Privacy Policy

This Privacy Policy explains how CyberHacking (“we”, “us”) collects, uses and protects your personal data when you use cyberhacking.io, buy our toolkits or books, join a waitlist or contact us.

1. Who we are

The website cyberhacking.io is operated by CyberHacking, based in Riyadh, Saudi Arabia. We are the data controller for the personal data described in this policy.

Contact for any privacy question or request: support@cyberhacking.io

2. The data we collect

• Account data: your email address and password (stored only as a secure hash) when you create an account, or the basic profile details (such as your name and email address) shared by the sign-in service you choose, such as Google.
• Purchase data: purchases are made on Gumroad. We receive what you bought, when, the price and currency, and the email address and country you gave at checkout. Card and payment details are handled by Gumroad (see section 5); we never see or store your full card number.
• Waitlist sign-ups: if you join the waitlist for a product that is coming soon, we store your email address, the product, the consent text you agreed to, your language (English or Arabic) and the date and time you signed up.
• Messages: what you send us by email (your email address, name if you include it, and your message). The contact form on this site does not send or store anything itself: it opens your own email app with a pre-filled message, which you then choose to send to us.
• Technical data: your IP address, browser type and the pages you request, which our hosting provider processes to deliver the site, keep it running and protect it from automated abuse.

3. Why we use your data, and our legal basis

• To provide what you bought (account, downloads delivered through Gumroad): necessary to perform our contract with you.
• To process payments, issue receipts and meet tax and accounting rules: contract and legal obligation.
• To tell you when a product you joined the waitlist for becomes available: your consent, which you can withdraw at any time by emailing us.
• To answer your messages and give support: our legitimate interest in helping you, or steps you asked us to take before a contract.
• To keep the website and your account secure (sign-in protection, spam and fraud prevention, security logs): our legitimate interest in protecting our users and our service.
• To send you service emails (account, password reset and order updates): contract.
• To send marketing emails or newsletters: only with your consent, which you can withdraw at any time using the unsubscribe link or by emailing us.

We do not sell your personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.

4. How long we keep it

• Account data: while your account is active. If you ask us to delete your account, we delete or anonymise it within 30 days.
• Purchase records: as long as tax and accounting laws require (normally up to 10 years).
• Waitlist sign-ups: until you ask us to remove you, and no longer than needed to tell you about the product.
• Emails you send us: up to 24 months after our last exchange with you.
• Technical and security logs: kept for a limited period by our hosting providers.

5. Who we share it with

We only share data with service providers who help us run CyberHacking, under terms that require them to protect it:

• Lovable (and its infrastructure provider Supabase) – website hosting, database, sign-in and file storage for cyberhacking.io.
• Gumroad (gumroad.com) – our payment processor and reseller. Gumroad processes your payment and billing details, handles any sales tax or VAT, issues your receipt and delivers your files. Gumroad acts as an independent controller for that data under its own Privacy Policy.
• Google – only if you choose to sign in with your Google account.
• Our email provider – receives and stores the emails you send to support@cyberhacking.io and our replies.

We may also disclose data if the law requires it or to protect our rights, our users or the public.

6. International transfers

Some of these providers are located outside your country, including in the United States and the European Union. Where data from the EU or UK is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or the provider’s equivalent commitments.

7. Your rights

Depending on where you live (including under the EU and UK GDPR, the Saudi Personal Data Protection Law and US state privacy laws), you can:

• access the personal data we hold about you and get a copy of it;
• correct inaccurate data;
• ask us to delete your data;
• object to or restrict certain uses of your data;
• receive your data in a portable format;
• withdraw consent at any time, where we rely on consent.

To use any of these rights, email support@cyberhacking.io. We reply within 30 days. We may ask you to confirm your identity first. You also have the right to complain to your local data protection authority.

8. Cookies

We use a small number of cookies and browser storage items to run the site, remember your choices and keep you signed in. See our Cookie Policy for details.

9. Security

We protect your data with encrypted connections (HTTPS), hashed passwords, two-step verification for administrators and access rules that keep each record visible only to those allowed to see it. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of a personal data breach where the law requires it.

10. Children

Our services are intended for adults and are not directed at anyone under 18. We do not knowingly collect data from children.

11. Changes to this policy

We may update this policy. If we make significant changes, we will tell you by email or by a notice on the website. The date at the top shows when it was last updated.