Privacy Policy

1.WHO WE ARE

Cyber Vault USA, LLC, an Oklahoma limited liability company.
1067 36th Avenue NW, Norman, Oklahoma 73072
Privacy questions: legal@cybervaultusa.com · General: info@cybervaultusa.com

We provide cybersecurity and IT support as a subscription — Overwatch (bought directly by individuals, families, and small businesses) and QRF (offered by employers to their employees). We are not an insurance company, and nothing in this policy or our services is insurance.

2.WHO THIS POLICY COVERS

This policy is incorporated into the Client Services Agreement (§14.2). Where that agreement and this policy address the same thing, they are meant to agree; if they ever do not, the Client Services Agreement controls and we will fix this document.

3.WHAT WE COLLECT

We have grouped this by why we have it, because that is more useful than an alphabetical list.

3.1 Information you give us when you enroll

Name, email address, phone number, mailing address, and — for a business membership — company name and your title. Your chosen service tier and, for QRF, your employer. Payment details for directly-billed members. Card entry and storage for billing happen in Zoho, which processes our billing. We do not intentionally retain card numbers in our case, support, or business records — and if one reaches us another way, we restrict it and remove it.

3.2 Information about the devices and accounts you ask us to protect

Device type, operating system, make and model, an identifier, and who owns it. The accounts and services you enroll for monitoring or support.

3.3 Security telemetry from protected devices (Overwatch)

Where an endpoint security agent is installed, it sends us and its vendor security telemetry — file activity, process execution, network connections, and account activity. This is how detection works. It is also, unavoidably, a detailed record of how a device is used, and we treat it accordingly.

3.4 What you tell us during a case — including the sensitive parts

This is the category that matters most. Depending on what has happened to you, a case file can contain:

• Government identifiers — Social Security number, driver’s license, passport number
• Financial account information — account and card numbers, statements, transaction records
• Credit information — credit reports, disputes, fraud alerts, freezes
• Credentials — usernames and, where you supply them, passwords and authentication details
• Communications content — the phishing email, the scam text, the message thread
• Reports and filings — police reports, FTC Identity Theft Reports, agency correspondence
• Technical evidence — logs, screenshots, malware samples, forensic artefacts

We ask for these only when the work requires them, and we tell you why at the time. If you would rather not give us something, say so — sometimes we can work around it, and sometimes we will tell you honestly that we cannot.

3.5 Records of our interactions

Case notes, ticket timestamps, chat transcripts, call and remote-session recordings (Section 6), and the log of what we provided to whom.

3.6 Information from your employer (QRF only)

Your name, work contact details, employment or eligibility status, and enrollment elections — provided by your employer so we know who is enrolled. See Section 9.

3.7 Website information

See Section 10.

We do not knowingly collect information about your race, ethnicity, religion, political opinions, health, sex life, sexual orientation, or union membership, and we do not want it. If it turns up incidentally inside evidence you send us, we treat it as part of the case file and nothing more.

4.WHY WE USE IT

Except for the limited direct marketing described in Section 9.4 — one or two emails offering Overwatch after a QRF enrollment ends — we do not use your personal information for advertising, and we do not build advertising profiles about you. We do not sell or share personal information for cross-context behavioral advertising. The only profile we build of you is the one needed to protect you.

5.SHEILA AND ARTIFICIAL INTELLIGENCE

Sheila is an AI system, not a person. She takes in your issue, gathers details, classifies it P1 through P4, and routes it. You can ask for a human at any point, and we will route one to you or provide return contact within our response timetable.

What we do with AI:

• Process your intake communications for triage, classification, routing, and quality assurance
• Use AI tooling internally to help specialists work faster

What we do not do, and will not:

• We do not use your case content, communications, or personal information to train or fine-tune general-purpose AI models.
• Our AI vendors are contractually prohibited from doing so with your data.
• Our personnel are prohibited from entering Social Security numbers, financial account numbers, passwords, or authentication credentials into any AI system, and Sheila is configured to detect and suppress them.

We may use de-identified data to improve Sheila’s own configuration — see Section 8.

6.RECORDING AND MONITORING

Calls, chats, and remote sessions may be recorded and monitored for quality assurance, training, security, and documentation. By using the service you consent to this, including in states that require every participant to consent.

One place we handle this differently: calls with people who are not you. Your consent covers you — it cannot cover your insurance adjuster, your bank’s fraud department, a credit bureau, or anyone else we speak to on your behalf, because they have not agreed to anything with us. So on any call involving such a third party, we announce recording at the start and ask everyone. If anyone objects, we turn recording off and write the call up afterwards instead.

7.REMOTE ACCESS

With your knowledge and consent at the time, our specialists connect to your devices to diagnose and fix problems. You can end any session at any moment. Sessions are logged and may be recorded.

Permission is not the same as scope. Being allowed onto a device does not make that device part of your service — what we are engaged to support is set by your agreement.

8.WHEN WE SHARE — AND WHEN WE DO NOT

8.1 We do not sell your personal information

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are used in state privacy laws. We have not done so in the past twelve months and we do not intend to start.

8.2 Service providers who help us deliver the service

We share what is necessary with vendors who work for us under written confidentiality and data-protection obligations. A current list of our vendors and what each one handles is available on request at legal@cybervaultusa.com — we keep it as a maintained inventory rather than a list buried in this document, so it stays accurate.

8.3 People you ask us to contact

Where you ask us to, and within the authorization you give, we contact banks, credit bureaus, agencies, or carriers on a matter — and only within what that authorization says.

8.4 Legal process

We may disclose information where required by law, subpoena, court order, or lawful government request. Where we are permitted to tell you, we will — but we may be unable to inform you where the request is made by a law enforcement agency in reference to an ongoing criminal investigation, and we will honor any confidentiality mandate applicable to us regarding such a disclosure requirement.

8.5 Business transfer

If the business is sold or merged, information may transfer as part of it, subject to this policy until it is superseded by one you are told about.

8.6 De-identified data

We may create and use aggregated, de-identified data for security research, threat intelligence, benchmarking, and improving the service. It will not identify you, we will not attempt to re-identify it, and it is not sold as personal information. Raw case content is never used this way in identifiable form.

8.7 Mobile opt-in data

If you give us a mobile number and consent to text messages, that number and the record of your consent are used only to send you service, incident, security, and account messages. Mobile opt-in data and consent are never shared or sold to third parties or affiliates for marketing purposes, and no mobile information is shared with third parties for their own marketing. We share a mobile number with a messaging provider only as necessary to deliver our own messages to you, under the vendor obligations in Section 8.2. Text consent is optional, is never required for any service, and may be withdrawn at any time by replying STOP — see the SMS section of our Terms of Use.

9.IF YOU ARE ENROLLED THROUGH YOUR EMPLOYER (QRF)

Read this section. It is the one people most often get wrong.

9.1 Your employer does not get to read your case

We do not tell your employer what your case is about, or that you opened one. Not the substance, not the category, not your name on a list. Your employer sees enrollment and billing information — who is enrolled, so it can be invoiced — and nothing else about your use of the service.

We may share aggregate, de-identified information with an employer (for example, how many cases were opened across the whole workforce). Never at a level that identifies you, and we will not do it at all where the numbers are small enough to make someone identifiable.

Your employer cannot require us to hand over your case details, and their agreement with us says so.

9.2 What your employer gives us

Your name, work contact details, eligibility and employment status, and enrollment elections. Your employer is responsible for having the right to give us that, and for the accuracy of it.

9.3 Roles, in legal terms

As to the enrollment and billing data your employer provides, your employer is the controller and we act on its instructions. As to what you tell us during a case, we are the controller in our own right — that information is yours and ours, not your employer’s.

9.4 When your QRF ends

Once your employer tells us — or we otherwise determine — that your enrollment has ended, we will tell you directly. Separately, we may send you one or two emails asking whether you would like to buy Overwatch personally. That offer:

• goes to an email address you gave us yourself, never to a list from your employer;
• is email only unless you separately opted in to marketing calls or texts, which is never required;
• can be stopped instantly at no cost, without affecting anything else; and
• is never reported back to your employer, who is not told whether you accepted and is not associated with the offer in any way.

10.THE WEBSITE

cybervaultusa.com collects standard technical information — IP address, browser and device type, pages viewed, referring page — and whatever you submit through a form. We use it to operate and improve the site and to respond to you.

Cookie choices default to the privacy-preserving option where a choice is offered, and we do not use advertising or cross-site tracking cookies. Most browsers let you refuse cookies; parts of the site may not work if you do.

We honor Global Privacy Control and similar browser opt-out signals as an opt-out of sale or sharing, in states where that is required — which is straightforward for us, since we do not sell or share.

11.HOW LONG WE KEEP THINGS

We keep information as long as we need it to provide the service, run the business, and meet legal obligations. We maintain a written retention schedule, applied consistently rather than case by case; the short version:

Full detail is in our Data Retention Schedule, available on request. Where a legal hold applies, we keep what the hold requires until it lifts.

12.HOW WE PROTECT IT — AND THE HONEST LIMIT

We maintain a written information security program with administrative, technical, and physical safeguards appropriate to how sensitive this information is. In practice that includes multi-factor authentication on our systems, endpoint detection on our own devices, encryption in transit and at rest, least-privilege access with quarterly review, logging, background checks, same-day offboarding, vendor security review, and security training at onboarding and annually.

We will not list a control here that we are not actually running. Our security program is written down, it names the things we have not finished yet, and we would rather you read an accurate list than an impressive one.

And the honest part: no system is impenetrable — not the U.S. government’s, not a Fortune 500 company’s, and not ours. We do not warrant that your information will never be subject to unauthorized access. If a security incident affects your information, we will investigate, remediate, and notify you as the law requires — and we would rather tell you early and imperfectly than late and polished.

13.YOUR RIGHTS

Depending on where you live, you may have the right to:

• Know what personal information we hold about you and how we use it
• Access a copy of it, in a portable format
• Correct information that is wrong
• Delete it, subject to what we must keep
• Opt out of sale, sharing, or targeted advertising — we do none of these. The one or two marketing emails described in Section 9.4 are first-party direct marketing, not any of the three — and you can stop them instantly.
• Limit the use of sensitive personal information
• Appeal if we say no
• Be free from discrimination for exercising any of these — and you will be; nothing you ask for here changes your service or its price

How to exercise them: email legal@cybervaultusa.com or write to the address in Section 1. We will verify who you are before acting — the whole business is built on not handing people’s data to strangers who ask nicely.

Timing: we respond within 45 days, and will tell you if we need a permitted extension. There is no charge unless a request is excessive or repetitive, and we will tell you before charging anything.

Authorized agents may act for you with proof of authorization. If we refuse a request, we will tell you why and how to appeal, and an appeal goes to a person who was not involved in the original decision.

A limit worth stating plainly: we may have to keep some information despite a deletion request — to complete work you asked for, to meet a legal or tax obligation, to honor a legal hold, or to defend a claim. We will tell you what we kept and why.

14.CHILDREN

Our services are not directed to children, and we do not market them to children.

We do not knowingly collect personal information directly from a child under 13 — with one exception, which we would rather state than hide: a child covered through a paid subscription. A minor can be an authorized Covered Person under an Overwatch household membership, or under a QRF Employee + Family tier an employee has elected and pays for. Where that happens we may hold information about that child — device identifiers, case information, and (Overwatch only) security telemetry from a protected device. It only happens where the child’s parent or legal guardian has signed the Covered Person Consent for them, and a child is never covered by default: someone chose, and pays for, that coverage.

A parent or legal guardian may at any time ask us what we hold about their child, ask us to delete it, and withdraw consent for us to collect more — email legal@cybervaultusa.com. Withdrawing consent removes that child as a Covered Person; it does not end the membership.

If you believe a child’s information reached us any other way, contact us and we will delete it.

15.WHERE INFORMATION IS HELD

We and our vendors process information in the United States. If that ever changes we will update this policy and tell you before it takes effect.

16.CHANGES TO THIS POLICY

We will post any change here with a new “last updated” date. For a material change we will give at least thirty (30) days’ notice to members by email before it takes effect, so nobody discovers it afterwards. Continuing to use the service after the effective date means the updated policy applies.

17.CONTACT US

If you think we have got something wrong, tell us first. We would rather fix it than have you find out through a regulator — and you can always complain to your state Attorney General regardless.

See also our Website Terms of Use, which govern use of this site.