We collect only the data we need to answer you and do the work. We do not sell it, do not use it for advertising and do not track you on the site.
1. Who is responsible for your data
The controller of your personal data is Individual entrepreneur (FOP) Vadym Lohai (brand OpenCyberAI), Ukraine, Horonda, Mukachevo district, Zakarpattia region. For any data questions, write to aicyber@opencyberai.site.
This policy explains what data we process on opencyberai.site and when providing our services, why and on what legal basis, who we share it with and what your rights are. It follows the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Law of Ukraine “On Personal Data Protection”.
2. What data we process and why
2.1. Requests sent through the site form
- Data: name; phone and/or e-mail or Telegram; task description, selected services and budget; the language and page the request was sent from; the time it was sent. We do not store your IP address — only an irreversible hash of it, to filter spam.
- Purpose: to answer your request, prepare a proposal and protect the form from abuse.
- Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR); spam protection is our legitimate interest (Art. 6(1)(f) GDPR).
- Retention: 12 months from receipt, after which the request is deleted automatically. If we sign a contract, the data it needs is kept as described in section 2.3.
2.2. Correspondence
When you e-mail, call or message us, we process your contact details and the content of your messages to reply and run the project. Legal basis and retention are the same as for requests or contracts.
2.3. Clients: contract, invoicing and accounting
- Data: name or company name, contact details, details needed for documents (tax ID, address, IBAN), payment data (amount, date, method).
- Purpose: to conclude and perform the contract, issue invoices and certificates, and keep accounting and tax records.
- Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and legal obligations (Art. 6(1)(c) GDPR).
- Retention: for the term of the contract and afterwards for the record-keeping periods required by Ukrainian law (usually at least 3 years) and the limitation period for claims.
2.4. Payments
Card payments are processed by LiqPay (JSC CB PrivatBank) as an independent controller. We receive only the payment status, amount, date and possibly masked card digits. We never receive or store the card number, expiry date or CVV.
2.5. Free SEO and speed check
We process the website address you enter and your IP address, the latter only to limit the number of requests. IP addresses are kept only in the server's memory for no more than 1 hour; check results are not linked to you and not stored. For the speed check we send Google (PageSpeed Insights) only the website address, none of your data. Legal basis: providing the service you asked for and our legitimate interest in preventing abuse (Art. 6(1)(b) and (f) GDPR).
2.6. Server logs
Like any web server, ours records the IP address, date and time, requested address, browser (user agent) and response code. We need this for security, attack protection and troubleshooting (legitimate interest, Art. 6(1)(f) GDPR). Logs rotate automatically and no more than five archives are kept, so entries are usually deleted within a month and in any case within 90 days.
2.7. Cloudflare network
The site is delivered through Cloudflare's network, which processes the IP address and technical data of each request to deliver pages quickly and stop attacks (legitimate interest, Art. 6(1)(f) GDPR).
2.8. Request notifications
To reply quickly, we forward the text of your request to the owner's Telegram account. If you prefer we don't, e-mail us instead of using the form.
3. Cookies and local storage
We do not use advertising, analytics or tracking cookies. Your browser only remembers your chosen language and interface state. See our Cookie policy.
The widget that shows technical details of your device (screen, time zone, network type) computes them in your browser and does not send them anywhere.
4. Who we share data with
- Hostinger International Ltd. (Cyprus, EU) — the site's server in a data centre in Germany, and business e-mail.
- Cloudflare, Inc. (USA) — DNS, content delivery and attack protection.
- Telegram (Telegram FZ-LLC, UAE) — internal notifications about new requests.
- Google LLC (USA) — only the website address you check with PageSpeed Insights; no personal data of yours.
- JSC CB PrivatBank (LiqPay payment service) and the bank that issued your card — when you pay; they act as independent controllers under their own terms.
- Accountants and public authorities — only to the extent required by law.
We do not sell personal data or share it for advertising.
5. Transfers outside the EU
We operate from Ukraine, while the site's server and e-mail are hosted in the EU. Data is transferred outside the European Economic Area:
- to the USA (Cloudflare) — under the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses;
- to the UAE (Telegram) — because this is necessary for steps taken at your request before entering into a contract (Art. 49(1)(b) GDPR).
6. How long we keep data
- Requests sent through the form — 12 months, then deleted automatically.
- Client data and documents — for the term of the contract and the periods required by Ukrainian law (usually at least 3 years).
- IP addresses for rate limiting — up to 1 hour, in memory only.
- Server logs — usually up to a month, never more than 90 days.
When the period ends, we delete or anonymise the data.
7. Your rights
Under the GDPR and Article 8 of the Law of Ukraine “On Personal Data Protection” you have the right to:
- know what data we process about you and get a copy;
- have inaccurate data corrected;
- have your data erased;
- restrict processing;
- receive your data in a machine-readable format and transfer it to another controller;
- object to processing based on legitimate interest;
- withdraw consent where processing is based on it (this does not affect processing before withdrawal);
- lodge a complaint with a data protection authority: in Ukraine, the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua); in the EU, the supervisory authority of the country where you live or work.
To exercise your rights, write to aicyber@opencyberai.site. We reply free of charge within 30 days and may ask you to confirm your identity.
8. Do you have to give us data?
To answer a request we need your name and at least one way to reach you: phone, e-mail or Telegram. Other fields are optional. To conclude a contract and issue documents we need the details required by law.
9. Automated decisions
We do not make decisions about you based solely on automated processing and do not profile you (Art. 22 GDPR).
10. How we protect data
- HTTPS only, with HSTS and strict security headers.
- Server in an EU data centre; only the owner has access to the data.
- Request files are readable only by the server's service account.
- IP addresses in requests are stored only as an irreversible hash.
- The site's fonts and libraries are served from our own server, with no calls to third-party CDNs.
If a breach occurs that puts you at risk, we will notify the supervisory authority and you within the time limits set by law.
11. Children
Our services are not intended for anyone under 16. We do not knowingly collect their data.
12. Changes to this policy
We publish new versions on this page with the date. We will notify clients of significant changes by e-mail.