Skip to content

Privacy Policy

Last updated: October 11, 2026

1. Information We Collect

We collect information you provide directly to us, including:

  • Account information (email address, name)
  • Organization details (company name)
  • Monitored email addresses
  • Alert configuration preferences
  • Billing information (processed securely by Stripe)

2. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our services
  • Monitor email addresses for data breaches
  • Send breach alerts and notifications
  • Process payments and manage subscriptions
  • Send service-related communications
  • Respond to your requests and support inquiries

Authorized Cykanner personnel may use a time-limited (30-minute), read-only support session to view your organization's dashboard for support or operational purposes. Starting a support session creates an audit record of the acting account and time.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on the following legal bases:

  • Contractual necessity — processing your account information and billing details is necessary to provide the breach-monitoring service you sign up for. Where a monitored email address belongs to someone other than the account holder (e.g. an organization monitoring its own employees' addresses), we process that address as a processor acting on the monitoring organization's instructions — see our Data Processing Agreement; it's that organization's own responsibility, as controller, to have a valid legal basis (typically its legitimate interest in protecting its own accounts and systems) for monitoring those addresses
  • Legitimate interests — securing our service (e.g. audit logging, abuse prevention, rate limiting), and improving reliability, where those interests aren't overridden by your own rights
  • Legal obligation — where we must retain or disclose information to comply with applicable law (e.g. tax and accounting records, law-enforcement requests)
  • Consent — for any processing where we ask for it directly, which you may withdraw at any time

4. Data Security

We implement appropriate technical and organizational measures to protect your data:

  • All data encrypted in transit using HTTPS between your browser or API client and our servers. The connection between our application servers and our database is confined to a private network not exposed to the public internet, rather than separately TLS-encrypted
  • Passwordless, magic-link authentication
  • Organization-scoped customer access controls, with time-limited, read-only support sessions for authorized personnel
  • Automated daily database backups, retained for 7 days

5. Data Retention

We retain your data for as long as your account is active or as needed to provide services, including breach history, for compliance and audit purposes. Specific retention periods for the data we hold:

  • Account, organization, and breach-history data — retained for the life of your account; deleted immediately and permanently from our primary database when you delete your account, subject to the backup-retention exception described below
  • Sign-in links (magic links) — expire 15 minutes after being sent, whether or not they were used, and are then removed by an automated cleanup that normally runs hourly, so a link is typically fully removed from our database within around 75 minutes of being sent; that's our normal operating target, not a guaranteed deadline, since an outage affecting the cleanup job itself would delay it until the job recovers and catches up
  • Session tokens — expire automatically 30 days after sign-in. Using "sign out everywhere" invalidates every session immediately in our primary store — there is no separate cache layer that could keep recognizing a signed-out device afterward
  • Lifecycle email delivery records (idempotency/tracking records for account-lifecycle emails like welcome, trial-nudge, trial-expired, weekly-digest, and payment-failed-dunning messages) — retained for the life of your account; there's no separate cleanup job for these, so they persist until account deletion like account and organization data above
  • Audit log records (e.g. who changed a domain or alert setting, when, and from what IP address) — retained for the life of your account for security and compliance purposes; your personal details are removed from them when you delete your account, though the fact that an audited action occurred may be retained in de-identified form
  • Alert delivery records — retained for at least 35 days after an alert is successfully delivered or permanently fails, then deleted by an hourly cleanup job (so deletion happens sometime after the 35-day mark, not exactly at it). One exception: if an alert permanently fails and we're unable to notify our own operators of that failure (for example, because our operator-alerting email itself is unreachable), that record is kept indefinitely rather than on the normal schedule, so the failure remains visible for us to investigate
  • Payment-processing event records (used to safely process Stripe webhook events exactly once) — retained for at least 35 days after processing completes, then deleted by the same hourly cleanup job; a small number of records for events that were reserved for processing but never completed (e.g. due to an unexpected error, with no further retry or manual replay from Stripe) may persist longer, since they're only cleared once a later retry or replay completes them; your actual billing history is retained by Stripe under its own privacy practices
  • Database backups — automated daily backups, retained for 7 days (see Data Security above)
  • Contact-form submissions — we don't keep a database record of contact-form submissions. A successful submission is forwarded once, by email, to our own operator mailbox (retained there under our own mailbox's normal retention, not a separate schedule we control here). If sending that email fails, we log the full submission (name, email, subject, and message) to our application's server logs instead, so it isn't lost — those logs are retained under our hosting provider's standard operational log window, not archived separately or kept indefinitely

You can delete your account and its data yourself at any time from Settings > Danger Zone — deletion from our database is immediate and permanent, with no recovery window, and cancels any active subscription. An already-open session stops working on its very next request after deletion; no new session can ever be created for a deleted account. A minimal record that an account existed and was deleted is kept for our own audit trail, with your personal details removed from it. Because we retain daily database backups for 7 days, a deleted account's data may persist in those backup copies until they age out on that same schedule — backups exist solely for disaster recovery and are not used to reconstruct or restore an account you've deleted. If you verified a domain through our HIBP Pro-tier integration, HIBP retains that domain's own verification state under our shared account after you delete it from Cykanner; we cannot erase that record on your behalf. Deleting your account does not instantly stop work already in progress. A scan that is running when you delete your account, or that starts while the deletion is being processed, may keep sending monitored email addresses from its list to HIBP until it detects that your account no longer exists, and we cannot guarantee exactly when that happens. Once the deletion is complete, nothing such a scan finds about your addresses is kept, apart from the backup copies described above. An alert that was already being sent, or one about a scan that finished just as you deleted your account, may also still be delivered to the alert channels you configured.

6. Data Sharing

We do not sell your personal information. We share data with the service providers below (our subprocessors), each limited to what they need to perform their specific function:

  • Have I Been Pwned (HIBP) — monitored email addresses are checked against HIBP's breach-notification database as part of every scan
  • DigitalOcean — application hosting, database, and cache/queue infrastructure
  • Stripe — payment processing and subscription billing
  • SMTP2GO — outbound transactional email (sign-in links, breach alerts, and contact-form submissions — if you use our contact form, your name, email, and message are forwarded through it)
  • Cloudflare Email Routing — inbound email to our @cykanner.io addresses (e.g. this page's own contact address below) is routed through Cloudflare before it reaches us
  • OpenAI — used only as a fallback when bulk-importing monitored emails, if our own extraction can't identify any addresses in the file you upload. On that fallback path, the complete raw file content (up to 100,000 characters) is sent to OpenAI, not just the addresses — if your file has other columns or text, that goes too
  • Google Fonts — every page loads a web font from Google's CDN, which receives the visitor's IP address and browser details as part of that request (not data we send Google directly, but a consequence of how the page is built)
  • Sentry — application error tracking, performance monitoring, and session replay. When an unhandled error occurs, we send Sentry details about the error itself (its type and a generic message) along with opaque internal correlation identifiers (e.g. a request or background-job id) that let us trace an error back to server logs. If an error happens in your browser while you use the site, your browser sends that report to Sentry directly, so Sentry also receives your IP address and browser details as part of that request; the report itself carries only the error type, a generic message, and where in our code it occurred. Performance monitoring: for a sample of page views, your browser also sends Sentry timing measurements of how the page loaded and responded (for example load time, responsiveness, and layout-stability scores), the page's address with its query string and fragment removed, and your browser's user-agent string. For those same sampled page views, our server also sends Sentry a matching record of how long it took to handle the page request and some of the requests the page makes afterwards — the HTTP method, the route that was requested (for example "/dashboard/domains/[id]", never the actual values in the address), and the response status, with no request contents — linked to your browser's measurements by a random trace identifier. Session replay: when an error occurs in your browser, it may also send Sentry a recording of your activity on that page — page structure, clicks, scrolling, and navigation — covering roughly the minute before the error and, once an error has occurred, the rest of that browsing session on our site (up to 60 minutes), so we can reproduce the problem. All text on the page and everything you type into form fields is masked (replaced with placeholder characters) inside your browser before the recording is sent, images and other media are blocked out entirely, and page addresses in the recording have their query strings and fragments removed. Replays are only sent to Sentry when an error occurs; otherwise the in-browser recording is discarded. We do not intentionally send Sentry monitored email addresses, breach data, or other account-holder personal data, and run all of this through a scrubbing layer designed to prevent that. These correlation identifiers are pseudonymous rather than anonymous: while we hold the corresponding server logs, we could in principle use one to look up the account or organization context of the request or job it came from. Error events, performance data, and replays are retained in Sentry under its own standard retention windows for our plan, independent of your Cykanner account — deleting your account doesn't delete Sentry data already created, since Sentry has no record that ties it to a specific account for us to act on. If you'd prefer that your browser send nothing to Sentry, blocking requests to Sentry's domains with a browser content blocker prevents it without affecting how the site works; the server-side timing records described above are sent by our server, not your browser, so a content blocker does not affect them

Alert channels work the same way regardless of type — email recipients you add, a Slack workspace you connect, or a custom webhook you point us at: the breach-alert content is sent to the destination you configure. Those destinations are yours, not vendors we chose, so they aren't in the list above — but we want to be clear they're still real places your data goes.

Separately from the vendors above, we may also disclose data to law enforcement when legally required to — this is a legal obligation, not a service we've engaged a provider to perform on our behalf.

This list reflects our infrastructure as of the "last updated" date above and changes as our infrastructure does — contact us if you'd like the current list confirmed.

7. International Data Transfers

We are a US-based company, and the service providers listed above (Data Sharing) process data primarily in the United States. If you're located outside the US, your data will be transferred to and processed in the US and other countries our subprocessors operate in. Where we transfer personal data internationally, we take steps designed to ensure it receives an adequate level of protection, consistent with applicable data-protection law.

8. Data Processing Agreement

If your organization needs a signed Data Processing Agreement (DPA) to use Cykanner under GDPR or a similar framework, we offer a standard-form DPA — see our Data Processing Agreement page, or contact us to request an executable copy.

9. Your Rights

You have the right to access, correct, or delete your data. Deleting your account is self-service (Settings > Danger Zone) and immediate. For access or correction requests, or if you'd rather we handle deletion for you, contact us (see below).

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you additionally have the right to: access the personal data we hold about you; request correction of inaccurate data; request erasure of your data; restrict or object to certain processing; request a portable copy of your data; and lodge a complaint with your local data-protection supervisory authority. If you are a California resident, you have equivalent rights under the CCPA/CPRA to know what personal information we collect, to request its deletion, and to opt out of its "sale" or "sharing" — we do not sell or share personal information as those terms are defined by California law.

10. Children's Privacy

Cykanner is a business-to-business service intended for use by adults acting on behalf of their organization. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us (see below) and we will delete it.

11. Cookies

We use essential cookies for authentication and session management. These are necessary for the service to function and cannot be disabled. Session replay (see Sentry under Data Sharing) also stores a random session identifier in your browser's session storage — not a cookie — which is cleared when you close the tab.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "last updated" date.

13. Contact Us

If you have questions about this privacy policy, please contact us at:

Email: privacy@cykanner.io
Address: 5830 E 2nd St, Ste 7000 #37463, Casper, Wyoming 82609, US