Privacy Policy

This Privacy Policy explains how CyberLab LLC ("CyberLab," "we," "us") collects, uses, discloses, and protects information in connection with the Home Office Compliance Guard desktop application and the cyberlabcorp.com website and services (together, the "Services"). By using the Services you agree to this Policy.

1. Summary

We built the Services to be privacy-first. All network scanning happens locally on your device. We collect the minimum needed to operate your account, process payments, and issue verifiable compliance certificates. We do not collect your browsing history, file contents, or a full inventory of your devices.

The Services support two account types — individual and employer — chosen when you sign up. For an individual, your compliance data stays yours and is only shared when you choose to share a certificate. For an employer-monitored employee, a defined set of compliance data is shared with the employer, but only after you give explicit, in-app consent before any monitoring begins (see Employer Monitoring & Employee Consent).

2. Information We Collect

Account information

• Your email address and authentication credentials, managed by our authentication provider (Supabase). We never see or store your password in plaintext.
• Your account type — individual or employer — which you select when you sign up and which determines the features available to your account.

Payment information

• Subscriptions are processed by Stripe. We do not store your full card number or payment credentials; Stripe handles them. We retain limited billing metadata (plan, subscription status, seat quantity, renewal/cancellation dates, and a Stripe customer identifier).

Device & compliance information

• When you link a device to your account, we collect a machine identifier (a one-way hash of hardware/OS characteristics combined with a fixed application secret — the raw hardware values never leave your device, and the identifier is not reversible to the underlying hardware), the device hostname, the operating system, and the name of the logged-in user account the scan runs under, plus a revocable device token (only a hash of the token is stored). A given machine can be actively linked to only one account — individual or employer — at a time.
• When your device reports, we collect the compliance result only: your overall grade/score and the pass/fail verdict and summary for each check (for example Wi-Fi encryption, router/gateway exposure, device isolation, DNS & VPN integrity), the ruleset version, and timestamps.

Employer-monitored employees

If you link your device under an employer's organization, and only after you give explicit, in-app consent, the following additional information is shared with your employer for that device (see Employer Monitoring & Employee Consent):

• Your name, position, and email, as provided to the organization by your employer.
• The device's compliance grade and the per-check PASS/FAIL verdicts against your employer's policy (Wi-Fi encryption, router/gateway, device isolation, and DNS & VPN).
• A freshness status (live, stale, or expired) indicating how recently the device confirmed its status.
• The IP address the device most recently reported from.

Your browsing history, file contents, and personal data are never collected or shared, whether you are an individual or an employer-monitored employee.

Technical & security logs

• For security and dispute resolution we keep an audit log of significant account events (device linked/unlinked, certificate issued, subscription changes), including the event time, machine identifier, and the requesting IP address and user-agent.
• Aggregate counts such as the number of app downloads.

Cookies & local storage

• The website uses browser local storage for your login session, your light/dark theme preference, and your "keep me signed in" choice. We do not use third-party advertising or cross-site tracking cookies.

3. What We Do NOT Collect

The desktop application never uploads your browsing history, the contents of your files, your messages, or a general inventory of the devices on your network. Only the compliance result described above is transmitted, and only while your device is linked to a subscribed account. Unlinking the device stops all uploads.

4. How We Use Information

• To create and operate your account and authenticate you.
• To process subscription payments and manage seats/machines.
• To issue, update, and verify compliance certificates, and to show a certificate's current status to anyone you share its verification link with.
• To secure the Services, detect abuse, and resolve disputes (audit log).
• To communicate with you about your account, security, and service changes.

5. Sharing a Certificate With Your Employer

A core purpose of the Services is to let you prove your home-office compliance to an employer or other party. When you generate a certificate and share its verification link, the person who opens that link can see the certificate's grade/score, the per-check verdicts, the machine name and identifier it was issued for, and whether the machine has recently confirmed its status. You control whether to generate and share a certificate. Think carefully before sharing a link, as it reflects your home network's security configuration.

6. Employer Monitoring & Employee Consent

Employer accounts let a business monitor the home-office compliance of its team. An employer creates an organization and sets a security policy that marks each of the four checks — Wi-Fi encryption, router/gateway, device isolation, and DNS & VPN — as Required, Recommended, or Waived. The employer invites employees by email; each invitation produces an invitation link and a single-use, expiring linking code.

For each onboarded employee device, the employer's roster shows:

• the employee's name, position, and email (as provided by the employer);
• the device's compliance grade and the per-check PASS/FAIL verdicts against the employer's policy;
• a freshness status of live, stale, or expired; and
• the IP address the device most recently reported from.

Explicit employee consent is required before any monitoring begins. In the desktop app's "I was invited by my employer" flow, the employee is shown a verbatim disclosure of exactly what the employer will see — the employee's name, position, and email; the device's compliance status and per-check verdicts (Wi-Fi, router/gateway, device isolation, DNS & VPN); the IP address the device reports from; and alerts when the device deviates from the required policy — and must affirmatively Accept before the device links. This consent is recorded with a timestamp.

Browsing history, files, and personal data are never collected. An employee can stop monitoring at any time by unlinking the device, which ends the sharing of compliance data with the employer.

When an employer receives this data, the employer is an independent (separate) controller of that information. The employer is solely responsible for having a lawful basis to monitor its staff and for providing any notices or obtaining any additional consents that its jurisdiction's employment and privacy laws require. CyberLab provides the tooling and the in-app employee consent step; it does not direct how an employer uses the data it receives.

7. Service Providers

We share information with processors who help us run the Services, under their respective terms and safeguards:

• Supabase — authentication, database, and serverless functions.
• Stripe — payment processing and subscription billing.
• Cloudflare — bot-prevention via Turnstile (a CAPTCHA challenge on sign-up and sign-in; completing the challenge may involve Cloudflare processing limited technical data for bot detection), and content delivery (CDN) and DNS for the website.

We do not sell your personal information.

8. Data Retention

We retain account, subscription, and compliance data while your account is active. If your subscription lapses, your certificates stop being verifiable immediately, and if you do not resubscribe within a grace period (currently 30 days) the associated certificates, device links, and live status data are permanently deleted. Unlinking a device immediately and permanently removes that machine's certificate and status. Audit-log records are retained for a longer period for security and dispute-resolution purposes.

If your account is deleted, we cancel any active subscription, revoke the device tokens, stop any monitoring, and anonymize your user-facing profile. We do not promise instant or total erasure: billing and tax records are retained for the period required by law and our retention obligations.

9. Your Rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. As noted above, exercising a deletion right anonymizes your profile data, but financial and tax records are retained for the legally required period.

California (CCPA/CPRA)

California residents may request disclosure of the categories and specific pieces of personal information we have collected, request deletion, and are entitled not to receive discriminatory treatment for exercising these rights. We do not sell personal information.

EEA/UK (GDPR)

If you are in the EEA or UK, our lawful bases for processing are performance of our contract with you (operating your account and issuing certificates), our legitimate interests (securing the Services, preventing abuse), and your consent where required. You may lodge a complaint with your local supervisory authority.

For employer-monitored employees, the employer is an independent controller of the data it receives, and you may also have rights directly against your employer in addition to your rights against CyberLab.

To exercise any right, contact us at support@cyberlabcorp.com. We will verify your request and respond as required by law.

10. Security

We protect data with measures including encryption in transit (HTTPS), row-level access controls so each account can only access its own data, server-side verification of privileged actions, device tokens stored only as hashes, and an audit trail. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Children

The Services are not directed to children under 16, and we do not knowingly collect their personal information.

12. International Transfers

We operate from the United States, and our providers may process data in the United States and elsewhere. Where required, we rely on appropriate safeguards for cross-border transfers.

13. Changes to This Policy

We may update this Policy from time to time. We will post the updated version here with a revised "Last updated" date, and for material changes we will take additional steps as required by law.

14. Contact

CyberLab LLC
Waxhaw, NC 28173, USA
Privacy: support@cyberlabcorp.com
Security: security@cyberlabcorp.com

This document is provided for transparency and does not constitute legal advice.