Privacy Policy

This policy explains how Qyli Cyber Ltd ("we") collects and uses personal data. We use it in two different roles:

• Controller for the details of the people who sign up for and run a Qyli Cyber account — this policy.
• Processor for the people a customer trains or tests. Where you are asked by your employer, school or another organisation to take training or receive a simulated phishing test, that organisation decides why and how your data is used, and we handle it on their behalf. What is recorded about you is set out in our participant notice, and the terms we work under are in our Data Processing Agreement.

Who we are

Qyli Cyber Ltd, a company registered in England and Wales (number 17350994), registered office 66 Paul Street, London, EC2A 4NA. To contact us about your data, email [email protected].

Data we collect about you as an account holder

• Account data — your name, email address, organisation name and account type, and the details of your sign-in.
• Record of acceptance — which versions of our Terms and Data Processing Agreement you accepted, and when (at sign-up, and again each time they change), and the confirmations you give each time you send a simulated phishing campaign.
• Sign-in security data — when you ask for a sign-in or sign-up link we log your email address and a one-way, keyed hash of your network address for 24 hours, to stop the service being used to spam people. We do not keep your IP address.
• Billing data — handled by Stripe; we store your plan, subscription status and a Stripe customer reference, not your card details.
• Service data — what you create and do in the app: the training you set up, the campaigns you run, your Ask Qyli conversations and your settings.
• Network logs — like any website, our hosting provider (Cloudflare) sees your IP address and browser type when you visit, to deliver pages and protect against attack. We don't use these logs for analytics or profiling.

We don't use advertising or analytics trackers. See our Cookie Policy.

If you use our contact form

• What we collect — the name, email address, company (if you give one), topic and message you type into the form.
• Why — to read your message and reply to you.
• Lawful basis — our legitimate interests in responding to people who contact us.
• Where it goes — the form emails your message to our own mailbox at [email protected]. It is sent through Resend, which keeps a short delivery record, and received in Microsoft 365. We do not store it in the Qyli Cyber application or its database.
• Spam protection — the form uses Cloudflare Turnstile to check that you are a person. As with sign-in links, a one-way, keyed hash of your network address is kept for 24 hours to limit repeated submissions. That hash is the only thing the form records in our database: not your message, name or email address.
• How long we keep it — your message is kept in our mailbox while we deal with your enquiry and any follow-up, and is deleted within 12 months.

Why we use it, and our lawful basis

We do not sell personal data or use it for advertising. We do not use the training results or simulation results of the people on a customer's account to improve our product, or to train AI models, in any form that identifies them. We don't make decisions about individuals by automated means that have legal or similarly significant effects. Where an organisation uses skill reads for escape rooms and a person agrees, the service suggests follow-up training from that person's read; an administrator decides whether to send it.

Who we share it with

We rely on a small number of providers to run the service and to handle our own email, each under a contract that requires them to protect the data:

• Supabase — database and sign-in.
• Cloudflare — hosting and delivery, and the Turnstile spam check on the contact form.
• Resend — sign-in, invitation and training email, and delivery of contact-form messages to our mailbox.
• Postal — the mail server we operate to send simulated phishing emails.
• Contabo — hosts the server that runs Postal (United Kingdom).
• Stripe — payment (your billing contact only).
• Microsoft 365 — our email, where the messages people send us, including through the contact form, arrive and are kept while we deal with them.
• Anthropic — AI. Ask Qyli sends the text you type and the conversation so far, with your organisation's name, to generate a reply, so please don't type other people's personal data into it. The AI Cyber Analyst receives only aggregate statistics about a group — never names, email addresses or individual results, and not your organisation's name. We never send escape-room skill observations, or the reads built from them.

The providers above, other than Microsoft 365, are listed with what they do and where they are in our Data Processing Agreement. Microsoft 365 is our own mailbox and is not part of the training service, so it is named here and not there.

We may also share data with professional advisers, with regulators or the police where the law requires it, and with a buyer if the business is sold (who would have to honour this policy).

International transfers

Some providers process data outside the UK. When they do, we rely on UK adequacy regulations (including the UK–US data bridge for certified providers) or on safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

How long we keep it

• Sign-in link requests, and the network-address hash used to limit contact-form submissions: 24 hours.
• Contact-form messages: kept while we deal with your enquiry and any follow-up, and deleted within 12 months.
• Account data: while your account is open and for 30 days after it closes. Billing and tax records: 6 years, as the law requires.
• Free-access accounts: not closed automatically. We keep the account while it is open, and it stays open until you ask us to close it or we close it. We delete the account and its data when you ask us to, or when it is closed, within 30 days.
• Data about the people you train or test has its own schedule, set out in the Data Processing Agreement.

Your rights

Under UK GDPR you can ask us for a copy of your personal data, to correct it, to erase it, to restrict how we use it, to move it to another provider, and to object to processing based on our legitimate interests. Email us to exercise any of these; we will reply within one month and won't charge for it. You can also complain to the Information Commissioner's Office at ico.org.uk.

If you were asked by an employer, school or other organisation to take training or receive a simulated phishing test, ask them first: they are responsible for that data and can give you a copy, correct it or erase it. If you write to us instead, we will pass your request to them promptly.

Changes

We will update this page when our practices change and show the date above. If a change matters to you, we will email account holders before it takes effect.