Privacy Policy

Privacy Bytes ("we," "us," "our") operates the GRC Lab platform. This Privacy Policy explains what personal data we collect, how we use it, and the choices you have. If you have questions, email dopio@privacybytes.net.

1. Data we collect

We collect the minimum data needed to run the Service:

• Account data: your name (optional), email address, and a securely hashed password when you create an account.
• Billing data: your subscription tier, billing period, and payment status. Payments are processed by Stripe; we do not see or store your full card details.
• Learning data: your progress through project labs (for example, which projects you marked complete) so the platform can track your advancement.
• Technical data: basic session information needed to keep you signed in, plus standard server logs.

2. How we use your data

• To create and manage your account and membership.
• To process payments and manage your subscription through Stripe.
• To operate platform features such as progress tracking and webinars.
• To send you our Privacy Bytes newsletter. Paying members are subscribed automatically; you can unsubscribe at any time using the link in any email.
• To communicate about your account, billing, and important service updates.
• To improve the Service and understand aggregate usage patterns.

We do not sell your personal data to anyone.

3. Service providers

We share data only with the providers needed to operate the Service:

• Stripe: payment processing (subject to Stripe's privacy policy).
• Beehiiv: newsletter delivery for subscribed members.
• Vercel and Neon: application hosting and database services.

Each provider processes data only as needed to provide its service to us and is bound by its own contractual and legal obligations.

4. Cookies

We use a single essential session cookie to keep you signed in. We do not use advertising or cross-site tracking cookies.

5. Data retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within a reasonable period, except where we must retain records for legal, tax, or accounting purposes (for example, transaction records).

6. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, email dopio@privacybytes.net and we will respond within a reasonable timeframe.

7. Security

We use industry-standard measures to protect your data, including encrypted connections, hashed passwords, and restricted access to production systems. No method of transmission over the internet is completely secure, but we work to protect your information using reasonable safeguards.

8. Children

The Service is not directed at children under 18, and we do not knowingly collect data from them.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or through the platform, and the "Last updated" date above will reflect the latest revision.

10. Contact

For any privacy question or request: dopio@privacybytes.net.