Privacy

What we do with your data

We collect your email address so you can have an account, receive what you bought, or receive our weekly “what breaks next” email issue if you choose to subscribe. We hold the documents you upload only long enough to convert them, and handle deletion requests as described below. We may send a company one business offer about our pre-release defect hunt, as described below. We do not add the address to a mailing list. We sell your data to nobody. We also receive information when you request our gated Hugging Face sample, as described below.

Effective 23 October 2026. Last updated 23 October 2026.

23 October 2026: We added the pre-release defect hunt and explained its one-time business offer, contact sources, service correspondence, payments and retention.

22 October 2026: The weekly email issue now runs on our own website and Amazon Web Services instead of EmailOctopus. We added the optional “What do you run?” answer, and updated newsletter retention, unsubscribe and deletion information.

22 October 2026: We added the Canada check, a paid container-image check, and explained request details, local test copies, payments and deletion.

22 October 2026: We added our Hugging Face sample access requests: the information shared with us, request counting, optional one-time follow-up email, retention and data requests, and Hugging Face's separate processing.

20 October 2026: We added an optional weekly email issue, explained EmailOctopus's processing and international data transfers, and added newsletter retention, unsubscribe and deletion information.

18 October 2026: We added notice of one-time support payments and Team checks interest mail, clarified the payer information we receive and Stripe's own processing, and explained interest-mail retention and data requests without an account.

Changed on 16 October 2026: we now sell Paid For, a downloadable pack. Buying it gives us your email address and a payment record through Link, Stripe's checkout service, and we may email buyers about their purchase. The sections below say what we keep and for how long.

What changed on 15 October 2026: we now say that we also use our web logs to count visits, including visits through links that carry a ?ref= marker and fetches of our feed, and that the logs are deleted within 90 days. On 28 September 2026 we added Cloudflare to the list of companies that receive your data, for the domain check on our email authentication page. We should have put a note here at the time. From 23 September to 14 October 2026, when we counted visits, we looked up which network visitors' IP addresses belong to, so that we could leave out mail-security scanners and cloud servers. Those lookups went through Cloudflare's public DNS resolver to Team Cymru, so both received those IP addresses. This page did not say so. We now use a downloaded table instead, so this lookup no longer sends your IP address to anyone.

What we collect, and why

Your email address and password. You give these when you create an account at cybernative.ai/account/. The address identifies your account, is where your confirmation and password-reset codes go, and is how we reply if you write to us. Your password is held by Amazon Cognito, the account directory we use — we never see it and cannot read it.

The documents you upload. When you start a job you upload PDFs. We store them so the conversion can run and so you can download the result. They are encrypted where they sit, are never public, and are opened only by the systems running your job and by a reviewer checking a job that got flagged.

Documents you email us. We do not take documents or files by email for a job; we work from a public link and a description. If you email us a document anyway, it is stored in our mailbox and the support tooling listed below may receive its contents. We never make it public, use it only to answer you, and delete it as described below.

The fields you ask for, and the output. The field names you choose, the rows we extract, and the five files every completed job delivers.

Your payment record. Payments for jobs and one-time support run on Stripe's hosted checkout. Card numbers go to Stripe and never reach us. Stripe collects payment, billing and device information directly. For jobs, we send limited identifiers for the job, account, offer, product, price and referral so we can match the payment to the job; we do not send your PDFs or extracted document content. Support payments buy no job and need no CyberNative account. Payment records include the amount, currency, date, payment status and payment or refund references, and the payer's email address, name and card-issuing country when Stripe provides them. We use these records to reconcile payments, handle receipts, refunds and disputes, meet accounting obligations, and count support payments. We do not use payer details for marketing or match them to browsing records.

If you buy Paid For. You pay through Link, Stripe's checkout service, which is the merchant of record. Link collects your email address and payment details, and whatever else it needs for payment and tax, and handles them under its own privacy policy. From Stripe we keep only the payment reference, the date, the amount and currency, and which plan you bought, and we use your email address only for the messages listed under "Email we send you". Your download page is not personalised: it holds no name, email or order details.

Mail about Team checks and sponsorship. If you write to us, we receive your email address, the name you provide and your message. For Team checks, we ask for your team or organization and the runners, base images and runtimes you use. We use this information to discuss that service and decide whether to build it. We keep counts of interest and organization names for that decision, without copying private email addresses or message contents into those records. We use sponsorship mail to answer and discuss the sponsorship inquiry. These messages are stored by Zoho and processed by our support tooling as described below. We do not add you to a mailing list or send unrelated offers. Please send product names and versions only, not code, credentials, configuration files, internal hostnames or private repository or registry links.

Canada check requests. If you ask for a Canada check, we receive your email address, the name you provide, your message and the public image names or stack details you send. We use them to agree the check, run it and send your result. We pull the public image, or prepare the test image we agree with you, only to run the check. The public registry receives our request for that image and our network address; we do not send it your email address. We delete our local working copies of pulled and derived images, exported filesystems, test containers and working outputs within 7 days after sending the result; if no result is sent, we delete them within 7 days of receiving your request. Request and result emails are stored by Zoho and processed by our support tooling as described below; they follow the purchase-mail retention below, including its recovery-copy and backup limits. If you pay, Stripe processes the payment and provides the payer and payment details described above for support payments. We use them to match your payment to the check and handle receipts, refunds, disputes and accounting. We keep counts and organization names that do not identify an individual in our business records, without private addresses or message contents. Requesting a check does not subscribe you to a mailing list. You can ask for access, correction or deletion at hello@cybernative.ai without an account, under the process below. Do not send credentials, customer data, configuration files or private links.

Pre-release defect hunt. We obtain a company's published business or sales role address from its own website, and use public company, product and issue-tracker details to prepare the one-time offer described under “Email we send you”. If you reply, we use your message, name and email address to agree the scope, send reports and handle payment, refunds or disputes. Zoho stores these messages and our support tooling processes them as described below. We delete offer and hunt emails from our active mailbox within 90 days after the hunt is paid or closed and any refund or dispute is resolved. If no hunt is agreed, we delete the offer correspondence from our active mailbox within 90 days after our last message. This does not erase every copy: provider recovery copies and support-tool records and backups have the limits described below. We retain payment, refund and legal records where required by law, and the minimum stop record needed to avoid emailing you again. Stripe processes payments under the payment and Stripe disclosures on this page. The technical work uses public repositories and published packages only. Do not send credentials, private code or user data. You can request access, correction or deletion at hello@cybernative.ai without an account, under the process below.

The weekly email issue. If you subscribe, CyberNative AI LLC uses your email address to send the weekly “what breaks next” issue. We ask for no name. We send a confirmation email, and the issue starts only after you press Confirm on the page it links to. Buying something or writing to us does not subscribe you. When you confirm, you can tell us what you run (for example the CI runners, base images and runtimes you use). That answer is optional. We use it to choose what each issue covers and count answers only in total, including when we decide what to build next. We never use it to email you separately or publish it, and we delete it if you unsubscribe. We store your address, the page you signed up on, the dates you signed up and confirmed, and whether you are subscribed, unsubscribed or your address bounced or complained. We do not keep the bounce and complaint notices themselves. We do not store your IP address, browser or location with your subscription. To limit abuse we use a keyed code derived from your IP address for one hour, separate from your subscription; it is then deleted automatically, normally within a few days. We keep aggregate subscriber counts, without copying addresses into those counts. When you follow a confirmation or unsubscribe link, our ordinary web logs record that request, including the code in the link, like any other page request. Each time we try to send you a weekly email, we keep a record of that attempt, which we use to avoid sending you the same issue again while the record is kept. It holds a keyed code of your address (not the address itself), the outcome of the attempt, and Amazon's message ID when Amazon returned one.

Hugging Face sample access requests. If you request access to our gated task sample on Hugging Face, Hugging Face shares your username, email address, Organization, Intended use, and your answer to “May we email you once about further tasks of this kind?” with CyberNative AI LLC, the owner of the CyberNative-AI repository. Its access records may also show your public profile name, the request date and access status. We use this information to provide access, count requests and the organizations requesting the sample, and assess interest in further tasks. If you choose Yes, we may send you one follow-up email about further tasks of this kind. Choosing No gives you the same access. Neither choice subscribes you to our newsletter, and we do not use the request to send unrelated offers or link it to your browsing activity.

The request records are held on Hugging Face and are available to the people and systems we authorize to manage the sample. We do not publish requester details or keep a separate requester mailing list. If we make a private export to count requests, we delete it after counting and within 24 hours. Our retained business records contain counts and organization names that do not identify an individual, without usernames, email addresses, profile names or raw field answers. We use a Yes answer only for the one follow-up; you can withdraw it before we send that email by writing to hello@cybernative.ai.

If we send the follow-up, our email provider and support tooling listed below process the email. We delete it from our active mailbox within 90 days after the last message if the discussion ends; mailbox recovery copies and support-tool records and backups have the limits described below. We keep a request to stop optional email only for as long as needed to honour it.

Hugging Face operates the platform under its own privacy policy, including its cookies, processing in the United States and other countries, and retention of platform records. Our 24-hour export limit does not delete those platform records, which can remain after dataset access ends. You can ask us for access, correction or deletion at hello@cybernative.ai from the address used for the request; no CyberNative account is needed. We handle requests about what we hold within 30 days and confirm what we did. For Hugging Face's own records, contact privacy@huggingface.co; we will assist with a request where we can.

Ordinary web logs. Our host records the usual: IP address, time, the page requested, the page you came from if your browser sends it, and your browser's user-agent string. Cookies are excluded from those logs. We use them to keep the site up, to spot abuse, and to count visits: how many visits from outside the company each page gets, how many arrive through a link we posted or emailed that carries a ?ref= marker naming where we shared it, and how many times our feed and calendar files are fetched. A marker on a link we emailed to one person can show us that the link was followed. We keep those counts; the logs themselves are deleted automatically within 90 days.

How long we keep it

The 30-day deletions of uploads and output files are an expiry rule on the storage itself, not a promise that somebody remembers to run something. Documents emailed to us for a job are deleted from our mailbox once the job is delivered, and never later than 30 days after they arrive. That deletion does not reach every copy: our email provider keeps deleted messages for a recovery period under its own policy, and the text of a message can remain in our support tooling's records and backups for longer. The Paid For download page works for anyone who has its address. Treat it like a shared link: anyone you send it to can download the pack.

Deleting interest mail from our active mailbox does not erase every copy. Zoho keeps deleted messages for a recovery period under its own policy, and message text may remain in our support tooling's records and backups for longer.

Cookies

On CyberNative pages, two cookies, both first-party, both strictly necessary:

• sid — keeps you signed in. JavaScript cannot read it.
• csrf — stops another site acting as you.

On CyberNative pages: no third-party analytics, no advertising, no third-party cookies, no cross-site tracking. Signed out, these pages set no cookies at all. These statements describe CyberNative pages. Stripe-hosted checkout and Link use their own cookies and collect information under Stripe's privacy policy.

Do Not Track

On CyberNative pages, we do not track you across other websites, so there is no cross-site tracking for a Do Not Track signal to switch off, and we do not change what we collect when a browser sends one. Stripe's hosted checkout and Link are covered by Stripe's privacy policy.

What we measure about how the product runs

We keep operational numbers about jobs, and they are linked to your account: how long a job waits, how long it takes, whether it failed, whether it was paid or refunded, and how much storage a job used. We use them to see whether the product works, and we do not use them to profile you, target advertising, or build audiences.

Who else sees it

Some of your information reaches companies we use to run the product:

• Amazon Web Services — hosting, file storage, the account directory, and the email it sends you on our behalf. Data for these website services is stored in the United States; this includes the weekly email: your subscription is stored and each issue is sent from AWS in the United States.
• Stripe — payments, when you buy a job or choose to support our work, and the matching identifiers described above. Stripe processes information on our instructions and also for its own purposes, including fraud prevention, security, legal compliance, and improving and developing its products and services. See Stripe's privacy policy for its data practices and your rights and choices, including when you use Stripe-hosted checkout or Link. For Paid For, Stripe's Link service is the seller of record: it receives your payment and tax details as the seller, not only as our processor, and handles requests to delete them. Ask Stripe, or write to us and we pass the request on.
• Zoho — our email provider. If you write to us, Zoho stores that message.
• Cloudflare — only if you use the domain check on the email authentication page. Your browser asks Cloudflare’s public DNS resolver (1.1.1.1) for that domain’s public records, so Cloudflare receives the domain you type and your IP address. We receive neither.
• Our support tooling — where a message you send us is read and worked on, it is processed by the tools we use to answer support mail, which receive its contents.

We do not sell your data, and we do not share it with advertisers or data brokers. We would hand data to a court or a government only where the law requires it.

Email we send you

We send the following kinds of email:

• the codes that let you confirm your account or reset your password;
• a reply when you write to us;
• if you buy Paid For: one email when Pack 1 is ready if it was not ready when you paid, and messages about refunds, cancellation or a security problem with what you bought;
• if you subscribe to Paid For: at most one email a month with a link to that month's new rules, while your subscription is active.
• if you request our Hugging Face sample and choose Yes to the optional follow-up question: at most one email about further tasks of this kind; choosing No does not affect access.
• For the pre-release defect hunt, we may send one offer to a company's business or sales role address published on its own website, after a maintainer has taken a non-rejecting action on our free public defect report. This action does not subscribe the company to email. We send no follow-up offer. Reply “stop” and we will send no more offers to that address.

Stripe sends payment receipts for support payments. We may reply about the inquiry you sent us, including telling you whether we build Team checks.

Your job's progress lives in your account, not in your inbox — we do not send job notifications.

If you separately subscribe and confirm, we also send the weekly “what breaks next” issue. Every issue has an unsubscribe link; using it needs no CyberNative account. We disable open and click tracking for newsletter emails: no open-tracking pixels and no tracking redirects on content links. Necessary confirmation and unsubscribe links still work. Links to our site may carry one common marker for that issue so we can count visits under “Ordinary web logs”; the marker does not identify a subscriber, and we do not link those visits to subscriber records. To stop optional Paid For monthly email, reply “stop” and we stop before the next one. That does not cancel your Paid For subscription or remove your download; to cancel, see the Paid For section of the terms.

Getting your data, and getting it deleted

• Delete my account. Write to hello@cybernative.ai from the address on your account, or the address you paid with. We handle it manually: within 30 days we delete your account and email address from our directory, your uploaded documents and output files, your operational job records, and the support email you sent us. We keep the payment, refund and legal records we are required to keep. As with emailed documents, our email provider keeps deleted messages for a recovery period, and the text of your messages can remain in our support tooling's records and backups for longer. We write back to confirm when it is done. For a Paid For purchase, we delete what we hold except the payment and refund record the law requires us to keep; Stripe holds its own records as seller and handles requests to delete them. A deletion request to Stripe also cancels any Paid For subscription.
• Send me my data. We send you what we hold about you.
• Fix something. Tell us what is wrong and we correct it.
• No account needed. If you subscribed to the newsletter, emailed us or made a support payment, you can ask for access, correction or deletion by writing to hello@cybernative.ai from the address you used. We handle the request within 30 days and confirm what we did. A newsletter deletion request removes the contact record, rather than merely unsubscribing it, subject to the legal and backup limits described above. We retain payment, refund and legal records that we are required to keep; mailbox recovery copies and support-tool records and backups have the limits described above. Stripe handles requests about its own processing under its privacy policy. Do not send card numbers or identity documents with your request.

You do not have to give a reason, and it costs nothing.

Children

This is a product for businesses. It is not for anyone under 16 and we do not knowingly hold data about children.

Changes to this page

This policy takes effect on the effective date shown at the top, and that date changes whenever the page changes.

If we make a material change — a new kind of information collected, a new purpose, a new company that receives your data, or a shorter list of things you can ask us to do — we say so on this page: for thirty days after a material change, a dated summary sits at the top of this policy describing what changed. Checking this page is enough to find out; you do not have to ask us.

Who we are

CyberNative AI LLC, a California LLC. Write to hello@cybernative.ai.