AAAWgmp1bWIAAAAeanVtZGMycGEAEQAQgAAAqgA4m3EDYzJwYQAAABZcanVtYgAAAEdqdW1kYzJtYQARABCAAACqADibcQN1cm46YzJwYTo5NWFiMGJmOS01YWNlLTQyNWUtYTM1ZS0xODFjYzM3YTYxOWYAAAADl2p1bWIAAAApanVtZGMyYXMAEQAQgAAAqgA4m3EDYzJwYS5hc3NlcnRpb25zAAAAALxqdW1iAAAARGp1bWRjYm9yABEAEIAAAKoAOJtxE2MycGEuaW5ncmVkaWVudC52MwAAAAAYYzJzaCBBNy3OvSCO0Ax3GwTHk2AAAABwY2JvcqNpZGM6Zm9ybWF0bWltYWdlL3N2Zyt4bWxqaW5zdGFuY2VJRHgseG1wOmlpZDo0YWEyM2Q4MS0yNWZlLTQyMzEtYTZhMC1mODc1ZjdiNjBmOGVscmVsYXRpb25zaGlwaHBhcmVudE9mAAAB4mp1bWIAAABBanVtZGNib3IAEQAQgAAAqgA4m3ETYzJwYS5hY3Rpb25zLnYyAAAAABhjMnNoFvSFhKMcBR5BUgX3CZg/lAAAAZljYm9yomdhY3Rpb25zgqJmYWN0aW9ua2MycGEub3BlbmVkanBhcmFtZXRlcnOha2luZ3JlZGllbnRzgaJjdXJseC1zZWxmI2p1bWJmPWMycGEuYXNzZXJ0aW9ucy9jMnBhLmluZ3JlZGllbnQudjNkaGFzaFgg+60Kt1d3G2jkuEEkLiou86gKQS0aLr6ghIqd1LmN48+kZmFjdGlvbngdY29tLmFudGhyb3BpYy5jbGF1ZGUucHJvdmlkZWRqcGFyYW1ldGVyc6F4H2NvbS5hbnRocm9waWMub3JpZ2luLWNvbmZpZGVuY2VndW5rbm93bmtkZXNjcmlwdGlvbnhmQ2xhdWRlIHByb3ZpZGVkIHRoaXMgZmlsZSBhdCB0aGUgcmVxdWVzdCBvZiBhIHVzZXIgYW5kIG1heSBoYXZlIGNyZWF0ZWQgb3IgbW9kaWZpZWQgdGhlIGZpbGUgY29udGVudHMubXNvZnR3YXJlQWdlbnShZG5hbWVmQ2xhdWRlcmFsbEFjdGlvbnNJbmNsdWRlZPUAAADIanVtYgAAAEBqdW1kY2JvcgARABCAAACqADibcRNjMnBhLmhhc2guZGF0YQAAAAAYYzJzaCOKPeba7HsggBuSO8keJNoAAACAY2JvcqVjYWxnZnNoYTI1NmNwYWRNAAAAAAAAAAAAAAAAAGRoYXNoWCCElOLRdRxxpmPvPzO5kduU7p0E/1jNuRBUqdKd97ewaGRuYW1lbmp1bWJmIG1hbmlmZXN0amV4Y2x1c2lvbnOBomVzdGFydBiiZmxlbmd0aBkeBAAAAj5qdW1iAAAAJ2p1bWRjMmNsABEAEIAAAKoAOJtxA2MycGEuY2xhaW0udjIAAAACD2Nib3KlY2FsZ2ZzaGEyNTZpc2lnbmF0dXJleE1zZWxmI2p1bWJmPS9jMnBhL3VybjpjMnBhOjk1YWIwYmY5LTVhY2UtNDI1ZS1hMzVlLTE4MWNjMzdhNjE5Zi9jMnBhLnNpZ25hdHVyZWppbnN0YW5jZUlEeCx4bXA6aWlkOmRhOTUwMDdjLTJkYmQtNDgyZC05MTQ0LThjNjBhMzE3OTRkYXJjcmVhdGVkX2Fzc2VydGlvbnODomN1cmx4LXNlbGYjanVtYmY9YzJwYS5hc3NlcnRpb25zL2MycGEuaW5ncmVkaWVudC52M2RoYXNoWCD7rQq3V3cbaOS4QSQuKi7zqApBLRouvqCEip3UuY3jz6JjdXJseCpzZWxmI2p1bWJmPWMycGEuYXNzZXJ0aW9ucy9jMnBhLmFjdGlvbnMudjJkaGFzaFgg2pQVhyy1Uh+P16aOo/DGk6/qr4bZUrMpuzjQhG9Nw46iY3VybHgpc2VsZiNqdW1iZj1jMnBhLmFzc2VydGlvbnMvYzJwYS5oYXNoLmRhdGFkaGFzaFggc90DQUlMVRBmzUoTjLhLFv5YWv+MQJ/xSu7/Zp1yYet0Y2xhaW1fZ2VuZXJhdG9yX2luZm+jZG5hbWVvQW50aHJvcGljIEZpbGVzZ3ZlcnNpb25lMS4wLjBrc3BlY1ZlcnNpb25lMi40LjAAABA4anVtYgAAAChqdW1kYzJjcwARABCAAACqADibcQNjMnBhLnNpZ25hdHVyZQAAABAIY2JvctKEWQISogEmGCFZAgowggIGMIIBjaADAgECAhRA5aAK7sI50L64g/oGQgU9Z1UTADAKBggqhkjOPQQDAzBJMRcwFQYDVQQKEw5BbnRocm9waWMsIFBCQzEuMCwGA1UEAxMlQW50aHJvcGljIENvbnRlbnQgQ3JlZGVudGlhbHMgUm9vdCBDQTAeFw0yNjA4MDcxODQzNTZaFw0yODA4MDYxOTQzNTZaMEQxFzAVBgNVBAoTDkFudGhyb3BpYywgUEJDMSkwJwYDVQQDEyBBbnRocm9waWMgQ2xhdWRlIENvbnRlbnQgU2lnbmluZzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABJh6CmvLUBgFFNU0vUKlOVtE6djd17L5SuwX0LemFisBM3dkd/3cyjxFA3Qo5S46fX0/ihY0VZ7mfb9KF703t5OjWDBWMA4GA1UdDwEB/wQEAwIHgDAVBgNVHSUEDjAMBgorBgEEAYPoXgIBMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUzlHiBIFOZFsj+OPEz5o+nMHXXMIwCgYIKoZIzj0EAwMDZwAwZAIwMXMdFJ4BetLLVY7ORuE9noqbbAZOZn/aArXyTwFAZfKrPzxF2vPoJNf1+UCdg1XGAjBwX1zd9WGqYkqmL5SFqw1QySjr1zJfpJM9+1rdDwSPLMOPOjKuiXjoU/pUUeG9RwmhY3BhZFkNngAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPZYQN/edWY65+NPizmdDE9TSepWAGvavq+jNzjmO8m5kZQTzq/Wu0Lh9aONNk/7skKUtxzoRC0GQPqhaBEZy30MYnc=
Talk to us

Legal

Privacy Policy

Effective Date and Last Updated: October 14, 2026

1. Introduction

Cybervision Systems LLC ("we," "our," or "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our products and the related websites, web panels, browser extensions, and mobile applications (collectively, the "Services"):

  • CyberVault — password manager: web panel, browser extensions for Google Chrome, Microsoft Edge, and Apple Safari, and apps for iOS and Android, in personal and business editions
  • Tremor (Tremor by CyberVision) — platform for decision-making exercises under pressure (tabletop exercises), such as cyber crises: web portal and participant app for iOS and Android
  • CyberKey — privileged access management: web panel, Chrome extension, and components installed in the customer's environment

When you use the Services through an organization (for example, your employer), that organization is the controller: it decides how the Services are used and is responsible for the personal data it manages through them, including having a legal basis to include you and informing you. We act as its processor (service provider), and process that data on its behalf and under its instructions. For the CyberVault personal edition and our websites, we are the controller for the processing described here.

Company Name: Cybervision Systems LLC
Address: 2122 NW 158th Ln, Pembroke Pines, Florida 33028, United States
Email: [email protected]
Phone: +1 (754) 337-5155
Data Protection Officer: see Section 14

2. Information We Collect

2.1 Information You Provide

  • Account information (name, email address)
  • Profile and organization information (role, groups, team)
  • Billing information for paid plans
  • Communications with customer support
  • Content you create in the Services, such as vault items (see Section 10.1), and your responses, decisions, and crisis room messages in Tremor exercises

2.2 Automatically Collected Information

  • Device information (model, operating system, unique identifiers)
  • Usage data (features used, interactions)
  • Log data (IP address, browser type, access times)
  • Technical error reports generated by the platform (for diagnostics and support)
  • Cookies and browser local storage strictly necessary to keep you signed in and to remember preferences such as language. The web panels and the Tremor portal store your session and language in your browser. We do not use advertising or cross-site tracking cookies.

2.3 Browser Extension Data

  • Browser version and settings
  • Extension interaction data
  • The address of the page you are on, used to suggest and fill matching credentials

2.4 Mobile Application Data

  • Mobile device identifiers and push notification tokens
  • Camera (CyberVault): used exclusively to scan two-factor authentication (2FA) QR codes when you add an authenticator entry. We do not access your photo library, and camera frames are processed on-device and are never uploaded or stored.
  • Biometrics (CyberVault and Tremor): optional Face ID, Touch ID, or fingerprint unlock is handled by your device's operating system. We never receive your biometric data.
  • Microphone (Tremor): used only during exercise calls (see Section 2.6).

Our mobile applications do not show ads, do not track you across apps or websites owned by other companies, and do not sell your data. Data is encrypted in transit.

2.5 Location (CyberVault business edition)

We do not track your location. If your organization restricts certain vault items to approved locations, your browser or device asks for your location at the moment you open one of those items; it is used only to check that you are within the approved area. In addition, the security audit log records the IP address and the approximate location (country and city) derived from it for sign-in and item-view events.

2.6 Tremor Exercises, Calls, and AI

In a Tremor exercise, we process the following data on behalf of your organization:

  • Your name, email address, team, command level, and roles in the crisis (for example, strategic or legal)
  • Your responses, decisions, and crisis room messages, and your activity in the exercise (such as what you read and when you answered)
  • Call transcripts
  • Facilitator notes
  • Scores and evaluations of your responses

Exercise calls are voice conversations with characters generated by artificial intelligence. During a call, the audio passes through our own voice server and through our transcription provider to be converted into text; the audio is not recorded or stored. What is kept is the text transcript. The character's replies are generated by AI and spoken with a synthetic voice chosen from a catalog; we do not clone the voices of real people. This information is made available to your organization and to the exercise facilitator. AI is also used to create scenarios, grade responses, and draft reports (see Section 3.1).

Your organization may choose to send the Tremor audit log to its own security monitoring system (SIEM). That choice and that copy are under your organization's control.

2.7 CyberKey Sessions

CyberKey runs in a dedicated deployment for each customer, on-premises or in the cloud, with its own database. It records privileged sessions (screen activity, commands, and related events), connection details, and audit events. These recordings and logs are stored in the customer's deployment, on disk or in a storage bucket chosen by the customer, and are retained according to the customer's settings.

3. How We Use Your Information

  • Providing and maintaining our Services
  • Processing transactions and sending related information
  • Sending administrative information, updates, and security alerts
  • Responding to customer service requests
  • Improving the Services
  • Monitoring and analyzing usage and trends
  • Detecting, preventing, and addressing technical issues, fraud, and unauthorized access
  • Complying with legal obligations

We do not use your data for advertising, and we do not use the content of your vault items, exercise responses, or session recordings to train AI models.

3.1 AI Grading and Automated Decisions (Tremor)

Tremor uses AI to suggest scores and evaluations of exercise responses and to draft reports. These outputs are training feedback: they are reviewed by a person (the facilitator or your organization) and do not, by themselves, produce legal effects or similarly significant effects on you. You may ask for a human review of any score or evaluation and present your point of view, as provided for in laws such as the LGPD (art. 20) and the GDPR (art. 22). Send your request to your organization or to [email protected].

4. Legal Basis for Processing

Where data protection laws such as the GDPR (European Economic Area) or the LGPD (Brazil) apply, we process personal data based on:

  • Consent: You have given clear consent for processing
  • Contract: Processing is necessary for contract performance
  • Legal Obligation: Processing is required by law
  • Legitimate Interests: Processing is in our legitimate business interests, such as keeping the Services secure

When we act as a processor for an organization, the legal basis is defined by that organization.

5. Data Sharing and Disclosure

5.1 Service Providers — Third-party vendors who perform services on our behalf, under contract and only for that purpose. The current list is in Section 11. In particular:

  • AI providers used by Tremor: OpenAI performs speech-to-text transcription and the synthetic voice; Anthropic or OpenAI, depending on the platform configuration, generates the character's conversation, the scenarios, the grading, and the reports. Before an AI report is generated, participants are pseudonymized (for example, "Team 1" or "Legal 2") and their names are removed. Our agreements with these providers do not allow them to use this data to train their models.
  • Have I Been Pwned, used by CyberVault breach checks: for passwords, only the first characters of a hash of the password are sent (k-anonymity), never the password itself; for the email breach check, the email address you choose to check is sent.

5.2 Your Organization — If you use the Services through an organization, its administrators can see information about your use as described in Sections 2 and 10, such as audit logs, exercise responses, and session recordings.

5.3 Business Transfers — In connection with mergers, acquisitions, or asset sales

5.4 Legal Requirements — When required by law or to protect our rights, property, or safety

5.5 With Your Consent — When you have given explicit permission

We do NOT sell your personal data to third parties.

6. International Data Transfers

Cybervision Systems LLC is based in the United States. Tremor data is stored in the hosting region of the customer's country; one region may serve several Latin American countries when the customer agrees. When AI features are used, the data needed for them is sent to our AI providers (Anthropic and OpenAI) in the United States, which is an international transfer. Some other providers listed in Section 11 may also process data outside your country.

We make these transfers using the mechanisms required by each applicable law, including:

  • Brazil (LGPD, art. 33): standard contractual clauses approved by the ANPD
  • European Economic Area (GDPR): the European Commission's standard contractual clauses
  • Canada: under PIPEDA, contractual protections that give a comparable level of protection; under Québec's Law 25, a privacy impact assessment before the data is communicated outside Québec
  • Argentina, Colombia, Peru, Chile, and Mexico: contracts with the recipients that provide the safeguards required by each country's law, and, where required, the corresponding notice or consent

You may request more information about these safeguards at [email protected].

7. Data Retention

We retain your personal information only as long as necessary for the purposes outlined in this Privacy Policy, unless a longer retention period is required by law.

  • Accounts: account data is retained while your account is active.
  • CyberVault security logs: sign-in events are kept for 6 months.
  • Tremor exercises: exercise content, individual responses, call transcripts, facilitator notes, scores, and the audit log are kept for 24 months after the exercise ends by default, or for the period set by your organization (1 to 120 months). After that, only a report without names is kept.
  • Tremor call audio: not recorded or stored.
  • Push notification tokens: deleted when you sign out of the app or delete your account.
  • End of a customer contract: when an organization cancels, its data is deleted within 30 days. During that period, the organization may export its data or withdraw the cancellation.
  • CyberKey: recordings and logs are retained according to the customer's settings in its own deployment.

8. Your Privacy Rights

Depending on your location, you may have the following rights. To exercise them, contact us at [email protected]. If you use the Services through an organization, we may refer your request to that organization, which is the controller, and help it respond.

8.1 General Rights

  • Access: Request copies of your personal data
  • Correction: Request correction of inaccurate data
  • Deletion: Request deletion of your data
  • Data Portability: Receive your data in a structured format
  • Objection: Object to processing of your data
  • Restriction: Request restriction of processing
  • Human review of decisions made solely by automated means (see Section 3.1)

8.2 United States

  • California residents (CCPA/CPRA): right to know what personal information is collected, right to know if personal information is sold or shared, right to opt-out of sale/sharing, and right to non-discrimination. We do not sell or share personal information for cross-context behavioral advertising.
  • Residents of other states with comprehensive privacy laws may have similar rights to access, correct, delete, and obtain a copy of their data, and to appeal our decision on a request. Contact us to exercise them.

8.3 European Economic Area (GDPR)

  • Right to lodge a complaint with a supervisory authority
  • Right to withdraw consent at any time

8.4 Brazil (LGPD)

  • Right to confirmation of processing, access, correction, anonymization, portability, and deletion
  • Right to information about the entities with which data is shared
  • Right to review of automated decisions (art. 20)
  • Right to lodge a complaint with the National Data Protection Authority (ANPD)

8.5 Canada (PIPEDA and Québec Law 25)

  • Right to access and correct your personal information and to withdraw consent, subject to legal or contractual restrictions
  • Right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC)
  • In Québec: rights of access, rectification, de-indexation, and portability, the right to be informed of a decision based exclusively on automated processing, and the right to file a complaint with the Commission d'accès à l'information du Québec (CAI)

8.6 Mexico (LFPDPPP)

  • ARCO rights: access, rectification, cancellation, and opposition, and the right to revoke consent and limit use or disclosure
  • Right to file a complaint with the competent data protection authority

8.7 Colombia (Law 1581 of 2012)

  • Habeas data rights: to know, update, rectify, and request deletion of your data, to request proof of authorization, and to revoke authorization
  • Right to file a complaint with the Superintendence of Industry and Commerce (SIC)

8.8 Chile (Law 19.628 and Law 21.719)

  • Rights of access, rectification, deletion, and opposition, and, from December 1, 2026 under Law 21.719, portability and blocking
  • From that date, the right to file a complaint with the Agencia de Protección de Datos Personales

8.9 Argentina (Law 25.326)

  • Rights of access, rectification, updating, and deletion
  • The data subject has the right to access their personal data free of charge at intervals of no less than six months, unless a legitimate interest is shown, as provided in Article 14, paragraph 3 of Law No. 25.326.
  • The Agency for Access to Public Information (AAIP), as the Supervisory Authority of Law No. 25.326, has the power to hear complaints and claims filed by those whose rights are affected by non-compliance with the rules in force on personal data protection.

8.10 Peru (Law 29733)

  • ARCO rights: access, rectification, cancellation, and opposition, under Law 29733 and its regulation (Supreme Decree 016-2024-JUS)
  • Right to file a complaint with the National Authority for Personal Data Protection (ANPD) of Peru

9. Deleting Your Account

You can delete your account at any time, without the app if you prefer:

  • Tremor: in the app, go to Profile → Delete account; on the web portal, go to My account → Delete account.
  • CyberVault: on the web panel, go to My profile → Delete account and confirm with your master password. The browser extensions and apps link to this page.
  • CyberKey: accounts are managed by your organization; contact its administrator.
  • By email (all products): write to [email protected] from the email address registered to your account, with the subject line "Account Deletion Request". We confirm by email once it is completed.

Deletion through the web panel, portal, or app is immediate and cannot be undone. If you are the only administrator or the owner of an organization that still has other members, you must transfer that role first.

9.1 What is deleted

  • Tremor: in every organization where you confirmed the same email address, your name, email address, password, second factor, push notification tokens, and the texts you wrote (responses and crisis room messages).
  • CyberVault: your personal vault items and their history, your organization and group memberships, pending invitations, sessions, and recovery tokens. Your account record is anonymized: your name, email address, keys, two-factor settings, and recovery key are removed.

9.2 What is kept

  • Tremor: scores, choices, and audit records remain without your name, as part of your organization's exercise records, until the end of the retention period in Section 7.
  • CyberVault: items that belong to an organization remain with that organization. Security audit log entries of sign-ins are kept for 6 months and then purged. This metadata never includes the decrypted contents of your vault items, which we have no technical ability to access.

10. Data Security

We implement appropriate technical and organizational security measures to protect your data, including:

  • Encryption of data in transit and at rest
  • Regular security assessments
  • Access controls and authentication, including multi-factor authentication
  • Audit logs of security-relevant events
  • Support access to Tremor exercise content only with the authorization of your organization's administrator, for a limited time, and recorded in the audit log

However, no method of transmission over the Internet is 100% secure.

10.1 CyberVault — Zero-Knowledge, End-to-End Encryption

The CyberVault password manager is designed on a zero-knowledge architecture. The passwords and two-factor authentication secrets stored in your vault are encrypted and decrypted exclusively on your own device, using AES-256-GCM with a unique key for each item, protected by a key derived from your master password. Your master password never leaves your device and is never transmitted to or stored on our servers. We store only the resulting ciphertext and have no technical ability to read or decrypt your passwords or 2FA secrets.

To make search, autofill, and breach checks possible, the name of each item, the website address, and the username are stored on our servers without end-to-end encryption. They are protected by encryption in transit and at rest and by our access controls, but they are not part of the zero-knowledge encryption described above.

When you create your account, a recovery key is generated. It is the only way to regain access if you forget your master password. If you lose both your master password and your recovery key, your encrypted vault items cannot be recovered by you or by us.

10.2 Audit Logging (CyberVault)

To help you and your organization administrators detect unauthorized access, CyberVault keeps a security audit log of sign-in events and item-view events (a record that an item was accessed, identified by item ID, timestamp, IP address, approximate location, and device type, not its decrypted contents). This metadata is retained for security and compliance purposes and is never used to reconstruct the encrypted content of your vault items.

11. Subprocessors

These are the providers that process personal data on our behalf. We update this list whenever it changes.

  • Hosting: our own servers, in the hosting region of the customer's country (Tremor), and infrastructure providers for the other Services
  • Email delivery: Microsoft 365 (Microsoft Corporation)
  • Push notifications: Google Firebase Cloud Messaging (Google LLC) and Apple Push Notification service (Apple Inc.)
  • Artificial intelligence (Tremor): Anthropic, PBC and OpenAI, L.L.C., United States (see Section 5.1)
  • Payment processing: payment processors for paid plans contracted directly with us

12. Children's Privacy

Our Services are intended for adults and businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

13. Changes to This Policy

We may update this Privacy Policy. When we make material changes, we will update the date at the top and notify you through the Services or by email. The date at the top is the date the current version took effect.

  • October 14, 2026: Tremor description, Tremor data and retention, international transfers, named AI providers, subprocessors, automated decisions, rights by country, Data Protection Officer, and a public account deletion section.
  • January 20, 2026: first version.

14. Data Protection Officer

Our Data Protection Officer is also our Encarregado under Brazil's LGPD and the person in charge of the protection of personal information under Québec's Law 25. You can reach this person at [email protected].

15. Contact Us

For questions, concerns, or to exercise your privacy rights, contact us:
Cybervision Systems LLC
2122 NW 158th Ln
Pembroke Pines, Florida 33028
United States
Email: [email protected]
Phone: +1 (754) 337-5155