Privacy Policy

1. Data Controller

The data controller is Ibrahim Ben Hariz, trading as CYBEMY (SIRET 891 387 615 00059), 200 Rue de la Croix Nivert, 75015 Paris, France. This policy covers all data collected through CYBEMY websites and services, including cybemy.com, academy.cybemy.com, and any professional service engagement. For any data-related request, contact us at legal@cybemy.com.

2. Data We Collect

We collect only the data strictly necessary for the relevant service:

• Contact form: name, email address and message content submitted via the contact form on cybemy.com.
• Cookie consent: your preference (accepted or declined) stored locally in your browser — not transmitted to our servers.
• Academy account: name, email address and hashed password (when registering on academy.cybemy.com); learning progress (lessons completed, quiz attempts, certificates earned); subscription status and billing period (payment details are processed exclusively by Stripe).
• Discord identity: Discord user ID, collected only if you choose to link your Discord account (Premium subscribers).
• Professional service engagements: company name, contact details, project scope and any information you share in the context of a consulting, audit or penetration testing engagement. Such data is governed by a dedicated confidentiality agreement (NDA) signed prior to the engagement.

3. Purposes of Processing

• Responding to contact and service enquiry form submissions.
• Creating and managing Academy user accounts.
• Providing access to courses, learning pathways, Labs and CTF platforms.
• Processing Academy subscriptions and payments via Stripe.
• Issuing certificates upon pathway completion.
• Sending transactional emails (account verification, password reset, subscription confirmation) via Resend.
• Granting access to the community Discord for Premium subscribers.
• Delivering professional security services (consulting, audits, penetration tests, training programmes) under a signed engagement agreement.

4. Legal Basis

• Contract performance — managing your account, subscription and access to content; delivering professional service engagements.
• Legitimate interest — responding to enquiries, platform security and fraud prevention.
• Legal obligation — retaining billing and engagement records as required by French law.

5. Third-Party Services

We use the following sub-processors, each bound by their own privacy policy:

• Vercel (USA) — website and platform hosting.
• Neon (USA) — Academy database hosting.
• Stripe (USA) — Academy payment processing.
• Resend (USA) — transactional email delivery.
• Discord (USA) — community access for Premium subscribers (optional).

Transfers to the USA are carried out under appropriate safeguards (Standard Contractual Clauses or adequacy decisions).

6. Retention Period

• Contact form submissions: 3 years from the date of last contact.
• Academy account and learning data: retained for the duration of your account, then deleted within 3 years of account closure.
• Professional service engagement data: retained for the duration of the engagement plus 5 years, in accordance with professional liability obligations.
• Billing and invoicing records: 10 years (French commercial law obligation).

7. Cookies

On cybemy.com we use no tracking, advertising or analytics cookies. A cookie consent banner is shown on first visit; your preference is stored locally in your browser only. On academy.cybemy.com we use a strictly necessary session cookie to keep you logged in. No consent is required for strictly necessary cookies under the ePrivacy Directive.

8. Your Rights

Under the GDPR, you have the right to access, rectify, erase, restrict or port your personal data, and to object to its processing. To exercise any of these rights, contact us at legal@cybemy.com. You may also lodge a complaint with the French data protection authority: cnil.fr.