Privacy Policy

This Privacy Policy explains how Cyber Sky ("we", "us", "our") collects, uses, shares and protects personal data when you use the website cyberskyacademy.com, our learning platform, courses, hands-on labs, CTF challenges, community, newsletters and related services (the "Services").

Cyber Sky is the controller of your personal data for the Services. If you have any questions, contact us at [email protected].

Data you give us

• Account data: name, email address, password (stored hashed), phone number, country, and optional profile details such as username, photo, job title or bio.
• Purchase data: the courses or plans you buy, billing name and address, and transaction records. Card details are entered directly with our payment provider (such as Stripe), and we receive only limited information such as card type, last four digits and expiry date.
• Communications: messages you send to support, contact form submissions, survey answers and feedback.
• Community content: posts, comments, write-ups and other content you publish in shared spaces.
• AI feature inputs: questions and messages you send to AI-powered features such as a learning assistant, and the responses generated.

Data collected when you use the Services

• Learning data: course progress, videos watched, quiz and assessment results, flag submissions, scores, leaderboard ranking and certificates earned.
• Lab and VPN data: VPN connection times, assigned VPN IP addresses, your public IP address, lab start/stop/reset events, and network traffic and activity logs inside lab environments. We use these to run the labs, grade challenges, detect cheating and abuse, and protect our infrastructure.
• Device and usage data: IP address, browser type, operating system, device identifiers, pages viewed, links clicked, referring pages, approximate location derived from IP, and timestamps.
• Cookies and similar technologies: see Cookies below.

Data from others

• Your employer or training sponsor, if they enrol you through a corporate plan (for example, your name, work email and assigned courses).
• Payment providers (payment status and fraud signals) and sign-in providers, if you choose to log in with a third-party account.

We do not sell your personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.

We share personal data only as needed with:

• Service providers that process data on our behalf under contract, including cloud hosting and lab infrastructure (such as Amazon Web Services), payment processing (such as Stripe), email delivery, analytics, customer support tools, video hosting and AI model providers used for AI features.
• Your organization, if it enrolled you or pays for your access: progress, completion and assessment results.
• Other users, for information you choose to make public, such as your username, leaderboard ranking, community posts and certificate verification details.
• Authorities and others when required by law, to protect our rights, users or the public, or to investigate misuse of the Services, including illegal activity originating from our labs.
• A successor in a merger, acquisition or sale of assets, subject to this Policy.

We operate internationally, and our service providers may process data in countries other than your own, including the United States and the European Union. When we transfer personal data across borders, we use appropriate safeguards required by applicable law, such as standard contractual clauses.

• Account and learning data: while your account is active, and for up to 24 months after closure so we can restore progress and verify certificates, unless you ask us to delete it sooner.
• Certificate verification records: kept for as long as the certificate remains verifiable.
• Lab activity and VPN logs: generally up to 12 months, or longer if needed to investigate abuse or security incidents.
• Payment and tax records: as long as required by accounting and tax laws (usually up to 7 years).
• Support and AI conversations: up to 24 months.
• Marketing data: until you unsubscribe or withdraw consent.

After these periods, we delete or anonymize the data.

We protect your data with technical and organizational measures appropriate to the risk, including encryption in transit, hashed passwords, network isolation between lab environments and the platform, access controls and logging. No system is completely secure. If a breach affects your personal data, we will notify you and the relevant authorities where the law requires it.

Depending on where you live, including under the EU/UK GDPR, the Oman Personal Data Protection Law, other GCC data protection laws and US state privacy laws, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate or incomplete data;
• delete your data;
• restrict or object to certain processing, including direct marketing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting earlier processing;
• lodge a complaint with your local data protection authority.

To exercise any right, email [email protected] from the email address on your account. We may need to verify your identity, and we will respond within the time required by law (normally within 30 days). We will not discriminate against you for exercising your rights.

We use cookies and similar technologies to:

• Keep the Services working (essential): sign-in sessions, security, load balancing, language preference and payment flows.
• Understand usage (analytics): how pages and courses are used, so we can improve them.
• Marketing (where used): to measure campaigns and show relevant ads.

Where the law requires it, we ask for your consent before using non-essential cookies. You can also block or delete cookies in your browser settings; blocking essential cookies may stop parts of the Services from working.

The Services are not directed to children under 13, and we do not knowingly collect their personal data. Users aged 13 to 17 may use the Services only with the consent and supervision of a parent or legal guardian. If you believe a child has given us personal data without proper consent, contact us and we will delete it.

We may update this Privacy Policy from time to time. We will post the new version on this page and update the "Last updated" date. For material changes we will give reasonable notice by email or through the platform.

For privacy questions or requests, contact Cyber Sky at [email protected] or through our contact page.

See also our Terms of Service.