Privacy Policy

CyberStatus UK is a trading name operated by David Wells, a sole trader in England. David Wells is the data controller for the information described here.

Business and correspondence address (not a customer walk-in location):
The Bristol Office, 2nd Floor, 5 High Street, Westbury-on-Trym, Bristol, BS9 3BY, United Kingdom

Privacy contact: privacy@cyberstatusuk.co.uk

Account. Your email address, an account identifier and authentication/sign-in information. Your password is handled by our authentication provider; we do not have access to your plaintext password.

Business profile. Employee range, industry (optional, asked after your results), remote-working status, whether the business takes payments, whether it stores customer data, and which productivity platform you use.

Assessments. Your 25 core answers, any optional module answers, your score, points, band and category scores, critical risks, Operational Risk and related timestamps.

Guided Fix. Which fixes you have marked complete and the assessment they relate to.

Report requests and Protect interest. The email address you give us, and marketing consent where you have explicitly provided it.

Help requests. If you use “Need more help?”, we handle the business and contact name, email address, optional phone number, the category and urgency you select, whether you have an IT provider, and what you tell us about the problem. We use this to review your request, respond, and identify an appropriate next step. Where it is appropriate and you agree, that may include pointing you towards an independent specialist; your information is not automatically shared with any third party. Please do not include passwords, login codes, payment details or other credentials.

Protect subscriptions. Payment-provider customer and subscription identifiers, subscription status and tier, and paid-through/cancellation information.

Usage. First-party product events (for example that a results page was viewed) and standard campaign parameters. These events do not contain assessment answers or email addresses.

Business landing counts are events, not unique people. If you allow optional storage, we keep only the UTC date of your last Business landing in this browser and send a first-visit or same-day-repeat flag with the landing event. No visitor identifier, IP address or device fingerprint is used for this estimate. Multi-day totals sum daily browser estimates; we cannot deduplicate people across browsers or infer historical unique visitors. Without consent or available storage, the landing event is recorded without a browser estimate. Recognised admins, preview activity and explicitly marked internal tests are excluded from new first-party events where identifiable; older events are retained.

Our infrastructure providers may also process technical request and log information that is necessary to host and secure the service.

CyberStatus Personal is a self-assessment of your phone and online account habits. It does not scan, monitor, test or verify your phone or your accounts.

While you complete the Personal check, your answers are kept in your browser only. They are not sent to us.

If you choose to save a Personal result to your CyberStatus account, we store only: the assessment date, your overall Personal score, your five category scores, the phone type you selected, and which actions you have marked as completed. Personal results are stored separately from Business assessment data.

Personal usage events record only the event name and time, for: Personal landing viewed, Personal started, Personal completed and Personal result saved. They do not contain answers, scores, phone type, email addresses or other sensitive information, and they are not used as Google Ads conversions.

• To provide accounts, assessments, scores, Guided Fix and Protect — performance of a contract, or steps requested by you before entering a contract, as appropriate.
• To operate, secure and improve the service — our legitimate interests, where appropriate.
• To administer payments and subscriptions — performance of a contract, and legal obligations where applicable.
• To meet legal, accounting and security obligations — legal obligation and/or legitimate interests, as appropriate.
• Marketing — consent, where consent is specifically requested.

• Your assessment answers are not sent to an AI model or AI provider.
• We do not sell personal data.
• We do not receive or store full payment-card numbers, expiry dates or CVCs. Stripe handles card entry on its own hosted payment pages.

• Lovable / Lovable Cloud — hosting and managed backend services, including database, authentication and server functions.
• Stripe — subscription and payment processing.

The exact hosting and database region is not represented to you as UK-only. Some service providers may process information internationally, and appropriate safeguards are used where required.

This section describes our retention policy. Deletion is currently carried out manually rather than automatically.

• Identifiable assessment, account and service records are normally retained while your account is active, and for up to 12 months after account closure or last meaningful activity, where reasonably necessary to provide the service, resolve queries and maintain security and audit records.
• Payment and accounting records may be retained longer where required by law.
• Marketing information is retained until consent is withdrawn or it is no longer reasonably required.
• Security and technical logs may be retained for shorter operational and security periods.
• Information may be retained longer where necessary for a legal claim, dispute, fraud or security investigation, or a legal obligation.

Under UK data-protection law you may have the right to access your information, have it corrected or erased, restrict or object to certain processing, request portability where applicable, and withdraw consent where processing relies on consent.

To exercise a right, email privacy@cyberstatusuk.co.uk. Requests are currently handled manually, so please allow a little time for us to respond.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

We use a small amount of browser storage. Not all of it is cookies.

• Authentication/session storage — keeps you signed in. Strictly necessary.
• cybercheck_uk_assessment_v1 — local storage holding your in-progress assessment, answers, Guided Fix progress and a private claim token used to link an anonymous check to your account. Strictly necessary for the check to work.
• cyberstatus_personal_v1 and cyberstatus_personal_v1_done — local storage holding your in-progress CyberStatus Personal answers, phone type, result and the actions you have marked as done. Strictly necessary for the Personal check to work.
• Sidebar layout cookie — remembers whether a panel is open.
• cyberstatus_acquisition_v1 — optional local storage retaining first-party campaign attribution (utm_source, utm_medium, utm_campaign). This is only written if you allow it, and declining does not affect the Cyber Health Check or your account.
• cyberstatus_business_landing_day_v1 — optional storage of the last Business landing date only, for daily first/repeat browser estimates. It is used only with optional storage consent and removed when you reject or withdraw. Explicit internal testing may also use a tab-only exclusion flag; no visitor ID is stored.
• Google Ads tag (Google LLC) — optional advertising cookies used only to measure whether our Google ads led to visits and completed checks (ad measurement and ad optimisation). With your acceptance, Google receives page visits, your IP address and device/browser details, and may use cookies for ad personalisation. In the UK and EEA these cookies are only set after you accept; until then the tag runs in a cookieless, consent-denied mode. No answers, scores or email addresses are sent to Google.
• cyberstatus_ad_consent_v1 — local storage recording your cookie choice, when you made it and which version of our notice you saw. Strictly necessary to respect your choice.

You can change or withdraw your choice at any time using "Cookie settings" at the bottom of every page. Withdrawing takes effect immediately.