Privacy Policy

CyberPulse (Pty) Ltd ("CyberPulse", "we", "us", "our") is a South African company registered under the Companies Act 71 of 2008. We operate the CyberPulse platform, which provides cyber security scanning, dark web monitoring, and insurance readiness assessment services to businesses. Our registered address is Cape Town, Western Cape, South Africa.

We collect the following categories of personal information:

Account information: Name, business email address, company name, and password (stored as a salted hash — we never store your plaintext password).

Scan data: Domain names you submit for scanning. Scan results are stored encrypted using our SCCA vault.

Usage data: IP address, browser type, pages visited, and timestamps — collected via server logs and used for rate limiting, fraud prevention, and service improvement.

Dark web check data: Email addresses you submit for breach checks. These are hashed before transmission to the HIBP API — we do not transmit raw email addresses.

Billing information: If you purchase a paid plan, payment is processed by our payment provider. We do not store card numbers on our servers.

We use your information to:

• Provide and operate the CyberPulse platform
• Deliver scan results, reports, and monitoring alerts
• Prevent abuse and enforce our rate limits
• Send transactional emails (scan complete, breach alert, account verification)
• Comply with our legal obligations under POPIA and other applicable laws
• Improve our services through aggregate, anonymised analytics

We do not sell your personal information to third parties. We do not use your data for advertising purposes.

Under POPIA, we process your personal information on the following grounds:

• Contract performance: Processing necessary to provide the services you have requested.
• Legitimate interests: Security monitoring, fraud prevention, and service improvement — balanced against your rights.
• Legal compliance: Where processing is required to comply with South African law.
• Consent: Where you have explicitly consented, such as receiving marketing communications.

All scan results are stored encrypted using our SCCA (Secure Cyber-posture Cryptographic Attestation) vault with AES-256-GCM encryption. We store data on servers located within the European Economic Area (EEA) and/or South Africa. We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, or destruction.

We retain your personal information for as long as your account is active, plus a further 3 years after account closure, unless a longer retention period is required by law. Scan results are retained for 12 months and then automatically purged. You may request deletion of your data at any time (see Section 9).

We share data with the following categories of third-party service providers, solely to operate our platform:

• Anthropic: AI narrative generation. Scan findings (not personal identifying information) are sent to the Anthropic Claude API.
• HIBP (Have I Been Pwned): Hashed email addresses for breach checking.
• Hosting providers: Cloud infrastructure. All processors are bound by data processing agreements.
• Payment processor: Card payments. PCI-DSS compliant.

We do not share your personal information with any other third parties without your explicit consent, unless required by law.

CyberPulse uses strictly necessary session cookies to authenticate your account. We do not use tracking cookies, advertising cookies, or third-party analytics cookies. You may disable cookies in your browser settings, but this will prevent you from logging in.

Under POPIA, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Delete your personal information (right to erasure)
• Object to the processing of your information
• Portability — receive your data in a structured, machine-readable format
• Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, contact us at privacy@cyberpulse.co.za. We will respond within 30 days.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by displaying a notice in your dashboard. Continued use of the platform after the effective date of changes constitutes acceptance.

For any privacy-related queries or to exercise your rights:

Privacy Officer, CyberPulse (Pty) Ltd Email: privacy@cyberpulse.co.za Post: Cape Town, Western Cape, South Africa

Information Regulator of South Africa: inforeg.org.za