Privacy Policy

Introduction

CyberScore, published by Patrick Astoul (Individual Entrepreneur), is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.

Data Controller

Personal Data Collected

1. Registration Data

• First and last name
• Email address
• Organization name (optional)

2. Billing Data

• Billing address
• Payment information (processed by Stripe, not stored by CyberScore)

3. Service Usage Data

• Scanned domains
• Security scan results
• Scan history
• Generated PDF reports

4. Technical Data

• IP address
• Browser type
• Pages visited
• Connection timestamps

Processing Purposes

Your data is collected to:

• Provide CyberScore security scanning services
• Manage your account and subscription
• Track usage according to your plan
• Improve service quality
• Comply with legal obligations
• Communicate about service updates

Legal Basis for Processing

• Contract performance: to provide scanning services
• Legitimate interest: for service improvement and security
• Legal obligation: for billing and accounting
• Consent: for optional features

Retention Period

These periods describe our retention policy, not proof of an automated deletion job. The current restored service has no verified scheduled purge of account data, scan history or PDF reports. Deletion requests require an operator to verify the affected database records, report files and separately retained backups. Contact patrick@cybersco.re to request deletion or ask about a specific record.

Your Rights

Under GDPR, you have the following rights:

• Right of access: view your personal data
• Right to rectification: correct inaccurate data
• Right to erasure: delete your data
• Right to object: oppose data processing
• Right to portability: retrieve your data in a structured format
• Right to restriction: limit data processing

To exercise your rights, contact us at: patrick@cybersco.re

Data Security

CyberScore implements the following security measures:

• HTTPS/TLS encryption: all communications are encrypted in transit
• Password hashing: account passwords are protected by one-way salted bcrypt hashes, not reversible encryption
• Secure authentication: JWT tokens with expiration
• Restricted access: only authorized administrators access data
• Access monitoring: audit logs for sensitive operations
• Backups: restricted-access recovery copies and an OVH Premium VPS backup configured daily at 17:20 UTC with seven rotations. Two recovery points were visible on October 6, 2026. This confirms provider-reported backups, not a tested application restoration or verified backup encryption.
• Data isolation: tenant-scoped access checks and isolated service containers

Report files are not application-encrypted at rest. They remain private even when based on public observations. Account passwords and MCP authorization credentials are stored as one-way hashes; hashing is not encryption. TLS protects HTTPS transport, but does not establish encryption of every stored file or backup.

Optional read-only assistant connection

After you authorize reports:read, the connector can list, read and compare reports accessible to your account. Responses include report identifiers, domains, dates, availability, selected external observations, stored recommendations and comparison limits. They do not include your password, payment details, raw report HTML, debug output or a newly generated AI Brief. The connector cannot start scans, change controls or purchase services.

We store registered client and callback metadata, account and tenant identifiers, granted scope, expiry and revocation information, and hashes of authorization codes and tokens to enforce access. Access tokens are valid for 15 minutes and rotating refresh tokens for up to seven days; expiry ends access, not necessarily storage. Expired non-client grant records are removed in bounded batches during later token issuance, not by a scheduled purge. Registered client metadata has no automatic expiry. Security logs record tool name, success and response time. Request-rate protection uses a 60-second rolling window and a bounded in-memory IP-derived key map; inactive keys can remain until capacity cleanup or process restart. Server access logs can contain IP addresses, paths and timestamps, but omit OAuth query strings.

You can review and revoke an assistant connection from the authenticated connections page, and contact patrick@cybersco.re about retained connection data. Revocation prevents further connector access; it does not delete information already received by OpenAI, which is subject to that service's controls and policies.

Service providers and optional data sharing

The following services may receive or process data under their applicable terms. Their legal roles are not necessarily the same:

• Stripe (Ireland / USA): payment processing (PCI-DSS compliant). Legal basis: contract performance.
• OVHcloud: the current VPS is hosted in Beauharnois, Canada (OpenStack zone os-bhs6), as verified in the service dashboard. The account's accepted OVH S.A.S. data-processing annex is dated October 3, 2025. The former Hostinger deployment has been retired.
• OpenAI: the current snapshot does not generate an AI Brief. If you later choose to connect the read-only MCP, selected report observations and stored recommendations are sent to your assistant in response to your requests. Do not connect reports you are not authorized to share. OpenAI’s own privacy and retention policies also apply to that service.
• Competent authorities: in case of legal obligation.

For the assistant connection, OpenAI and CyberScore act under their respective terms with their users or customers. The OpenAI App Developer Terms state that neither party processes personal data on behalf of the other. An OpenAI API data-processing agreement should not be assumed to cover this ChatGPT connector.

Your data is never sold to third parties.

International Data Transfers

CyberScore's current VPS is hosted in Canada, not exclusively in the European Union. The accepted OVH data-processing annex includes a framework for transfers and remote processing outside the EU, including standard contractual clauses where applicable; this does not replace assessment of the actual processing and required safeguards. Stripe and, when you choose to connect it, OpenAI may also process data outside the European Union under their applicable terms. The snapshot does not automatically send reports to an AI provider. Optional MCP sharing is limited to the authenticated account’s accessible reports and can be revoked.

Anonymous free baseline

When you trigger a free baseline from the homepage without a user account, CyberScore stores a salted hash of your IP address solely to rate-limit the service (one baseline per IP). Legal basis: legitimate interest (Article 6.1.f) — preventing abuse of a free service. The rate-limit hash is retained for up to 365 days and then expires automatically. You can ask a question about this processing by emailing patrick@cybersco.re with the timestamp of your baseline.

People whose data appears in a scanned domain

The current snapshot uses known DNS lookups and bounded public HTTP/TLS observations, with historical Certificate Transparency names only when available. It does not currently query GitHub, the Wayback Machine or threat-intelligence feeds as part of this offer. Older retained reports may contain observations from those historical sources, including names or email addresses belonging to people who are not CyberScore users.

Legal basis for processing: legitimate interest (Article 6.1.f), namely identifying and reporting publicly exposed digital assets of an organisation that has commissioned the scan. We do not aggregate or resell personal data extracted from scans. The retention policy above applies; subscription cancellation does not trigger a verified automatic 30-day scan purge in the current service.

If you believe your personal data appears in a CyberScore scan and you wish to exercise your right to object or to be erased, contact patrick@cybersco.re. We will review the request and remove identifiable data from the affected scan record within 30 days.

Cookies

CyberScore uses cookies to:

• Maintain your login session
• Remember your preferences

You can disable cookies in your browser settings, but this may affect service functionality.

Minors

CyberScore is not intended for persons under 18 years old. If you are under 18, please do not use this service.

Filing a Complaint (EU Residents)

If you believe your rights are not being respected, you can file a complaint with the CNIL (French Data Protection Authority):

California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

Last updated: October 6, 2026

Contact

For any questions regarding this privacy policy, contact us: