Privacy
What we collect about you, why, who we pass it to, and how long we keep it. Without the legal padding.
Last updated: 10 August 2026
The data controller is CypherOn, company ID 23496495, registered at Korunní 2569/108, Vinohrady, 101 00 Prague 10, Czech Republic.
For anything related to personal data, reach us at [email protected] or +420 910 927 985. We have not appointed a Data Protection Officer — the law does not require one of us.
Contact form and the “Under attack” form. Your name, email, phone, company, the type of inquiry or incident, and whatever you write to us. We process it so we can reply and possibly agree on working together — the legal basis is steps prior to entering a contract and our legitimate interest in answering an inquiry (Art. 6(1)(b) and (f) GDPR). Filling in the form is voluntary; without an email or phone number we have no way to get back to you.
Newsletter. The email address you give us with your consent (Art. 6(1)(a) GDPR). Alongside it we store the IP address and browser details from which the consent was given — that is our record that the consent exists. You can withdraw it at any time via the link at the bottom of every email — no reason needed, no consequences.
Document downloads. Name, email and optionally company. We use it to send you the download link; we also keep a record of which document was downloaded, together with browser details and a fingerprint of the IP address. The legal basis is our legitimate interest in knowing which documents people are interested in.
Security tools. The password check, the password generator and the file fingerprint calculation run entirely in your browser — neither the password nor the file reaches us. With the email domain check, the website header check and the file fingerprint check, all you send us is the domain, the page address or the fingerprint you entered; we cache the result for a few minutes so we do not ask the same question repeatedly. The breach check needs your email address, because that is where we send the verification link: we hold the address encrypted for at most 60 minutes, until you confirm the link or it expires, and then delete it. The legal basis is our legitimate interest in running a publicly available tool and preventing its misuse — with the breach check, above all preventing anyone from querying somebody else's mailbox through it (Art. 6(1)(f) GDPR).
Self-checks and calculators. The answers you fill in stay in your browser and are not sent to us. The email address you enter in the ZKB readiness check to receive the report is processed only if you also tick the newsletter subscription — the same applies to it as to the newsletter above, including the consent and your ability to withdraw it at any time.
Visiting the site. See cookies and analytics below.
We do not use personal data for automated decision-making or profiling.
We do not sell it to anyone. We share it only with the services the site could not run without:
We may also disclose data where the law requires it — typically to law enforcement or the supervisory authority.
After that we delete it. We keep things longer only where the law says we must (accounting records, for instance).
The site runs its own traffic measurement, which stores no cookies and does not handle your IP address in a form that could identify you. It records the page visited, where you came from, browser language, screen resolution and how long you stayed.
Google Analytics 4 is always on the site, but without your consent it runs in a limited mode (Consent Mode): it neither stores nor reads cookies and does not build a profile out of your visits. Even in that mode it still sends the basic page-view signal, so Google records your IP address and browser type. Only after consent do the analytics cookies get added, which are what makes a returning visitor recognisable. We store your choice in browser storage (localStorage), not in a cookie — and you can revoke it any time by clearing site data.
Technical cookies required to run the site (admin login, form protection) do not require consent.
Under the GDPR you have the right to:
Just write to [email protected]. We will get back to you as soon as we can, within one month at the latest.
If you believe we are handling your data badly, you can complain to the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.
When the way we handle data changes, we update this text and change the “last updated” date at the top. We do not keep a version history, so if this document matters to you, save a copy.