Version 1.0 — Effective [DATE TO BE SET]
This document is a draft prepared to reflect CyberTRIZ.ai's actual data processing activities as accurately as possible under the EU General Data Protection Regulation (GDPR). It is not a substitute for legal advice. Please have this reviewed by qualified legal counsel before publishing it as a binding policy, particularly the sections on international data transfers and liability.
CyberTRIZ.ai is operated by PayServices BV/SRL (trading as BigBigBrain), registered in Belgium, with its registered office in Beersel, Belgium (postal code 1650).
For any question about this policy or your personal data, you can contact us at: [PRIVACY CONTACT EMAIL TO BE ADDED]
We are the "data controller" for the personal data described in this policy — the entity that decides why and how your data is processed.
We collect only what is needed to operate the service and improve it. Depending on how you use CyberTRIZ.ai, this may include:
Account and identity data (when you create an account) - Email address - Password (stored as a salted cryptographic hash — we never store or can see your actual password) - Preferred language - Role within your organization (owner, admin, or member) - Newsletter subscription preference - Terms-of-service acceptance record (version and timestamp) - Cookie consent record
Usage and security data - Login timestamps, IP address, and browser/device information (used to detect suspicious login activity and secure your account) - Session tokens (to keep you logged in; stored as hashes, not usable on their own if intercepted)
Search and query data - The text of searches you run on the platform - The language automatically or manually detected for your query - Which result (if any) you clicked on - A session identifier (a random cookie value, not directly tied to your identity unless you are logged in)
We do not sell search or usage data to third parties, and we do not use it for advertising.
Documents you upload (Personal tier and above) - The files themselves, encrypted at rest using post-quantum cryptography (ML-KEM-768) with a unique key pair generated per account - Metadata: filename, file type, size, upload date, and processing status - AI-generated analysis of the document (e.g. gap analysis, audit-readiness findings), where you request it
Billing data (Personal tier and above) - Billing email address and account/organization name - Subscription status and tier - Payment processing itself is handled by our payment provider (Stripe); we do not store your card details on our own servers.
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the core search/AI service you've signed up for | Performance of a contract |
| Account security (lockouts, login logging, session management) | Legitimate interest — protecting your account and our service |
| Improving search relevance and language detection accuracy | Legitimate interest — service improvement |
| Sending you the newsletter | Consent (you can withdraw this at any time) |
| Complying with tax, accounting, or legal obligations | Legal obligation |
We keep our infrastructure as self-hosted and minimal as reasonably possible:
We do not sell your data, and we do not share it with data brokers or advertisers.
As a resident of the EU/EEA (or wherever GDPR applies to you), you have the right to:
To exercise any of these rights, contact us at the address in Section 1.
No system is perfectly secure, and we cannot guarantee absolute security, but we take reasonable, current-best-practice technical and organizational measures to protect your data.
CyberTRIZ.ai is a business-to-business compliance and security research platform. It is not directed at, and we do not knowingly collect data from, children under 16.
We may update this policy from time to time. Material changes will be communicated to registered users (e.g. by email or an in-app notice), and the "Version" and "Effective" date at the top of this document will be updated accordingly.
[PRIVACY CONTACT EMAIL TO BE ADDED] PayServices BV/SRL, Beersel, Belgium