Vendor Shield (the “Service”), provided by CybrGen Limited (“we”, “us”, or “our”), helps you assess and monitor vendor security and compliance. This Privacy Policy explains what information we collect, how we use it, when we share it, and the choices you have. By using the Service, you agree to this Policy.
Information We Collect
1) Information You Provide
- Account information: your name and email address (from the platform’s built-in authentication).
- Vendor assessment data: company names, websites, services provided, contact details, and other information you input to conduct assessments.
- Uploaded documents: compliance reports (e.g., SOC 2, PCI DSS) and related files you explicitly upload for analysis.
2) Information Generated by the Service
- AI-generated analysis: compliance statuses (e.g., SOC 2, ISO 27001, GDPR, PCI DSS), risk scores, privacy policy analysis (strengths, red flags, summaries), trust center detections, incident findings, and other derived insights.
- Assessment logs: records of changes to vendor assessments and audit trails.
3) Automatically Collected Information
- Usage data: interactions with pages and features needed to operate, secure, and improve the Service.
- Cookies and similar technologies: the platform may use essential cookies for authentication and session management. We do not use non-essential cookies without notice and, where applicable, consent.
How We Use Your Information
- Provide, operate, and maintain the Service (including vendor assessments, dashboards, and exports).
- AI-powered analysis: We process uploaded documents and public web pages via AI/LLM integrations to extract findings, summarize content, and generate structured security and privacy insights.
- Improve and personalize the Service, including quality, accuracy, and user experience (using aggregated or de-identified data where possible).
- Protect the Service, enforce policies, prevent fraud or abuse, and maintain security.
- Communicate with you about updates, features, or support requests.
- Comply with legal obligations and respond to lawful requests.
Legal Bases for Processing (EEA/UK)
Where applicable, we process personal data under the following legal bases: (i) to perform our contract with you (provide the Service), (ii) our legitimate interests (e.g., improving Service reliability and security), and (iii) compliance with legal obligations. When consent is required (e.g., for certain cookies), we will ask for it and you may withdraw it at any time.
How We Share Information
We do not sell your personal information. We may share information in these limited circumstances:
- Service providers and infrastructure: The Service runs on the Base44 platform which provides hosting, database, authentication, file storage, and integrations.
- AI/LLM providers: When you request analysis, we send relevant content (e.g., uploaded reports, policy URLs, or extracted text) to trusted Large Language Model (LLM) providers solely to perform the analysis. These providers act under contractual terms and confidentiality commitments. We do not allow LLM providers to use your data to train their models beyond what is necessary to deliver the Service.
- Cloud storage: Files you upload are stored securely and accessed only to perform the Service you request.
- Legal and compliance: We may disclose information to comply with applicable laws, regulations, legal process, or enforceable government requests; to enforce our terms; or protect the rights, property, or safety of users or the public.
- Business transfers: In a merger, acquisition, or asset sale, information may be transferred as permitted by law and subject to appropriate safeguards.
Data Retention
We retain your information for as long as your account is active or as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce agreements. Uploaded files and derived assessment data remain available to your account until removed by you or in accordance with retention rules. Where feasible, we will honor requests to delete or anonymize data.
Data Security
We implement technical and organizational measures designed to protect your data, including access controls, encryption in transit (and at rest where supported), and secure development practices. However, no method of transmission or storage is 100% secure; we cannot guarantee absolute security.
International Data Transfers
We and our service providers (including AI/LLM providers and hosting infrastructure) may process data in countries other than your own. Where required, we rely on appropriate safeguards for such transfers, such as standard contractual clauses or equivalent mechanisms.
Your Rights
Depending on your location, you may have rights to access, correct, delete, or port your data; restrict or object to certain processing; and withdraw consent where applicable. To exercise your rights, contact us using the details below. We will respond in accordance with applicable law.
Children’s Privacy
The Service is not intended for children under the age of 16 (or the age required by your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us to request deletion.
Third‑Party Links
The Service may contain links to third‑party websites or resources. We are not responsible for their content or privacy practices. Please review their policies before providing any personal information.
Changes to This Policy
We may update this Privacy Policy to reflect changes to our practices or for legal, technical, or operational reasons. We will update the “Last updated” date and, where required, provide additional notice.
Contact Us
If you have questions about this Policy or our data practices, please contact: contact@cybrgen.nz.
Summary: How We Use AI
- You choose what to analyze (e.g., upload reports or run policy scans). Relevant content is sent to trusted LLM providers only to produce the requested analysis.
- Outputs include structured findings like compliance statuses, privacy analysis, and risk indicators; these are saved in your account.
- We do not permit providers to use your data for unrelated model training.