Privacy Policy

Cyberyami HRM (“we”, “us”) provides a Human Risk Management platform for organisations. This page summarises how we collect, use, and safeguard data on behalf of you and your team.

Note: this is a placeholder. The final privacy policy will be reviewed by counsel before launch and will replace this content.

• Account data: name, work email, organisation name, password (stored as a bcrypt hash, never plaintext).
• Product telemetry: simulation events (open, click, submit), training enrollments and completions, risk scores.
• Operational logs: IP address, user agent, request timestamps — used for rate limiting and abuse detection. Retained 90 days.

• To run phishing simulations and training campaigns you configure.
• To compute per-user, per-team, and per-org risk scores.
• To send transactional emails (verification codes, training reminders, alerts).
• To improve the product — aggregated, never sold to third parties.

When you use the platform as part of your organisation, you can exercise the following rights directly in the app from your My Privacy page — no email or ticket required:

• Right to access (DPDP §11): download a complete copy of your personal data as a portable bundle. Requests are fulfilled within 24 hours.
• Right to correction (DPDP §12): update inaccurate or incomplete personal data. Self-editable fields can be corrected in your profile; locked HR-of-record fields are raised as a correction request to your organisation's administrator.
• Right to erasure (DPDP §12): request deletion of your personal data. On approval we anonymise your record — personal identifiers are replaced with redacted stubs while aggregate signals and the audit trail are preserved as the law requires.
• Right to nominate (DPDP §14): nominate another individual to exercise your rights in the event of death or incapacity.
• Right to grievance redressal (DPDP §13): raise a grievance about how your data is handled and track it to resolution. See below for how to reach the grievance officer.
• Consent (DPDP §5 / §6): review the privacy notice you consented to, see your consent history, and withdraw consent at any time — withdrawal is as easy as giving it.

Under GDPR / CCPA you additionally have the right to object to specific processing and to lodge a complaint with your local data-protection authority.

Each organisation using the platform designates its own grievance officer and Data Protection Officer (DPO). Their name and contact details are configured by your organisation in its white-label settings and are surfaced in-app on your My Privacy page and grievance form — we do not publish a single operator address here, because the responsible contact depends on which organisation holds your data. File a grievance from within the app and it is routed to your organisation's grievance officer, who acknowledges and resolves it.

• Active account data: until deletion + 30-day grace period.
• Phishing-simulation events and risk scores: retained only for the window configured by your organisation's retention policy, then automatically purged.
• Audit logs: 1 year hot, then archived; retained for 7 years for compliance.
• Drafts and temporary uploads: 7 days and 24 hours respectively.

If a personal-data breach affecting your data occurs, the platform supports notification of the Data Protection Board within the statutory 72-hour window and notification of affected individuals, with an auditable incident register backing the process.

All data is encrypted in transit (TLS 1.2+) and at rest. Tenant data is isolated per organisation; Enterprise customers can opt into a dedicated database. Secrets are encrypted with AES-256-GCM before being stored. Production access is restricted to a small operations team with mandatory MFA.

Questions about this policy? Email support@cyberyami.com.