Privacy Policy

3.1 Corporate Website (creativecyber.in)

• Contact form submissions: name, professional email address, organisation name, message content
• Newsletter subscriptions: email address and preference settings
• Analytics data: page views, session duration, referral source — our website analytics store only a salted hash of your IP address, never the raw address
• Technical metadata: browser type, device type, approximate geographic region (country/state level only)

Privacy note: Our custom website analytics system hashes IP addresses using salted SHA-256 before any storage, so raw IP addresses are never retained by that system. Other systems do store the IP address in plain form for fraud prevention and security: contact and enquiry forms, Knowledge Portal registration (Section 3.5), one-time passcodes, administrator security logs, and sign-in, token and audit records on our product platforms (Sections 3.2 to 3.4). See Section 10.

3.2 RiskSage (risksage.creativecyber.in)

• Account registration data: full name, business email address, job title, organisation name, industry sector
• Assessment inputs: cyber risk posture data, control gap information, maturity scores entered by the user or organisation
• Organisation profile: sector, employee count range, existing security frameworks in use
• Usage telemetry: feature interactions, report generation events, session metadata
• Security and audit records: the IP address (and, for sign-in sessions, the browser user-agent) is recorded in plain form with sign-in sessions, refresh tokens, audit-log entries, AI-usage records, evidence uploads and risk-model runs
• Communication preferences and notification settings

3.3 DPDP Assurance Platform (dpdp-assessment.creativecyber.in)

• Account data: name, designation, work email, organisation name, role (Data Fiduciary / DPO / Compliance Officer)
• Compliance assessment inputs: responses to DPDP control questionnaires, gap findings, evidence artefacts uploaded by the user
• Organisational data: business entity details provided for compliance scoping (not customer PII of BFSI clients)
• Workflow and collaboration data: task assignments, comments, review status within the platform
• Audit logs: user action logs for accountability and compliance trail purposes, recorded with your IP address and browser user-agent (data-subject-request audit entries also record the IP address)
• Subscription and billing metadata: plan tier, payment reference IDs (full card details are not stored; payment processing is handled by our payment partner)

Important: DPDP Assurance processes compliance metadata about your organisation — it does not process personal data of your organisation's end customers. If you upload documents containing third-party personal data, you are responsible for ensuring appropriate consent or lawful basis for that upload.

3.4 Practitioner Toolkit (practitioner-toolkit.creativecyber.in)

• Identity and authentication data: name, email address, professional credentials or certifications declared during registration
• Profile data: professional bio, area of specialisation, organisation affiliation
• Single Sign-On (SSO) / centralised identity: the Practitioner Toolkit uses Creative Cyber's centralised identity service, which may share authentication tokens across integrated platforms
• Toolkit usage data: downloads, tool interactions, assessment history within the toolkit
• Security and audit records: the IP address and browser user-agent are recorded in plain form with sign-in sessions, one-time tokens (such as invitation, verification and reset), audit-log entries and platform action records; the IP address of each vulnerability-scan agent authentication attempt is also logged
• Communication and support interactions: messages submitted to support or feedback channels

3.5 Knowledge Portal & Content Gate (creativecyber.in/knowledge)

• Registration data: professional email address, role and organisation name
• Content engagement data: which gated articles you unlock and when, together with your IP address and browser user-agent
• Access credential: once you confirm your email address, a signed token valid for 90 days is kept in your browser's local storage (not a cookie). Our server stores only a hash of that token, its expiry and the status of your access, so that it can check the token each time you open a gated article

Privacy note: on these records the IP address and user-agent are stored in plain form. See Section 10.

3.6 Data Collected Automatically (All Platforms)

• Session tokens and cookies (see Section 9 for details)
• Hashed device fingerprint components for rate-limiting and fraud prevention
• Web server access logs, which include IP addresses and requested URLs
• Application error and performance logs, kept until the log rolls over (by size, not by date); see Section 7

5.1 Service Delivery

• Creating and managing your account across our platforms
• Providing access to RiskSage assessments, DPDP Assurance compliance workflows, and Practitioner Toolkit resources
• Processing subscription plans, plan upgrades, and billing communications
• Delivering knowledge articles, reports, and newsletters you have subscribed to

5.2 Security & Platform Integrity

• Detecting and preventing unauthorised access, fraud, or abuse
• Rate-limiting requests: page-view and reaction limits use hashed identifiers; form, registration and passcode limits use the IP address, which is held in the server's memory only (it is not written to a database or to disk) and is cleared when the server restarts
• Maintaining audit trails for compliance accountability within the DPDP Assurance platform
• SSO session management for users authenticated via the Practitioner Toolkit identity service

5.3 Compliance & Legal

• Maintaining records required under applicable Indian law, including the DPDP Act, 2023
• Responding to lawful requests from regulatory authorities or law enforcement
• Exercising or defending legal rights

5.4 Product Improvement & Analytics

• Analysing aggregated and anonymised usage data to improve product features
• Measuring page performance and content engagement via custom analytics and Google Analytics 4
• Conducting user research with explicit consent of participants

5.5 Communications

• Sending transactional emails (account confirmations, password resets, plan notifications)
• Sending newsletters and product updates to subscribers who have given consent
• Responding to support and contact form queries

5.6 Content Engagement & Lead Attribution

• When you register to read gated content on our Knowledge Portal, we record which articles you view and associate this with your registered email address, role and organisation
• We use this to understand which topics are relevant to you, to prioritise follow-up from our team, and to plan future content
• This data is visible to our internal team through an access-controlled administrator interface

6.1 Service Providers (Data Processors)

We engage the following categories of service providers who process data on our behalf, subject to data processing agreements and DPDP-compliant obligations:

• Email delivery: Zoho SMTP (transactional and notification emails)
• Analytics: Google Analytics 4 (with IP anonymisation enabled; governed by your cookie consent)
• Cloud infrastructure: hosting and database providers for platform operations
• Payment processing: our payment partner for subscription billing (we retain only payment reference IDs, not full card data)

6.2 SSO & Identity Integration

The Practitioner Toolkit uses Creative Cyber's centralised identity service. When you authenticate, your identity token may be shared across linked Creative Cyber platforms to enable seamless access. This is a first-party integration; no identity data is shared with external third parties.

6.3 Legal & Regulatory Disclosure

We may disclose personal data to government authorities, regulatory bodies, or law enforcement when required by law, court order, or to protect the rights, safety, or property of Creative Cyber or others. We will notify affected users to the extent permitted by law.

6.4 Business Transfers

In the event of a merger, acquisition, or asset sale, personal data may be transferred to the successor entity, subject to equivalent privacy protections. Affected users will be notified.

13.1 DPDP Assurance — B2B Compliance Tool

DPDP Assurance is a business-to-business (B2B) compliance tool. The data you enter into the platform pertains to your organisation's compliance posture, not to end consumers. Creative Cyber acts as a Data Processor with respect to any personal data you (as a Data Fiduciary) upload or enter into the platform for compliance assessment purposes. A Data Processing Agreement (DPA) is available on request for enterprise customers.

13.2 RiskSage — Risk Assessment Data

Risk assessment results, scores, and reports generated within RiskSage are confidential to your account and are not shared with other users or organisations. Aggregated and fully anonymised benchmarking data (with no organisation-level identifiers) may be used to improve platform risk models.

13.3 Practitioner Toolkit — SSO and Identity

The Practitioner Toolkit authenticates users via Creative Cyber's centralised identity service. Your session token and identity profile may be shared across Creative Cyber platforms where you are authenticated. This is a first-party SSO integration; no identity data is shared with external third parties.

Version 2.2 (effective 19 September 2026): what changed

• Extended the IP address and browser user-agent disclosure to RiskSage, DPDP Assurance and the Practitioner Toolkit: sign-in sessions, tokens and audit logs (Sections 3.1 to 3.4 and 10)
• Added retention periods for platform audit logs, session and token records, the Practitioner Toolkit scan-agent authentication log, proxy and web-server access logs on the platform servers, and database backups (Section 7)
• Replaced the earlier "anonymised server logs, 30 days" entry, which did not describe how our logs actually work (Section 7)
• Clarification added 20 September 2026: listed the privacy-policy notice acknowledgement in the cookies and browser storage table (Section 9). It records only that you dismissed the notice; no practice changed

Version 2.1 (effective 19 September 2026): what changed

• Corrected how we describe IP address handling: our website analytics store only a salted hash, while forms, one-time passcodes, administrator security logs and the Knowledge Portal store the IP address in plain form (Sections 3.1, 3.5, 5.2 and 10)
• Added the Knowledge Portal and Content Gate, including the access token kept in your browser and what our server stores about it (Sections 2, 3.5 and 9)
• Added how we record which Knowledge Portal articles you read under your registered email, why, and that we rely on your consent for it (Sections 4 and 5.6)
• Added retention periods for web server access logs and for Knowledge Portal registration and reading records (Section 7)