Privacy Policy

1. Introduction

CySense Intelligence (“we”, “us”, “our”) is operated by five92 LLC, a company incorporated in Barbados. We are committed to protecting your personal information in accordance with the Barbados Data Protection Act, Cap. 308D and any regulations made thereunder.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and your rights as a data subject. By using our platform at cysense.net or any related services, you agree to the practices described in this policy.

2. Data Controller

The data controller responsible for your personal information is:

3. Information We Collect

We collect the following categories of personal data:

• Assessment responses — your answers to cybersecurity assessment questions, used to calculate your risk score and generate recommendations.
• Email address — collected only if you voluntarily provide it (e.g., to receive your results by email or when a practitioner links your submission to their campaign).
• Practitioner account data — name, email address, and account credentials for registered practitioners.
• Contact form submissions — name, email address, and message content when you use our contact form.
• Usage data — anonymised analytics such as page views and session counts, collected to improve our platform. We do not use third-party advertising trackers.

We do not collect special categories of personal data (as defined in the DPA, Cap. 308D) and we do not collect data from persons we know to be under the age of 13 without verified parental consent.

4. Legal Basis for Processing

Under the Barbados Data Protection Act, we process personal data on the following lawful bases:

• Consent — where you voluntarily provide your email address or submit a contact form.
• Contractual necessity — to provide practitioner account services to registered users.
• Legitimate interests — to operate, secure, and improve our platform in ways that do not override your privacy rights.
• Legal obligation — where we are required by law to retain or disclose data.

5. How We Use Your Information

We use your personal data to:

• Calculate and display your cybersecurity risk score and personalised recommendations.
• Provide practitioner dashboards with campaign results and reporting tools.
• Generate AI-powered assessment summaries using the Google Gemini API. Only anonymised assessment answers — never your name or email — are submitted to the AI model.
• Respond to enquiries submitted through our contact form.
• Send you results or account-related communications where you have requested them.
• Maintain the security and integrity of our platform.

We do not use your data for automated decision-making that produces significant legal effects, and we do not sell personal data to any third party.

6. Data Sharing and Third Parties

We share data only in the following limited circumstances:

• Google Gemini API — anonymised assessment answers are processed to generate AI summaries. No personally identifiable information is included in these requests.
• Resend — our transactional email provider, used to deliver results and contact form confirmations. Your email address is shared only as necessary to deliver the message.
• Practitioners — if you complete an assessment via a practitioner's campaign link, your results are visible to that practitioner within their dashboard.
• Legal authorities — where required by applicable Barbados law or a valid court order.

7. Data Storage and Security

All personal data is stored on encrypted servers. We implement appropriate technical and organisational measures to protect your data against unauthorised access, disclosure, alteration, or destruction, in accordance with Section 25 of the Barbados Data Protection Act.

Assessment results are retained for as long as the associated campaign or account is active. Unlinked anonymous assessments are retained for 12 months and then deleted. Contact form data is retained for no longer than 24 months.

8. Your Rights Under the Barbados DPA

Under the Barbados Data Protection Act, you have the following rights:

• Right of access — you may request a copy of the personal data we hold about you.
• Right to rectification — you may request correction of inaccurate or incomplete data.
• Right to erasure — you may request deletion of your personal data, subject to legal retention obligations.
• Right to object — you may object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior processing.
• Right to lodge a complaint — you have the right to lodge a complaint with the Barbados Data Protection Commissioner.

To exercise any of these rights, email us at hello@cysense.net. We will respond within 30 days.

9. Cookies

We use a session cookie solely to maintain your login state if you are a practitioner. We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies. No cookie consent banner is required for strictly necessary cookies under applicable law.

10. Children's Privacy

While CySense offers assessments suitable for children (ages 7–12) and teenagers (ages 13–17), we design these experiences to collect minimal data. We do not knowingly collect personal data from a child under 13 without verifiable parental consent. Practitioners deploying CySense in educational settings are responsible for ensuring appropriate consent is obtained in accordance with applicable law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. We encourage you to review this policy periodically. Continued use of our platform following a change constitutes acceptance of the revised policy.

12. Contact Us

For privacy-related questions, data access requests, or complaints, please contact us at: