CIBERKIT PRIVACY POLICY
Last updated: November 13, 2026

1. CONTROLLER
[OWNER NAME OR COMPANY], [TAX ID], [ADDRESS], Colombia. Email: [CONTACT EMAIL].

2. GENERAL PRINCIPLE: YOUR DATA STAYS IN YOUR BROWSER
Ciberkit tools process what you type or load (passwords, email headers, logs, tokens, files, configurations) in your own browser. We do not send it to our servers or store it.
Some tools query public external services to obtain information that is not on your device. Only the minimum necessary data is sent and the tool says so:
- DNS over HTTPS (Cloudflare, Google and other public resolvers): the domain name queried.
- RDAP and RIPEstat: the domain or IP address queried.
- Service status pages: none of your information, only the status request.
- Vulnerability databases (CISA KEV, FIRST EPSS, NVD, CVE.org): the CVE identifiers.
- Breached password check (Have I Been Pwned): only the first 5 characters of the password's SHA-1 hash (k-anonymity). The password never leaves your device.
- Speed test (Cloudflare): test data without personal information.
Each of those services has its own privacy policy.

3. DATA WE PROCESS IF YOU CREATE AN ACCOUNT
- Identification and contact: name and email.
- Credentials: your password hash (bcrypt). We never store the password in clear text.
- Security: if you enable MFA, the encrypted TOTP secret (AES-256-GCM) and hashes of your recovery codes; sign-in attempt records (email, IP, result and date) for 30 days to prevent brute-force attacks.
- If you sign in with Google: your Google account identifier, name, email and profile picture provided by Google.
- Plan and subscription: plan, status, dates and Lemon Squeezy customer and subscription identifiers. We never receive or store your card details.
- Preferences: language.

4. PURPOSES AND LEGAL BASIS
- Providing the service and managing your account and plan (performance of contract).
- Protecting your account and the service against unauthorized access (legitimate interest and security duty).
- Sending transactional emails: password recovery, security and subscription notices (performance of contract).
- Complying with legal, accounting and tax obligations.
We do not use your data for personalized advertising and we do not sell it.

5. DATA IN YOUR BROWSER (LOCAL STORAGE)
Ciberkit stores in your browser's local storage your preferences (theme, language), favorite and recently used tools, and the daily usage counter of the Free plan. That data is never sent to any server and you can delete it from your browser settings. See the Cookie Policy.

6. PROCESSORS AND INTERNATIONAL TRANSFERS
To provide the service we use providers that process data on our behalf:
- Supabase (account database).
- Vercel (application hosting).
- Resend (transactional email).
- Lemon Squeezy (payments, as merchant of record; an independent controller of payment data).
- Google (sign-in, only if you choose it).
Some of these providers may store data outside Colombia (for example in the United States or the European Union). We require adequate safeguards under article 26 of Colombian Law 1581 of 2012 and, where applicable, the GDPR.

7. RETENTION
- Account: while it is active. If you delete it, we erase your data within 30 days, except what we must keep by law.
- Sign-in attempts: 30 days.
- Password reset tokens: expire after 60 minutes and are deleted afterwards.
- Billing data: as long as tax law requires.

8. YOUR RIGHTS
You may know, update, rectify and delete your data, revoke your authorization, request proof of it and be informed about its use (Law 1581 of 2012). If you live in the European Union you also have the GDPR rights of access, rectification, erasure, restriction, portability and objection.
From "Your account" you can download your data and delete your account. For any other request write to [CONTACT EMAIL]. We will answer within the legal deadlines. You may also lodge a complaint with the Superintendence of Industry and Commerce or your local data protection authority.

9. SECURITY
We apply encryption in transit (HTTPS with HSTS), content security policy (CSP), bcrypt passwords, encrypted MFA secrets, server-only database access and sign-in rate limiting. No system is infallible; if you find a vulnerability, see the Responsible Disclosure Policy.

10. CHILDREN
Ciberkit is not directed at children under 14 and we do not knowingly create accounts for them.

11. CHANGES
We will publish any change on this page with its date. For relevant changes (for example, adding advertising or analytics) we will notify you before applying them.