Privacy Policy

How Cyber Alliance collects, uses, shares, and protects personal information when you use Sally, our AI-assisted cybersecurity platform at www.ca-sally.ai.

01Who we are & scope

Cyber Alliance Consortium, LLC, a North Carolina limited liability company ("Cyber Alliance", "we", "us") provide the Sally platform (the "Services"). This Privacy Policy explains how we handle personal information about visitors, account holders, members of customer Organizations, and people invited to collaborate on an assessment.

Controller vs. processor

For personal information about our own account holders, website visitors, and billing contacts, Cyber Alliance is the controller (in South Africa, the responsible party). For personal information contained in Customer Content that a business customer submits and controls, for example the data an Organization loads into its workspace, Cyber Alliance acts as a processor (in South Africa, an operator) on that customer's behalf, and our Data Processing Addendum governs that processing. This Policy is incorporated into our Terms of Service.

02Information we collect

Information you provide

Information collected automatically

When you use the Services we collect usage and log data such as IP address, device and browser information, pages and features used, timestamps, and security telemetry, including via cookies and similar technologies (§7).

Information from third parties

We receive limited information from our identity provider (authentication events), our payment provider (subscription status), and threat-intelligence sources (which are not intended to contain your personal information).

03How we use information

• Provide, operate, and secure the Services, including running scans and assessments and generating findings and reports;
• Power AI features (§5);
• Authenticate users, prevent fraud and abuse, and protect the security and integrity of the Services;
• Process payments and manage subscriptions;
• Communicate with you, including service messages, security and verification emails, and, where permitted, product updates;
• Provide support and respond to your requests;
• Analyse and improve the Services and develop new features;
• Comply with law and enforce our Terms.

We do not use Customer Content to build advertising profiles, and we do not sell personal information.

04Legal bases

Where the law requires a legal basis to process personal information (including under POPIA and comparable laws), we rely on: performance of a contract with you; your consent (which you may withdraw); our legitimate interests in operating, securing, and improving the Services in a way that does not override your rights; and compliance with legal obligations. Under POPIA we process personal information in accordance with its conditions for lawful processing, and special personal information only where a lawful ground applies.

05AI processing

Sally uses artificial-intelligence models, including models operated by a third-party AI provider (OpenAI), to generate chat responses, explanations, risk narratives, and reports. To provide these features, we send the content needed to generate a response or report to our AI provider, for example the chat messages you submit and, when you generate an AI-written report, the relevant scores and findings. Your Trust Score is calculated by our own scoring logic rather than by the AI provider, and we apply automated filtering designed to remove secrets and credentials before content is sent.

06How we share information

We share personal information only as described here:

• Service providers / subprocessors that help us run the Services under contract and appropriate safeguards, currently including our cloud host (AWS), identity provider (Auth0), payment processor (Stripe), AI provider (OpenAI), transactional email provider (Resend), and third-party scanning engine (Pentest-Tools).
• Within your Organization: your workspace administrators and authorized members can see data associated with your Organization, and invited collaborators' answers become part of the Organization's assessment.
• At your direction: for example when you invite someone to an assessment or generate a report to share.
• Legal & safety: where required by law or to protect rights, safety, and the security of the Services.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

07Cookies & tracking

We use cookies and similar technologies that are strictly necessary to operate the Services, for example to keep you signed in and to maintain session and security state. We do not use analytics, advertising, or other non-essential cookies. You can control cookies through your browser settings; disabling essential cookies may break sign-in and core features.

08International transfers

The Services are hosted in the United States, and we and our subprocessors may process personal information in the United States and other countries whose laws may differ from yours.

Where we transfer personal information out of South Africa, we do so on a lawful basis under section 72 of POPIA, for example your consent, because the transfer is necessary to perform our contract with you, or because the recipient is bound by adequate protections. Where EU or UK data protection law applies to a transfer, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism. More detail is available on request.

09Retention

We keep personal information for as long as your account is active and as needed to provide the Services. If you close your account or your subscription ends, we make Customer Content available for export for thirty (30) days and then delete or de-identify it within ninety (90) days after closure. We keep limited information longer where needed to comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. Billing records are kept for the period required by tax law. Copies in routine backups are overwritten on their normal cycle. We may close and delete Free tier accounts that have been inactive for twelve (12) months, after giving notice by email.

10Security

We use appropriate technical and organizational measures to protect personal information, including encryption in transit, access controls, authentication through a managed identity provider, network isolation, logging, and least-privilege access to production systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security; you are responsible for keeping your credentials safe and for the security of systems you connect to the Services.

11Your rights & choices

Subject to applicable law, you may have the right to:

• Access the personal information we hold about you and request a copy;
• Correct inaccurate or incomplete information;
• Delete personal information;
• Object to or restrict certain processing, and withdraw consent where we rely on it;
• Data portability where applicable; and
• Opt out of marketing communications at any time via the unsubscribe link or by contacting us.

To exercise a right, contact us at privacy@cyber-alliance.com. We may need to verify your identity, and we will respond within the timeframe required by law. If Cyber Alliance processes your information on behalf of a business customer (as a processor/operator), we will refer your request to that customer. Under POPIA you also have the right to lodge a complaint with the Information Regulator of South Africa; in other regions you may have the right to complain to your local supervisory authority.

12US state privacy rights

If you are a resident of a US state with a comprehensive privacy law (such as California), you may have the rights to know/access, delete, and correct personal information, to portability, and to opt out of the "sale" or "sharing" of personal information and certain profiling. We do not sell personal information and do not share it for cross-context behavioural advertising. We will not discriminate against you for exercising these rights, and you may use an authorized agent where the law allows. To exercise a right, contact us at privacy@cyber-alliance.com; we will verify your request as required.

13Children's privacy

The Services are intended for business and professional use and are not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact us and we will delete it.

14Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will post the updated Policy with a new effective date and, where appropriate, notify you in-product or by email. Your continued use of the Services after the changes take effect constitutes acceptance of the updated Policy.

15Contact us

For privacy questions or to exercise your rights, contact:

Cyber Alliance Consortium, LLC: Privacy / Information Officer
711 Six Forks Rd, Raleigh, NC 27609, USA
privacy@cyber-alliance.com · www.ca-sally.ai

South Africa: for purposes of the Protection of Personal Information Act (POPIA), our Information Officer is Larry Yon II, Co-Founder and President, who can be contacted at privacy@cyber-alliance.com.