Effective date June 25, 2026

‍

INTRODUCTION

At Cybernut Inc. ('the company', 'we', or 'us'), we respect your privacy and are committed to protecting it as described in this privacy policy ('Policy' or the 'Privacy Policy'). This policy describes the types of information we may collect from you or that you may provide when you use our product, Cybernut ('the product', 'the service', 'the website', 'the app', or 'product'), and our practices for collecting, using, maintaining, protecting, and disclosing that information. Your use of the Product and Services and any information you provide on the Services are subject to the terms of this Privacy Policy, which is incorporated into and subject to our Terms of Service.

Personal information that we collect:

‍

DATA COLLECTION

For the purpose of this policy, Personal Information is defined as information that identifies, relates to or could reasonably be linked with or describes an individual, either directly or indirectly. We collect Personal Information you provide to us, as well as Personal Information collected automatically and from third-party sources as described below.

‍

• Data you provide to us: During the account creation process, we will collect certain limited information to establish and manage your account effectively and provide the services. This information may include, but is not limited to, your name and email address.
• Data from third party sources: We allow teachers and administrators to add rostering information about students and classes directly into the product manually or via third party tools such as learning management systems. The data collected from these tools and all student records are used solely for the purposes of delivering the service.
• Data collected automatically: When you use our services, we may use cookies and similar technologies to deliver the services and better understand how you use the product. For more information on cookies and similar technologies, please see the Cookies and Similar Technologies section below.

‍

HOW WE USE YOUR PERSONAL INFORMATION

We limit the data we process and collect from users of the product and students to only what is required to deliver the services. We use the collected data for the following purposes:

‍

• Service delivery and App Functionality (such as providing, operating and improving the service and our business, reviewing, screening, and monitoring user-created content)
• Research and product improvement
• Security and Compliance with applicable laws

‍

CyberNut is a cybersecurity training platform for schools that enables administrators and account holders to assign cybersecurity training campaigns to students, teachers, and staff. When students use Cybernut through their school, their accounts are established and managed by the school. Beyond the assignment of cybersecurity content from teachers to students and other school members, the service does not facilitate social interactions between users or posting information publicly.

The service is free of advertising, including contextual and personalized ads. Additionally, we do not solicit user participation in third-party sweepstakes, contests, or promotional activities. We may send teachers and school leaders first-party marketing communications about our services, from which you can opt out at any time.

‍

HOW WE SHARE YOUR PERSONAL INFORMATION

As part of providing our services, we may share data with third-party sub-processors who process information to help us provide our services. This includes product functionality, analytics, onboarding, research, and product improvement.

‍

We establish contractual limitations with third-party sub-processors that restrict the extent and purposes for which they may process any personal information we disclose to them. These third parties are permitted to process personal information solely on our behalf and in accordance with our instructions. They are also required to implement and maintain security measures that provide a level of protection equivalent to those we uphold. You can view the vendors we use to process data, and the purposes for which they are used to provide our product, below.

‍

• Amazon Web Services (https://aws.amazon.com/privacy/): Cloud hosting and computing.
• Amazon Web Services EMEA SARL (https://aws.amazon.com/privacy/): Cloud hosting and computing.

‍

For the avoidance of doubt, we never sell personal data from our service, and we do not share data with third parties for their own marketing, advertising purposes, or creating advertising profiles.

‍

We do not display your personal information that you have submitted to us or that we have collected in the product. This does not prevent users from posting their own personal information through social features or otherwise.

‍

In the event of a merger, acquisition, or bankruptcy, user information may be transferred to an acquiring third party.

We may disclose information, including personal information, if we have a good faith belief that doing so is necessary to comply with the law, such as complying with a subpoena or other legal obligation.

‍

GOOGLE WORKSPACE / GMAIL ADD-ON DATA (DATA ACCESS DISCLOSURE)

1. Data We Access
   When you install and use the CyberNut Gmail Add-on, we may request access to the following Google user data (collectively, “Google Data”), as required by the functionality of our application:
   
   
   • Email Metadata: such as the sender, recipient, headers, content, and date of the message.
   • Email Subject Line: to identify potential security threats or suspicious keywords.
   • Other Email Elements: if needed for the core functionality of our threat detection features, we may access file attachments to scan for threats.
     
     
2. How We Use the Data
   We use your Google Data solely for the purpose of delivering and improving CyberNut’s core security and reporting functionality. Specifically, we:
   
   
   • Scan Email Metadata for potential cyber threats only when an email is reported.
   • Notify Users and Administrators about flagged content or recommended actions.
     
     
3. We do not use Google Data for advertising, profiling, or any other purposes not directly related to providing our Gmail Add-on services.
   
   
4. Storage and Retention
   
   
   • Limited Retention: We retain Google Data only for as long as necessary to fulfil the purposes outlined above or as required by law.
   • Deletion Upon Request: If you remove the CyberNut Gmail Add-on from your account or request deletion, we will securely delete any retained Google Data associated with your account according to our internal data retention schedules.
     
     
5. Data Sharing
   
   
   • We do not sell or rent Google Data to third parties.
   • We do not share Google Data with third parties for analytics or marketing.
   • If we use any third-party service providers (e.g., cloud hosting), they are contractually obligated to protect Google Data at the same or higher level of security as described in this Privacy Policy.
6. User Control & Revocation
   You can revoke the CyberNut Gmail Add-on’s access to your Google Data at any time by removing or uninstalling the add-on from your Google Workspace account. Once revoked, we will no longer have access to your data, and any data we previously held will be deleted in accordance with our retention policies.

‍

YOUR CHOICES

To use our Products and Services, admin users are required to create an account. During the account creation process, we will collect certain information to establish and manage your account effectively. Our platform is equipped with access control mechanisms, allowing account administrators to define, manage permissions for your data, and control any information you provide to us. Certain account controls may be accessible only to account administrators.

‍

We may contact teachers or administrators for our own direct marketing or to provide guidance on how to better utilize the product and to inform them about our services. You can stop receiving email communications from us by clicking “unsubscribe” in such communications or contacting us directly. We make every effort to promptly process all unsubscribe requests.

‍

OTHER SITES AND SERVICES

The Service may contain links to websites and other online services operated by third parties. These links are not an endorsement of, or representation that we are affiliated with, any third party. In addition, our content may be included on web pages, in mobile applications or other online services that are not associated with us. We do not control websites, mobile applications or online services operated by third parties, and we are not responsible for their actions.

‍

Third-party login is supported for authentication into our Product or Services. When you choose to log in to our services using third-party authentication, such as through learning management systems or other external identity providers, we collect certain information from your chosen third-party platform. This may include basic profile details, such as your name and email address. By opting for third-party login, you grant us permission to access and use this information for the purpose of creating and managing your account, as well as enhancing your overall experience with our services. We may also request additional permissions during the authentication process, depending on the requirements of the third-party provider.

‍

COOKIES

Our Product may use cookies to help you personalize your online experience. A cookie is a text file that is placed on your device browser that stores preferences to facilitate and enhance your experience. For example, if you register with our Product or Services, a cookie helps our product to recall your specific information on subsequent visits.

‍

For clarity, we do not use third-party cookies on our service for personalized advertising or to track users and display personalized advertisements on other third-party websites or services. You can find a list of the types of first and third party cookies we use below:

Functional cookies: Enable the core operation of our Products and Services. They include cookies that we use to help control secure areas of our site and to make sure it is accessible to you. You can set your browser to block or alert you about these cookies, but some parts of the site may or will not work as a result.

‍

DATA PROTECTION AND SECURITY MEASURES FOR SENSITIVE INFORMATION (DATA PROTECTION DISCLOSURE)

We employ the following protections specifically for any sensitive information (including any Gmail Data):

‍

• Encryption In Transit: All data exchanged between your device, our servers, and Google’s APIs is transmitted using industry-standard TLS/SSL encryption.
• Encryption At Rest: Any data stored on our servers (including logs or metadata) is encrypted at rest.
• Access Controls: We limit access to sensitive data only to those employees or personnel who require it to perform their duties. All personnel are bound by strict confidentiality obligations.
• Secure Storage: We maintain secure hosting environments with continuous monitoring, firewalls, and intrusion detection systems to safeguard against unauthorized access.
• Incident Response: We have a formal incident response plan. If a data breach involving your Google Data occurs, we will notify you and relevant authorities as required by law and take immediate steps to mitigate any potential harm.

‍

These measures align with industry best practices and ensure your Google Data remains protected against unauthorized access, alteration, or disclosure.

‍

YOUR PRIVACY RIGHTS

Except as otherwise provided, this section applies to residents of states where they have privacy laws applicable to us that grant their residents the rights described below.

‍

For purposes of this section, “personal information” has the meaning given to “personal data”, “personal information” or similar terms under the applicable privacy laws of the state in which you reside. Please note that not all rights listed below may be afforded to all users and that if you are not a resident of the relevant states, you may not be able to exercise these rights. In addition, we may not be able to process your request if you do not provide us with sufficient detail to allow us to confirm your identity or understand and respond to it.

‍

Verification: Upon receipt of your request, we will initiate the identity verification process to confirm that you are the individual for whom we hold information in our system. This verification procedure necessitates your cooperation in supplying relevant information, allowing us to compare it with the details you previously furnished. Depending on the nature of your request, we may request specific information to align with our existing records, or we may reach out to you using a previously provided communication method (such as phone or email). In certain situations, alternative verification methods may be employed based on the circumstances.

‍

Any personal information disclosed in your request will solely be utilized for the purpose of confirming your identity or validating your authority to make the request. We will make every effort to minimize the need for additional information for verification purposes. However, should it be impossible to verify your identity with the existing information in our records, we may request additional details to ensure security and prevent fraud. Any supplementary information you provide for verification will be promptly deleted upon the completion of the verification process.

‍

Authorized Agents: Your authorized agent may be able to make a request on your behalf. However, we may need to verify your authorized agent’s identity and authority to act on your behalf. We may require a copy of a valid power of attorney given to your authorized agent pursuant to applicable law. If you have not provided your agent with such a power of attorney, we may ask you to take additional steps permitted by law to verify that your request is authorized, such as by providing your agent with written and signed permission to exercise your rights on your behalf, the information we request to verify your identity, and confirmation that you have given the authorized agent permission to submit the request.

‍

• Access: You can request access to the personal information that we have collected about you.
• Correction: You can request that we correct inaccurate personal information that we have collected about you.
• Deletion: You can request that we delete your personal information. Please note that once we process a deletion request, we may be unable to provide access or support to any past products or services.
• You have the option to opt-out of specific tracking activities related to targeted advertising, also referred to as interest-based advertising. According to CCPA, this involves the 'sharing' of your personal information with advertising partners.
• End users have the option to opt-out of their personal information being sold or shared with third parties. You have the right to request details on the personal information that we sold, shared, or disclosed to a third-party for a business purpose.

‍

Please note that Cybernut does not track users for interest based advertising, share user information with advertising companies, or sell user information.

‍

The availability and scope of these rights vary by state and may depend on Cybernut's role as a controller or as a service provider or processor acting on behalf of a school. Where Cybernut processes personal information, including Student Data, on behalf of a school under a contract that establishes the institution as the primary controller, privacy rights requests relating to such data should be directed to the applicable School. In such cases, students and parents should contact their school directly to exercise rights regarding the access, deletion, or correction of their personal information, in accordance with applicable law.

‍

If you would like to modify, correct, or delete your data from our services please contact us at hello@cybernut.com.

‍

CHILDREN’S PRIVACY NOTICE

We comply with the U.S. Children’s Online Privacy Protection Act and Family Educational Rights and Privacy Act, and describe our practices regarding the processing of personal information for users under the age of 13 below. Our service is designed to be used by teachers, administrators, and students in a school context. As part of our services, we may process student records and data from children 13 years of age and under, as provided to us by schools, teachers, and directly from students.

‍

When we provide services on behalf of a school, the school provides consent for Cybernut to collect and process information from students under the age of 13 as permitted by the Children’s Online Privacy Protection Act. As described in the notice we provide to schools, we collect, maintain, use and share student records only for authorized educational purposes.

‍

We are committed to protecting the privacy and data of students and children and do not require more information about students or children than is reasonably necessary to provide the service. In addition:

• We collect, maintain, use and share student records only for an authorized educational purpose.
• We do not use or disclose student records for targeted advertising or any other commercial purposes unrelated to education.
• We do not build a personal profile of a student other than to deliver our service.

‍

Student records that we process on behalf of schools and educators will remain under the control of the respective school. To request access to, modification of, or deletion of student records, please contact the school that maintains those records directly.

‍

CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. If we make any changes to our data collection practices or other material changes that affect how personal information is collected, used, or shared, we will update this Privacy Policy with a new effective date and notify you using reasonable and appropriate means.

‍

HOW TO CONTACT US

If you have questions or concerns regarding this Privacy Policy, please contact us using the means described in this section.

‍

A grievance or remedy mechanism is available for users to file a complaint in the event their content or account is restricted or removed. Please use the information below to contact us.

Email:

hello@cybernut.com

‍

Address:

390 NE 191st St

STE 8370

Miami, FL 33179

United States

‍