Privacy

Who operates this website

Atlant Security EOOD operates Cybersecuritycompanies.io. Contact us using the details below for privacy and personal-data enquiries.

What we store

• Account email, role, and optional company ownership after a domain-matched claim
• Magic-link hashes that expire in 15 minutes
• Newsletter email + confirm timestamp (double opt-in)
• Reviews and community nominations you publish (and a retraction timestamp if you remove them)
• Limited daily profile-view and outbound-click counters per company, as described below. These are incomplete measurements, not a record of every visit.
• Prepaid advertising credit, eligible click charges, refunds and campaign delivery records, plus historical campaign and job apply counts.
• Stripe event ids so webhooks are not applied twice. We never see card numbers
• Public company lookup and submission limits use a keyed hash of the connection IP and attempt times. The hash changes each UTC day; the budget store is scheduled for deletion after the daily reset. This budget store does not retain the raw IP, submitted email or form contents.
• Listing submission receipts retain a hashed form key and keyed content fingerprint alongside the listing. They prevent duplicate saves after interrupted responses, contain no copy of the email or submitted text, and are removed if the listing is deleted.

What we do not do

• No advertising pixels or session replay. Google Analytics is used for public site measurement, with advertising personalization and Google signals disabled in our tag.
• No selling of emails or reviews
• No client-side database SDK

Google Analytics

We use Google Analytics 4 to understand visits to our public pages and improve the site. Google processes page and browser information and may set first-party cookies to distinguish visits and sessions. This measurement is separate from the directory’s company-level traffic counters below.

Our tag is excluded from sign-in, claim, account and administration pages. We strip query strings and fragments from the page address and referring address we configure, and do not configure account identifiers, email addresses or form contents as analytics data. Personal job-roast results use a generic analytics page title.

We do not initialize this tag when your browser sends Do Not Track or Global Privacy Control. You can also block analytics through your browser settings or use Google’s Analytics opt-out browser add-on. See how Google uses information from sites that use its services.

Limited first-party traffic measurement

Our first-party aggregate pilot counts a limited subset of profile views, directory outbound links, and included Featured promotion views and visits. It respects Do Not Track and Global Privacy Control, uses no analytics cookies or browser storage, and sends no traffic data to advertising providers. A keyed connection hash changes each UTC day to suppress duplicate events and limit requests. It is pseudonymous, not an identification of a unique person; shared connections can undercount activity. Raw IP addresses, user agents, account identities and page query strings are not stored by this collector.

Operators can pause collection without removing existing reports. The private stop control retains its current setting and the last ten changes, including the operator account ID, time and reason. These records remain after traffic totals expire so an operational pause is not accidentally removed.

Connection hashes are scheduled for removal at the next UTC daily reset. Daily company and promotion totals and collection-capacity summaries are retained for 90 calendar days. The first event of a new day also removes overdue records before collection continues. Cleanup can be delayed during a storage outage. Reports clearly disclose missing and capped measurements; these counters do not determine advertising charges. Cloudflare processes request metadata to deliver the site independently of this optional collector.

Sponsored delivery pilot

If enabled, sponsored cards use a separate daily keyed connection hash for request limits and duplicate-click protection. Short-lived card reservations expire within two minutes. Their daily admission records and connection hashes are scheduled for removal after the UTC reset; outages can delay cleanup. No raw IP, user agent, account email or browser identifier is stored in this admission store. Do Not Track and Global Privacy Control prevent card requests and charge admission.

Financial ledger records retain the campaign, placement, date, amount and a keyed duplicate-click reference for reconciliation. These references are pseudonymous and are not a count of unique people or qualified leads. Advertisers see their campaign transactions, not raw connection data. Charge authorization expires within two minutes; the signed link can still open the company profile without charging for up to seven days. It cannot grant access to your account. Advertiser websites apply their own privacy policies.

Private delivery review receipts retain each admitted attempt's campaign, placement, time, keyed duplicate-charge reference and acknowledgement for seven UTC dates, including today. They survive daily admission-counter cleanup so operators can investigate missing or uncertain acknowledgements against the financial ledger. These receipts can be incomplete and do not replace financial records; they contain no raw IP, user agent or account email. Cleanup failures can delay removal. The separate operator stop control retains its current setting and latest 20 changes, including the acting account ID, time and operational reason. These private control records survive the daily reset so a pause stays in place.

Company enquiries

When you request a demo or contact a company through its directory inbox, we store your account email, name, organization, message, chosen recipient, consent and conversation history. We share these details only with the receiving company account after you explicitly agree. Administrators can access requests for support and abuse review. This does not subscribe you to marketing.

You can withdraw a request from your dashboard to stop further company access and replies through the directory. Withdrawal cannot recall details the company already copied or exported. If company ownership changes, the new owner does not inherit these private conversations. This workflow does not send email notifications.

Processors

Cloudflare (hosting, D1, Turnstile). Stripe (payments). Resend (transactional mail) when configured.

Company website lookup may send public website content to xAI to suggest listing details. Existing directory entries are loaded from our catalog without another external lookup. You can enter the details manually instead; the final submission saves the fields you reviewed without a further website lookup.

LinkedIn and AI Danger Score

Optional LinkedIn sign-in retrieves your app-specific member ID, name and profile photo. We keep these in an encrypted, HTTP-only cookie for 30 minutes. Disconnecting clears this cookie. This connection does not create a site account, request your email or grant posting access, and its access token is discarded after retrieving your profile.

You can choose to include your LinkedIn name and photo when generating a roast. Your submitted public profile link and career information are used to generate the roast with xAI. The resulting score, name, photo, profile link and roast are stored and available at a public result URL. Your app-specific LinkedIn member ID is not included in that result. Sharing opens the platform’s composer; we do not request posting permission or publish on your behalf.

Company roasts

A submitted website is reduced to its public homepage. We send public page text to MiniMax to write a satirical company roast. Meme images combine that text with reusable artwork prepared in advance; new roasts do not request custom image generation. Older illustrated results may contain custom artwork previously generated by MiniMax, and earlier results may use xAI text. We store the company name, website, description, roast and short source quotations at a public result URL, with generated share images. The submission does not create or change a directory listing. You choose whether to share the result; LinkedIn, Facebook and X apply their own policies when you open their composers.

Company memes store up to three jokes and portrait and square PNG images in Cloudflare storage. Each meme has a public permanent link; a remix creates a new result and records the original meme link. Previously created custom illustrations also retain their original meme link. Copy-image and copy-caption actions write only the content you choose to your clipboard. Native sharing passes the PNG and, where supported, the caption to your device’s share menu. Desktop platform buttons copy the PNG and open the selected social website, with a caption in the composer URL where supported. You paste, review and publish the post. We do not request social posting permissions or publish automatically. Use the report link on a meme to request review or removal; removing a result also removes its stored images, but cannot recall downloaded, reposted or separately generated derivative copies.

Retention and deletion

Retract a review or nomination from the company page. Email contact to delete an account or listing you own. Magic links are single-use.

Terms