Legal
Privacy Policy
Last updated: 26 October 2026
This policy explains what Cyphlon, a sole proprietorship registered in a United Arab Emirates free zone with operations in the UAE and the United States, which operates jeerc ("we"), processes when you use the service, why, and your rights. We are the controller for account, billing and sign-up data. For what your organisation puts into the service (code, targets, findings, reports) we act as its processor, on its instructions; a data processing agreement is available from [email protected].
1. What we process
- Account data: names, email addresses, a hash of your password, sign-in and audit events.
- What you ask us to test: repository contents (cloned for each scan and deleted after it), target addresses and saved test logins (stored encrypted), findings and reports.
- Billing data: Polar processes payment details; we receive only your Polar customer reference, what you bought and the subscription status, never card numbers.
- Sign-up attribution: where a visitor first came from (a referring site, campaign tags), stored in the browser and sent only if you sign up. No advertising or tracking cookies.
2. Why
To provide and secure the service, to bill for it, to send the emails you need (sign-up, readiness, pentest results, alerts and reports you configure), and to understand which steps of sign-up and setup work. The legal basis is the contract with your organisation, and our legitimate interest in running and improving a secure service.
3. AI processing
On the Free plan no AI feature runs unless you buy a pentest. A pentest, and on paid plans AI verdicts, code review and fixes, send only what each task needs to the model provider through one gateway. Your repository credential is never sent to a model, and we do not use your code, targets or findings to train models.
4. Subprocessors
- Contabo: the servers the service, its data, its backups and its email run on (Germany).
- Polar: payments, invoicing and tax, as merchant of record.
- OpenRouter: routes AI requests for pentests and AI features to the model providers behind it.
- Cloudflare: DNS, network delivery and the anti-robot check on sign-up and contact forms (global).
Services you connect yourself, such as your code host, receive what that connection needs. We tell customers before adding a subprocessor that processes their data. Where data leaves the country it was collected in, we rely on the safeguards the applicable law provides, such as the EU standard contractual clauses.
5. How long
Organisation data is kept while the organisation is active and deleted 30 days after it is closed; encrypted backups are kept for 14 days. Sign-ups that were never confirmed are deleted a week after their link expires. Billing records are kept as long as tax law requires.
6. Your rights
You can access, correct, export or delete your data, object to processing or ask us to restrict it, and withdraw consent you gave. We answer within 30 days, or tell you within that time why we need up to 60 more. Organisation administrators can export everything from the app. These rights apply wherever you are; the GDPR, the UK GDPR, the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and the CCPA/CPRA give some of them the force of law. You can complain to your data protection authority, in the UAE the UAE Data Office. Requests: [email protected].
7. Changes
We announce material changes to this policy by email before they take effect. Questions: [email protected].