factor authentication, and contact relevant providers if their own account or submission may have been exposed.

16. Sensitive information users should not submit

Never submit passwords, one-time passcodes, complete card details, private keys, recovery phrases, identity documents, medical records, intimate material, or trade secrets unless there is a lawful, necessary, and protected reason. Redact unrelated personal information before using analysis or support features.

17. Changes to this Policy

CyberNet may update this Policy as features, providers, retention practices, laws, and business operations change. The effective date and version will be updated. Material changes may be communicated through the website, account, or email, and renewed acceptance will be requested where required.

18. Contact and complaints

Privacy questions, access requests, export requests, deletion requests, and complaints may be sent to [email protected]. Include the account email and request type, but never send passwords, one-time codes, API keys, private keys, or complete payment-card information.