Privacy Policy.

Operator profile data. Email address and password (stored as a salted hash by our authentication provider — we never see plain-text passwords), or magic-link sign-in data; display name and optional profile details.

Learning data. Course enrollments, lesson progress, lab attempts, reasoning trails and verdicts, evidence links you create, achievement records, and portfolio exports.

Team / Academy data. Seat assignments, team or institution name, and the progress data visible to plan administrators and instructors.

Verification queries. Credential IDs submitted to the public verify endpoint, with timestamp and requester IP, for abuse prevention. Full signed-registry verification ships in Phase 2.

Technical data. IP address, browser and device type, pages visited — via privacy-focused, cookieless analytics (see Cookie Policy).

Support and contact data. Emails to hello@cybermode.grid and, once wired, contact-form submissions.

Billing data (when payments launch). Plan, billing country, and transaction status from our payment processor. Card details are held by the processor, never by us.

Sentinel inputs (Phase 2). Logs, alerts, or questions you paste into Grid Sentinel, processed to generate the response. Do not paste third-party personal data or live production secrets.

What We Don't Collect. No government ID numbers, no biometric data, no precise geolocation, no special-category data. We do not buy data about you, do not sell or rent your data, and do not share it with advertisers or data brokers. There is no third-party advertising on the Service.

Where we rely on legitimate interests we have balanced them against your rights; where on consent, you may withdraw it at any time.

If your seat is provided by a Team Grid or Academy Grid subscription, the plan administrator (and instructors, on Academy) can see your learning progress, lab activity, shared evidence library contributions, and achievement records. They cannot see your password or personal account settings. If the subscribing organization is your employer or school, it may be an independent controller of the progress data it views; check its own privacy notices.

We use vetted providers listed in our Sub-processor List, which forms part of this Policy — currently Vercel (hosting and edge network), Supabase (database and authentication), OpenAI (AI features), and Vercel Analytics (cookieless analytics); Stripe and a transactional email provider are planned for Phase 2.

Some providers process data outside the UAE, GCC, EEA, or your country. Where this occurs we rely on appropriate safeguards: Standard Contractual Clauses for EEA/UK data, adequacy decisions where available, and PDPL Articles 22–23 transfer requirements. The Sub-processor List is updated before any provider is added or replaced.

AI processing. Inputs sent to OpenAI via API are not used by OpenAI to train its models under its API data-usage terms. We send the minimum needed to provide the feature.

• Profile and learning data: life of the account; deleted or anonymized within 90 days of account deletion.
• Achievement records: retained while your account exists. On deletion, records are removed; if Phase 2 signed credentials have been issued, a minimal verification stub (record ID, issue date, revocation status — no name) may be retained so previously shared credentials don't falsely fail verification. You may request full removal.
• Billing and tax records (when launched): as required by tax and commercial law, typically 5–7 years.
• Support correspondence: up to 24 months after closure.
• Server and verify-endpoint logs: up to 12 months.
• Sentinel inputs (Phase 2): processed transiently; retained only in your workspace history, which you can delete.
• Backups: deleted data may persist in encrypted backups up to 35 days.

Under the UAE PDPL, GDPR, UK GDPR, or other applicable law, you may: access and obtain a copy of your data; rectify it; erase it; restrict or object to processing based on legitimate interests; port your data (your achievement vault is exportable in-product); withdraw consent; and complain to the UAE Data Office, your EEA supervisory authority, or the UK ICO.

Email hello@cybermode.grid to exercise any right. We respond within 30 days and may verify your identity first. Requests are free unless manifestly unfounded or excessive.

TLS in transit, encryption at rest, hashed passwords, role-based access controls, least-privilege staff access, and audit logging. SOC 2 attestation is on the Phase 2 roadmap and has not yet been achieved; we will update this Policy when that changes. If a breach risks your rights, we will notify the relevant authority and affected users as required by law.

The Service is not directed at children under 16 and we do not knowingly collect their data. Academy Grid institutions are responsible for ensuring enrolled learners meet this age floor or that valid parental/institutional consent exists under local law. Report suspected under-age accounts to hello@cybermode.grid.

Material changes will be announced at least 14 days in advance by email or in-Service notice. The "Last updated" date reflects the current version; prior versions available on request.

hello@cybermode.grid · CyberMODE Grid (entity registration in progress), Registered address to be confirmed — contact hello@cybermode.grid