Privacy policy

Version 3 · effective 14 November 2026

1. Who we are

Cybernocs is operated by JITTERCAT (Pty) Ltd ("we", "us"). We are the "responsible party" under the Protection of Personal Information Act (POPIA) for your account details and for what you tell us when you contact us. For the personal information of other people that you enter into the service, you are the responsible party and we are your "operator" (see section 14 of our terms).

Our information officer is Charlie Tester, who can be reached at hello@cybernocs.co.za. Our full details are in section 30 of the terms.

2. What we collect, and where it comes from

• Your account details. Name, email address, role, a password stored in a protected form so that we cannot read it, two-step sign-in details, a record of your activity in the account (for example when you signed in, and changes you made), and a record of when you accepted our terms and when and by whom permission was given to scan each domain. To limit repeated wrong passwords we also keep a one-way scrambled form of your network address and email address for up to 24 hours. It cannot be turned back into the original. These come from you or the person who invited you.
• What you tell us to monitor. Your company name, website and domains, email domains, brands, IP ranges and suppliers.
• Results of scans. Findings and their status, scores, the sources that were read, and notes about what could not be read. Most of this comes from public sources and from ordinary requests to your own website. It is information about your business and its systems, and may include a few personal details that are publicly visible, such as a staff email address that appears in a public record.
• What you enter in tools. Your answers to incident response questions and your staff exit checklists. Staff exit checklists contain the names of people leaving your business, and you are responsible for having a lawful reason to record them.
• Enquiries. What you send us when you contact us. To stop spam and misuse of the form, we keep a one-way scrambled form of your network address and of your email address for up to 24 hours. They cannot be turned back into the original.
• People who ask for an EDAN decoy address. If a customer switches on EDAN, we record each request for their decoy address: the time, the visitor's IP address, an approximate country, the page asked for, and the name the browser or tool gives itself. These people have no account with us, so this notice is where we tell them. An IP address is personal information, even though it does not name anyone.
• Payment details. Payments are handled by our payment provider. We receive confirmation of payment, not your card number.

We do not collect passwords or the contents of leaked or exposed files. Where a public source suggests a secret may be exposed, we record only where it appeared.

3. Why we use it

We use information to run scans, show you results, show you alerts, give you reports, take payment, keep the service secure and working, prevent misuse, improve the service, meet legal duties and reply to you. We may also produce anonymous, combined statistics that do not identify you. We do not sell your information, and we do not use it for advertising or for deciding anything about people.

For EDAN visitors, we use the details to tell the customer who owns the decoy address that someone asked for it, and to keep the service and the customer's systems secure. Our basis is legitimate interest: a business has a real interest in knowing when something probes its domain, and a visitor to an address that nothing real uses has little reason to expect privacy about a request they send to it. We do not use these details for advertising or to make decisions about the visitor, and we do not sell them. Any visitor may ask what we hold about their IP address, and may object to us holding it, through our information officer (section 1).

Your health score is worked out automatically from your findings. It is about your business's internet exposure, not about any person.

You give us your information because the service needs it. If you do not give it, we cannot provide the service.

4. Who else handles it

• Hosting and storage. We use a global cloud platform to run the service and store data.
• Email. We use an email-sending service to deliver account messages such as invitations and password resets.
• Payment. A payment provider processes payments.
• Public data sources. To run scans we send business and domain names, but not personal details, to public security sources and receive results back. These sources have their own policies.

We do not give your information to anyone else unless the law requires it, or you ask us to (for example when you invite a team member or share a report). Providers are allowed to use it only to give us their service, and are bound to keep it secure.

Our providers may handle information outside South Africa, including in the European Economic Area and the United States. We only allow this where POPIA permits it, for example where the provider is bound by an agreement that gives the information protection similar to POPIA, or where it is needed to provide the service to you.

5. How long we keep it

• We keep your account details and scan history while your account is active, so that you can see your history and progress.
• After your account closes you have 30 days to ask for a copy of your reports and plans. After that we delete your data from the live service, and it leaves our backups as they expire, within 90 days.
• EDAN visitor details, including IP addresses, are kept for 30 days and then deleted. They are also deleted when the customer removes the decoy or the account closes.
• We may keep what the law requires us to keep, such as payment and tax records, for as long as it requires.
• You can ask us at any time to delete your account and its data.

6. Your rights

You may ask us to confirm whether we hold personal information about you, to give you a copy, to correct it, or to delete it. You may object to our using it, and you may withdraw any permission you gave us. Contact our information officer. We will reply within a reasonable time and will not charge for ordinary requests.

If you are not happy with how we handle your information, you may complain to the Information Regulator of South Africa (inforegulator.org.za).

7. Security

Each customer's data is kept separate. Passwords are stored in a protected form, two-step sign-in is available, connections are encrypted, and access is limited by role. No system is perfectly secure. If a breach affects your information, we will tell you as soon as reasonably possible, as the law requires, and tell the Information Regulator where we must.

8. Cookies and this website

This public website does not use advertising or tracking cookies. When you sign in to your account, we use a cookie that keeps you signed in and keeps your account secure. It is needed for the service to work. You stay signed in for up to 7 days, and are signed out after 24 hours without activity.

9. Children

The service is for businesses. It is not meant for anyone under 18, and we do not knowingly collect information about children.

10. Changes

We will post changes here and tell customers about significant ones by email or in the account before they apply.