Privacy Policy | Cyberneza

Last updated: September 26, 2026

Cyberneza ("Cyberneza", "we", "us", or "our") respects your privacy and is committed to protecting it. This Privacy Policy explains how we collect, use, and share information when you visit our website at cyberneza.com, interact with us, or engage our services.

1. Information we collect

We collect the following categories of personal information:

Information you provide directly

Contact information: name, email address, phone number, company name
Communications: messages you send via contact forms, email, or scheduling tools
Professional information: job title, company size, industry, and compliance needs you share with us

Information collected automatically

Device information: IP address, browser type and version, operating system, device type
Usage data: pages visited, time spent on pages, referring URLs, click patterns
Session replay data: where analytics cookies are active (see section 3), Microsoft Clarity records how you interact with pages — mouse movement, scrolling, and clicks — to produce session recordings and heatmaps. Clarity is configured in strict masking mode, so all page text — including anything you type into a form — is masked before the recording is sent, and the content of your entries is not captured.
Location data: approximate geographic location based on IP address (country/region level only)

2. Legal basis for processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases:

Consent: When you accept analytics cookies via our consent banner, or when you submit a contact form or book a call, you consent to us processing your information for those purposes.
Legitimate interests: We maintain basic website security and functionality. Our legitimate interests do not override your fundamental rights and freedoms.
Contract performance: When you engage our services, we process information necessary to fulfill our contractual obligations.
Legal obligation: We may process data when required to comply with applicable laws.

3. Cookies and tracking technologies

How non-essential cookies behave, and whether you see a consent banner, depends on where you are visiting from. Any choice you make is stored in your browser and remembered on future visits.

EEA, UK, and Switzerland: a consent banner asks whether you accept or decline non-essential cookies on your first visit. Analytics and advertising cookies are off by default and are set only if you click Accept (opt-in).
United States and everywhere else: no banner is shown. Analytics and advertising cookies are on by default, consistent with the opt-out model under U.S. privacy laws. You can turn them off at any time by clicking Cookie Settings in the site footer, which opens the same accept-or-decline choice (opt-out). The Do Not Sell or Share My Info link beside it brings you to the California section of this policy, which explains every way to opt out.

Essential cookies

Required for basic website functionality. Your cookie consent preference is stored in your browser's local storage so it persists between visits. These cannot be disabled.

Analytics and advertising cookies

Cookie	Provider	Purpose	Duration
_ga	Google Analytics	Distinguishes unique users	2 years
_ga_*	Google Analytics	Maintains session state	2 years
_gcl_au	Google Ads	Stores ad-click information for conversion measurement	90 days
_uetsid	Microsoft Advertising	Session identifier for conversion tracking	1 day
_uetvid	Microsoft Advertising	Visitor identifier for conversion tracking and remarketing	13 months
__oppref	OpenAI (ChatGPT Ads)	Stores the OpenAI ad-click reference (`oppref`) from the page you landed on, for conversion measurement	30 days
__obref	OpenAI (ChatGPT Ads)	Random browser reference used to connect an ad click to a later conversion	1 year
_clck	Microsoft Clarity	Persists the Clarity user ID for session replay and heatmaps	1 year
_clsk	Microsoft Clarity	Connects page views into a single session recording	1 day

Microsoft services may also set third-party cookies on Microsoft's own domains (such as MUID, used to recognize browsers across Microsoft sites, valid up to 13 months). These are governed by the Microsoft Privacy Statement.

First-party campaign attribution (session and local storage)

When you open our site in a browser tab, we store a small record of that visit in your browser's session storage under the key cn-attrib: the page you landed on, the referring site, the time of your visit, a random visit identifier (cn_id) and, where the repeat-visit identifier described under "First-party engagement measurement" below is set, a copy of it. If the link you arrived through carries campaign parameters — utm_source, utm_medium, utm_campaign, utm_term, utm_content, a Microsoft click ID (msclkid), a Google click ID (gclid, or its gbraid, wbraid or dclid forms), or an OpenAI click ID (oppref) — those parameters are stored in the same record; on a visit without them, they are simply absent. This is not a cookie: it is first-party data that records your first page in the tab session (and, if a later page in the same tab session was reached from an ad click, that page and the time of that click), and it is deleted automatically by your browser when the tab session ends. It is not shared with advertising networks.

First paid touch (local storage). If the first time you arrive through such a link is on one day and you send us an enquiry on another, the tab-session record above has usually been deleted by then, and we would wrongly conclude you found us on your own. So the first time your browser arrives through a link carrying campaign parameters or a click ID, we also keep a copy of those parameters, the landing page, the referring site's hostname and the time in your browser's local storage under the key cn-first-touch. It is written once and never updated, it is meant to hold campaign context and not anything about you, and it is governed by exactly the same rules as the repeat-visit identifier described under "First-party engagement measurement" below: in the United States and other opt-out regions it is kept unless you opt out; in the EEA, the United Kingdom and Switzerland it is kept only after you accept the cookie banner; and it is deleted, and never set, if you decline the banner, if your browser sends the Global Privacy Control signal, or if you use the measurement opt-out. It is not shared with advertising networks.

If you decline non-essential cookies (or revoke consent via Cookie Settings), every identifier is deleted immediately and is not re-created while your choice remains declined: the visit identifier (cn_id), the repeat-visit identifier, any Microsoft, Google or OpenAI click ID (including where one appears in the recorded landing-page address), and the whole first-paid-touch record. What remains in the tab-session record is reduced to context: the campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the path of the page you landed on and, if a later page in the same tab session was reached from an ad click, the path of that page (each with every other part of its address removed), the referring site's domain rather than the page on it, and the times. Your browser deletes it when the tab session ends. If you then send us an enquiry, that context is attached to it so we know which campaign it came from, but no click ID or identifier is.

When you submit a form, whichever attribution records exist at that moment — both of them, or after a decline only the reduced tab-session context described above — together with your answers and your cookie-consent state at that moment, are attached to your submission and stored securely in our systems so that we can respond to your enquiry and understand which ad or link brought you to us. When you open our scheduling links (Calendly), the visit identifier and campaign parameters are included in the scheduling link so that a booking you choose to make can be connected to your enquiry — only while a visit identifier exists; after a decline the links are left untagged. Scheduling is governed by Calendly's privacy policy.

First-party engagement measurement (cookieless)

We measure how our own pages are used with our own software, rather than relying only on Google's and Microsoft's analytics. The measurement itself is cookieless: it sets no cookie and writes nothing to your browser's local or session storage, and it can recognize you on no other site. To group the pages of one visit together it uses a value derived on our server that cannot follow you from one day to the next (see "We do not store your IP address" below). Because of that, the measurement operates without needing your consent under the cookie rules, which govern storing and reading information on your device. The one thing we do store on your device — separate from this measurement, and only where the rules below allow it — is the repeat-visit identifier described next.

Repeat-visit identifier. So that we can tell that a visit today and a visit last week came from the same browser — for example, to understand that the ad someone clicked on Monday led to the enquiry they sent on Friday — we store one random identifier (a meaningless string of letters and digits, named cn-visitor-id) in your browser's local storage. It identifies your browser to this website only: it is not a cookie, it is not readable by any other site, it is never shared with advertising networks, and it contains nothing about you. Where you are governs whether it is on by default: in the United States and other opt-out regions it is set unless you opt out, consistent with the opt-out model described in section 3; in the EEA, the United Kingdom, and Switzerland it is set only after you accept the cookie banner. It is deleted, and never set, if you decline the banner, if your browser sends the Global Privacy Control signal, or if you use the measurement opt-out described below.

What we record for each page you view: the page path (never the query string), the page title, the site you arrived from (the domain only — for example bing.com, never the full address or anything you searched for), whether the page was your entry point, how long the page was open and active, how far down the page you scrolled, your approximate location, your device type, and your browser and operating system family.

About that approximate location. We record the country, the state or region, and the nearest city that our network provider associates with your internet connection — for example "United States, Florida, Orlando". We use it to understand which parts of the country our visitors come from, because we serve clients regionally. Two things are worth being precise about. First, it is derived by our network provider from your connection and given to our server; it is not read from your device, and no cookie or storage is involved, which is why this measurement still operates without consent under the cookie rules. Second, it is approximate and often wrong at the city level — it reflects where your internet provider routes traffic, not where you are. We still do not store your IP address itself (see below).

We also record interactions with our pages: which links and buttons are clicked, and — this is the part we most need in order to fix our own forms — when someone begins filling in a form and does not send it, including how many fields were completed and which field they were on when they stopped. We record the names of our form fields, never anything you type into them. Nothing you enter into a form is recorded unless you choose to submit it.

We do not store your IP address. To group the pages of a single visit together without a cookie, our server combines your IP address and browser identification with a secret value that changes every day, and keeps only the irreversible result. That value cannot be turned back into your IP address, and because the daily secret changes, the value for the same visitor is different tomorrow — so this cannot follow you from one day to the next. The IP address itself is never written to our records.

This data is stored in our own database, is used only by us to improve this website, and is never sold, shared with advertising networks, or used to build a profile of you. It is retained for 13 months and then deleted.

Session recording. As part of this same first-party measurement, we also record a playback of the pages you view here: the page as it was drawn, and what you did on it — where you moved and clicked, how far you scrolled, which form fields you moved between, and any error our own scripts produced. We use it for one purpose, which is to find where our own pages and forms fail people; that is very hard to work out from counts alone. It runs for every visitor on exactly the same basis as the measurement described above — the recorder itself sets no cookie and writes nothing to your browser's local or session storage, and a recording carries no identifier that can recognize you on a later visit or on another site.

What you type is never recorded. Every form field — every text box, every message box, every dropdown — is masked in your browser before anything is sent. The recording carries only the fact that a field of a certain length was filled in, never the characters in it. That masking happens on your device at the moment of capture, so the values are not sent to us and then removed: they never leave your browser at all. Anything you enter into a form — your name, your email address, your message — is outside the recording by construction, whether you typed it or your browser filled it in for you. As with the measurement above, we also do not record the query string of the address you are on, the full address of the site you came from, or your IP address.

Recordings are kept for 30 days and are then deleted automatically. That is deliberately shorter than the 13 months we keep the measurement records described above: a replay is a much richer record than a count, and there is no good reason to keep one for longer than it takes us to act on it.

A one-question prompt, and the only thing here you write yourself. After you have been reading a page for a while, we may show a small box in the bottom-left corner asking what you were hoping to find. Answering is entirely optional and the box closes on a click, on the Escape key, or by being ignored. It never appears on a page where you are filling something in, and never while you have text in a form.

Everything else described on this page is behaviour our scripts observed — pages, counts, timings. Your answer is the one thing we store that you actually wrote, so we keep it separately from the rest and treat it with more care. We do not ask for your name, email or phone number in that box, and we would rather you did not put them there — if you want a reply, please use the contact form instead, which is designed for it. If you close the box without answering, we record only that it was shown and declined, and nothing else. Answers are kept for 13 months, the same as the measurement records above, and are used solely to improve this website.

Opting out. If you would rather not be included even in this anonymous measurement, run the following in your browser's developer console on this site, and we will stop collecting entirely on this browser: localStorage.setItem('cn-telemetry-optout', '1'). This one setting covers session recording, the question prompt, and the repeat-visit identifier as well — with it in place recording and the prompt are never started (their code is never even downloaded), and the cn-visitor-id identifier is deleted and not set again. You can also email us at privacy@cyberneza.com and we will explain the steps.

What happens before you choose

We want to be precise about this, because "cookies are blocked" and "nothing is sent" are not the same thing.

If you are in the EEA, UK, or Switzerland: our analytics and advertising tags are not loaded at all until you accept. Nothing is requested from Google, Microsoft or OpenAI, and no data — including your IP address — reaches them, unless and until you choose to accept. We also deliberately omit browser "preconnect" hints for those providers, because those alone would open a connection and disclose your IP address before you had chosen.

If you are in the United States or elsewhere: our Google and Microsoft measurement tags load when the page loads, without a banner, consistent with the opt-out model described above. If you decline — or if you send the Global Privacy Control signal — they operate in a restricted mode: they do not read or write cookies and do not create a persistent identifier for you, and we delete any such cookies already set. They do still contact Google and Microsoft servers, which necessarily discloses your IP address, the page address you are visiting, and your referring page. If you prefer that no data reach these providers at all, decline non-essential cookies and use a browser content blocker.

The OpenAI (ChatGPT Ads) measurement pixel has no such restricted mode, so it is treated more strictly: it loads only while advertising cookies are permitted for you — on page load in the United States and other opt-out regions unless you have declined, and only after you accept in the EEA, the UK and Switzerland. It is never loaded if your browser sends the Global Privacy Control signal. If you decline or revoke consent after it has loaded, it is told to stop, it sends nothing further, and its two cookies are deleted.

Microsoft Clarity (session replay) is never loaded until analytics are permitted for your region or you accept, so no session recording occurs before that point.

Google Analytics: We use Google Analytics 4 to understand website usage patterns. Google may transfer data to servers in the United States. Learn more: Google Privacy Policy | Opt-out Browser Add-on

Managing cookies

You can manage analytics and advertising cookies using the consent banner, which appears on your first visit in the EEA, the UK, and Switzerland, and on request everywhere. To open it, or to change your preference at any time, click the "Cookie Settings" link in the site footer — opening it this way immediately revokes any previously granted consent until you choose again. When you decline or revoke consent, we also delete analytics and advertising cookies previously set by our site from your browser.

Global Privacy Control: We honor the Global Privacy Control (GPC) browser signal. If your browser sends GPC, advertising cookies and ad-related data sharing are disabled automatically for your visit — even if you click Accept on the banner — and our own repeat-visit identifier (see "First-party engagement measurement") is deleted and not set.

How we decide which consent default you see: visitors in the EEA, the United Kingdom, and Switzerland get an opt-in default (nothing loads until you accept); elsewhere the default is opt-out. To apply the right default we look up the country of your IP address at our edge network when you first visit, and store only the resulting two-letter country code — not your IP address — in your browser's local storage. If the lookup fails, we estimate your region from your browser's timezone instead.

Consent records: when you make a choice in the cookie banner — accept, decline, or revoke via Cookie Settings — we keep a record of it so that we can demonstrate what you consented to if you or a regulator asks. The record contains the time, the choice made, the page you were on, your IP address and country, your browser's reported timezone, whether a Global Privacy Control signal was present, and the version of this policy in force at the time. Records are stored with our infrastructure provider (Cloudflare) and are retained for 3 years, after which they are deleted automatically. The IP address recorded with a receipt is deleted after 90 days; the rest of the record is kept for the full 3-year period. A receipt ID is stored in your browser's local storage so you can reference your record in any request to us.

Do Not Track: California law (Cal. Bus. & Prof. Code § 22575(b)(5)) requires us to tell you how we respond to browser "Do Not Track" (DNT) signals. We do not respond to DNT headers, because no common industry standard for interpreting them was ever adopted. We honor the Global Privacy Control signal instead, which is the successor mechanism and is recognized under California regulations. We also do not permit third parties to collect personally identifiable information about your activity across other websites through our site, beyond the advertising cookies described in section 3, which you can turn off at any time.

Most browsers also allow you to:

View and delete existing cookies
Block third-party cookies
Block cookies from specific sites
Block all cookies

4. How we use information

We use the information we collect to:

Respond to inquiries and communicate with you about potential or ongoing engagements
Provide, operate, and improve our services and website
Understand aggregate usage patterns to improve content, messaging, and user experience
Send relevant information about our services (only with your consent)
Maintain the security of our website and services and detect or prevent abuse
Comply with legal obligations where applicable

Automated decision-making: We do not use automated decision-making or profiling that produces legal or similarly significant effects on individuals.

5. How we share information

We do not sell, rent, or trade your personal information for money. We do use advertising cookies from Google, Microsoft and OpenAI for conversion tracking and remarketing (see section 3). Because those cookies let advertising partners recognize your browser across other sites, this may qualify as "sharing" for cross-context behavioral advertising under the California Privacy Rights Act. You can opt out at any time by clicking Decline on the cookie banner, Cookie Settings in the footer, or the Do Not Sell or Share My Info link in the footer — any of these turns advertising cookies off. Beyond those advertising cookies, we may share information in the following limited situations:

Service providers: Third parties who help us operate our website, analytics, or communications, bound by contractual confidentiality obligations and data processing agreements.
Professional advisors: Legal, accounting, or other professional advisors when reasonably necessary.
Legal requirements: When required to comply with applicable laws, regulations, court orders, or legal processes.
Business transfers: In connection with a merger, acquisition, or sale of assets, with notice provided to affected users.

Third-party services we use

Google Analytics: Website analytics — Privacy Policy
Google Ads: Advertising conversion tracking and remarketing. Advertising cookies follow your consent choice and region as described in section 3, and are disabled by the Global Privacy Control signal — Privacy Policy
Microsoft Advertising: Advertising conversion tracking and remarketing (Universal Event Tracking). Advertising cookies follow your consent choice and region as described in section 3, and are disabled by the Global Privacy Control signal — Privacy Policy
OpenAI (ChatGPT Ads): Advertising conversion measurement for ads shown in ChatGPT. The pixel records that a contact-form enquiry was sent — not what it said — and connects it to an ad click through the oppref reference and the cookies in section 3. Its "automatic advanced matching" feature may additionally take the email address, phone number and name you typed into our contact form, convert each into a one-way SHA-256 hash in your browser, and include only those hashes with the conversion event so OpenAI can match it to an ad click; the values themselves are not sent to OpenAI by it. The pixel loads only while advertising cookies are permitted for you (section 3), and never under the Global Privacy Control signal — Privacy Policy
Microsoft Clarity: Session replay and heatmap analytics. Configured in strict masking mode, so all page text and form inputs are masked — Privacy Policy
Calendly: Appointment scheduling — Privacy Policy
Cloudflare: Form security (Turnstile) and form processing. Form submissions, including the contact details you provide, are processed by a Cloudflare Worker and retained in short-term operational logs for reliability monitoring — Privacy Policy
Supabase: Database hosting (Supabase, Inc.). Form submissions, including the contact details you provide, are stored in a database hosted by Supabase in the United States — Privacy Policy
Resend: Transactional email delivery for form submissions — Privacy Policy
Render: Website hosting — Privacy Policy
Better Business Bureau: our pages display a BBB accreditation seal that is loaded from a BBB content delivery network. Loading that image discloses your IP address and the referring page to BBB and its CDN provider; it sets no cookies — Privacy Policy

Client and engagement data

This policy covers information collected from website visitors and prospective clients. Information we handle inside a consulting engagement — such as your policies, evidence, system documentation, or personnel data processed during readiness work — is governed by the engagement agreement (master services agreement and, where applicable, a data processing agreement) between Cyberneza and the client, not by this policy. In those engagements we act as a service provider or processor, handling client data for the purposes and on the instructions set out in that agreement. Clients should refer to their executed agreement for the controlling terms.

6. Data retention

We retain personal information for specific periods based on the type of data and purpose:

Contact form submissions: 3 years from last interaction, or until you request deletion
Email correspondence: 3 years from last interaction
Client engagement records: 7 years after engagement ends (for legal and accounting purposes)
Analytics data: up to 14 months (Google Analytics 4 user-level data retention; aggregated reports may persist longer)
Session replay data: individual Microsoft Clarity session recordings are retained for approximately 30 days; aggregated heatmap data for up to 13 months
First-party engagement measurement: 13 months, then deleted. These records contain no cookie and no IP address; where you have not opted out, they include the random repeat-visit identifier described in "First-party engagement measurement" above, and nothing else that could recognize you
First-party session recordings: 30 days, then deleted automatically — shorter than the measurement records above, on purpose. They contain no cookie, no device identifier, no IP address, and nothing you typed into a form (see "Session recording" above)
Answers to the one-question prompt: 13 months, then deleted. This is the only record here containing text you wrote yourself; we never ask for contact details in it (see "A one-question prompt" above)
Hosting and network logs: our website is statically hosted; access logs are maintained by our hosting and network providers (Render, Cloudflare) under their own published retention policies, and we do not separately retain server logs

When information is no longer needed, we securely delete or anonymize it.

7. Information security

As a security-focused company, we implement appropriate technical and organizational measures to protect personal information.

However, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we commit to notifying affected individuals and relevant authorities of any breach as required by applicable law.

8. Your privacy rights

Depending on your location, you may have the following rights regarding your personal information:

All users

Access: Request a copy of the personal information we hold about you
Correction: Request correction of inaccurate or incomplete information
Deletion: Request deletion of your personal information
Opt-out: Opt out of marketing communications at any time

EEA, UK, and Swiss residents (GDPR)

In addition to the above, you have the right to:

Portability: Receive your data in a structured, commonly used, machine-readable format
Restriction: Request restriction of processing in certain circumstances
Object: Object to processing based on legitimate interests
Withdraw consent: Withdraw consent at any time where processing is based on consent
Lodge a complaint: File a complaint with your local data protection authority

Cyberneza is a U.S. business with no establishment in the EEA or UK. We do not advertise into, or direct our services at, the EEA or the UK, so we do not believe the GDPR or UK GDPR applies to our processing of its own force, and we have not appointed a representative under Article 27 of either regulation. To the extent those regulations do not apply, we honor the rights above voluntarily as a matter of good practice. If that changes — if we begin marketing to or serving customers in the UK or the EEA — we will appoint a representative where required and update this policy before doing so.

Complaints: if you are in the United Kingdom you may complain to the Information Commissioner's Office (ICO). If you are in the EEA you may complain to your national supervisory authority, listed by the European Data Protection Board. In Switzerland, the authority is the Federal Data Protection and Information Commissioner (FDPIC). We would rather hear from you first at info@cyberneza.com, but you are not required to contact us before complaining.

California residents (CCPA/CPRA)

Opt out of the sale or sharing of your personal information. One click turns off advertising and analytics cookies in this browser, deletes the ones already set, and records your choice. It applies on this browser and device.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to know: Request disclosure of the categories and specific pieces of personal information we have collected
Right to delete: Request deletion of your personal information, subject to certain exceptions
Right to correct: Request correction of inaccurate personal information
Right to opt-out of sale/sharing: We do not sell personal information for money. Our use of Google, Microsoft and OpenAI advertising cookies may qualify as "sharing" for cross-context behavioral advertising — you can opt out at any time via the Cookie Settings button in our footer, which opens an accept-or-decline choice and revokes any consent already given the moment you open it; the Global Privacy Control browser signal, which we honor automatically and which overrides an Accept; or by contacting us at the address below. The Do Not Sell or Share My Info link in our footer brings you to this section, where the Opt out of sale/sharing button above records the opt-out in one click
Right to limit use of sensitive personal information: We do not use or disclose sensitive personal information for purposes other than those permitted by the CPRA
Right to non-discrimination: We will not discriminate against you for exercising your privacy rights

Categories of information collected in the past 12 months: Identifiers (name, email, IP address), internet activity information (browsing history on our site), and professional information (job title, company).

Notice at collection: the categories above, the purposes we use them for (section 4), how long we keep them (section 6), and the fact that we sell no personal information but may "share" it for cross-context behavioral advertising through the cookies in section 3, together make up our notice at collection. A short version of this notice also appears on every form on this site, at the point you submit your details.

To exercise your rights: Contact us at info@cyberneza.com. We will verify your identity before processing your request. You may use an authorized agent to submit a request on your behalf; we will ask the agent for proof of your written authorization and may ask you to confirm it directly.

Sensitive personal information and minors: we do not collect sensitive personal information as defined by the CPRA, and we do not sell or share the personal information of consumers we know to be under 16.

9. International data transfers

Cyberneza is based in the United States. If you access our website or services from outside the U.S., your information will be transferred to and processed in the United States.

For transfers from the EEA, UK, or Switzerland to the United States, we rely on the transfer safeguards maintained by our service providers:

Data Privacy Framework: Google, Microsoft, and Cloudflare are certified under the EU-U.S. Data Privacy Framework (including the UK Extension and the Swiss-U.S. DPF)
Standard Contractual Clauses (SCCs): our other service providers (including OpenAI, Calendly, Resend, and Render) incorporate EU-approved SCCs in their published data processing agreements

You may request more information about these safeguards by contacting us.

10. Third-party websites and services

Our site contains links to third-party websites and services, including Calendly for scheduling and various compliance framework resources. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies:

11. Children's privacy

Our website and services are not directed to children under 16 (or under 13 in the United States), and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately so we can delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

Revise the "Last updated" date at the top of this page
Provide notice on our website for significant changes
Where required by law, obtain your consent to material changes

We encourage you to review this page periodically to stay informed about our practices.

Use of this website is separately governed by our Terms of Service.

13. How to contact us

If you have questions about this Privacy Policy, want to exercise your privacy rights, or have concerns about how we handle personal information, contact us at:

Cyberneza
626 North Alafaya Trail, Suite 206
Orlando, Florida 32828
United States
Email: info@cyberneza.com

Privacy inquiries response time: We aim to respond to all privacy-related inquiries within 5 business days.