Privacy Policy

Version 1.0 · Effective September 30, 2026

This Privacy Policy explains how CyberWall Security, LLC (“CyberWall”, “we”) handles information in CyberWall Backup. CyberWall Backup is a business service: your company decides what is backed up, and we process that data on your company’s behalf under our Terms of Service.

1. Information we handle

• Account information: the name, work email, phone number and company name entered at signup, and the Microsoft 365 organization and account identifiers Microsoft sends when someone signs in. We never see or store Microsoft passwords.
• Backup data: the Microsoft 365 email, contacts, calendars and files your company chooses to protect, plus related details such as senders, subjects, folder names and dates used to browse and restore them.
• Activity records: sign-ins, messages opened, downloads, backup and restore activity, and technical logs (such as IP address, browser and time) used for security and support.
• Billing information: handled by our payment processor, Stripe. We don’t store full card numbers.

2. How we use it

Only to provide, secure, support and improve CyberWall Backup for your company; to communicate with you about your account and the service; to bill for the service; and to meet legal obligations. We do not sell personal information, use backup data for advertising, or use it to train artificial intelligence models.

3. Who can see it

• People your company authorizes in CyberWall Backup (administrators see company data; staff users see only their own mailbox and files).
• CyberWall staff, only when needed to operate or support the service, at your request, or when required by law. This access is logged.
• Our service providers, only to run the service: Microsoft (sign-in and the source of your data), Backblaze (encrypted backup storage, United States), DigitalOcean (hosting, United States) and Stripe (payments).
• Authorities, when we are legally required to disclose information. Where allowed, we will tell your company first.

4. Security

Backup data is encrypted with AES-256 using a separate key for each company before it is stored, and it travels over encrypted connections. Access is limited to authorized people and recorded in audit logs.

5. Retention

We keep backup data while your company’s account is active, as described in the Terms. After an account ends, backup data and its encryption key are deleted after 30 days, and removed from our providers’ systems within 60 more days. Account and billing records may be kept longer where needed for legal, tax or security reasons.

6. Cookies

We use one essential session cookie to keep you signed in and protect forms. We don’t use advertising or tracking cookies.

7. Your choices and rights

Your company’s administrators control what is backed up and who has access, and can disconnect Microsoft 365 at any time in Microsoft Entra. If you are an employee of a customer and want to access, correct or delete information about you, please contact your company’s administrator. We will help them respond. Depending on where you live you may have additional rights, and you can contact us about them.

8. Changes

We will post updates here and notify customers of material changes in advance.

9. Contact

CyberWall Security, LLC · mark@cyberwallsecurity.com