Privacy Policy

Covers cyberdesserts.com, blog.cyberdesserts.com, and the CyberDesserts Coach service.

Who we are

CyberDesserts is a cybersecurity skills platform operated by Shakel Ahmed, an individual based in the United Kingdom trading as CyberDesserts ("we", "us"). CyberDesserts is not a registered company; the platform and its services are provided by Shakel Ahmed as a sole individual. We publish hands-on labs, career guides, and a blog to help people build practical security skills. We also operate CyberDesserts Coach ("the Service"), a career and skills coaching service that returns structured role, certification, and skills guidance to your AI environment (for example ChatGPT or Claude) through the Model Context Protocol (MCP). You can learn more about who runs CyberDesserts on our About and Shakel Ahmed pages. If you need to reach us: info@cyberdesserts.com.

What this policy covers

This policy applies to two things. First, the website and blog, which anyone can browse. Second, CyberDesserts Coach, which requires sign-in and connects to your AI client. The sections below say which one each item applies to.

What we collect on the website

It depends on what you do on the site.

If you browse the site, our third-party analytics collects which pages you visit, how you got here, how long you stay, and basic device and browser information. No account or login is required, and we do not ask for your name or email to read content.

If you take the security readiness assessment, a third-party form provider collects your responses and, if you choose to provide it, your email address for receiving results.

On every page, a third-party advertising pixel runs for conversion tracking and remarketing. The pixel provider may collect data about your visit, including your IP address and browsing behaviour on our site, to serve relevant ads across their platforms. You can opt out of ad targeting through your ad preferences or by using browser-level controls.

Blog content loads from our content management system via API. Your browser makes those requests directly, and we cache the responses in your browser's localStorage to speed things up. No personal information is stored in that cache.

What we collect in CyberDesserts Coach

Account information. When you sign in with Google or Microsoft, we receive and store your email address, the provider's user identifier, and email-verified status. We use this solely to authenticate you and associate your access with your account.

Authentication tokens. OAuth access and refresh tokens and connecting-client registrations, stored to keep your MCP connection working. Tokens are opaque secrets, used only for authentication, and can be revoked at any time.

Operational metadata. Minimal server logs for security and reliability: request timestamps, per-token request counts for rate limiting, tool names invoked, and error events. These contain no query content and no result content.

What CyberDesserts Coach does not collect or store

• We do not store the content of the coaching queries you send through the MCP connection. They are processed transiently to return guidance and are not logged or retained.
• We do not store the results returned to you.
• We do not send your queries to a third-party language model. The Service returns structured guidance to your own AI client, which performs any synthesis.
• We do not collect payment information, precise location, contacts, or device identifiers beyond what is inherent to a standard web request.

How we use it

Analytics tells us which content is useful and which is not. We use it to decide what to write more of, spot broken pages, and understand where our readers come from.

Assessment data is used to generate your score and, if you provided your email, to send you the results. We also review aggregate assessment trends, not individual responses, to improve the questions over time.

Advertising pixel data is used for measurement and to reach people who have visited the site with relevant content on the pixel provider's platforms.

CyberDesserts Coach account data and tokens are used to authenticate you, provide the Service, enforce fair-use rate limits, protect against abuse, and diagnose errors.

We do not sell your data, share it with data brokers, or use it for purposes beyond what is described here.

Cookies and local storage

We do not run a cookie consent management platform. When you dismiss the cookie notice on the site, a flag is saved in your browser's localStorage so you do not see it again. That is the extent of our cookie management.

Beyond that flag, the main tracking technologies on the site are the analytics script and the advertising pixel, both of which may set their own cookies. Your browser's built-in controls are the best way to manage these. Most browsers let you view, block, or delete cookies and restrict third-party tracking. CyberDesserts Coach authenticates through OAuth tokens rather than tracking cookies.

Legal bases (UK GDPR)

For visitors in the UK and EU, we rely on the following:

• Legitimate interests: running analytics to understand site usage, authenticating and operating CyberDesserts Coach, enforcing rate limits, maintaining security, and operating the platform.
• Consent: when you voluntarily submit assessment responses or provide your email address for results delivery.
• Contract: processing your account information and tokens as needed to provide CyberDesserts Coach, which you have signed in to use.

For advertising pixel tracking, we rely on legitimate interests for measurement. You have the right to object to this processing. See "Your rights" below.

Who processes the data

We use reputable third-party providers to host, deliver, and process parts of the website, the blog, the assessment, and CyberDesserts Coach, including hosting, storage, identity sign-in (Google or Microsoft), analytics, form handling, advertising measurement, and content management. For security and intellectual property reasons, detailed infrastructure information is not publicly disclosed. These providers act under contract and are required to handle data appropriately. Some of these services operate outside the UK and EU, in which case transfers rely on Standard Contractual Clauses or equivalent safeguards. Where required by law or a regulator, additional detail can be provided on request under a suitable confidentiality arrangement.

How long we keep it

Assessment responses are kept for up to 12 months for benchmarking purposes, then deleted or anonymised. You can ask us to delete yours sooner. Analytics data follows provider retention defaults, typically 12 to 24 months. The localStorage data in your browser stays until you clear it yourself.

For CyberDesserts Coach, account data and tokens are retained while your account is active and deleted on account deletion or token revocation. Operational logs are retained for up to 30 days, then deleted. Logs are redacted of personal information and never contain query or result content.

Your rights

Depending on where you are, you can ask us to access, correct, delete, or export your data. You can also object to processing or withdraw consent you have previously given. For CyberDesserts Coach, you can revoke access at any time by disconnecting the connector in your AI client or by contacting us to revoke your tokens. To make a request, email info@cyberdesserts.com. We action deletion requests within 30 days.

If you believe we have handled something incorrectly, you can complain to your local data protection authority (in the UK, that is the ICO).

Security

We use HTTPS across the site. Access to CyberDesserts Coach is authenticated with OAuth 2.1 and PKCE. Tokens are stored as opaque secrets on encrypted, access-controlled infrastructure and are never logged. We apply least-privilege scopes and take no destructive actions on your systems. No system is perfectly secure, but we take reasonable steps to protect what we hold.

Everything else

This site and CyberDesserts Coach are not aimed at children and are intended for adults learning and building cybersecurity skills and careers. Do not submit a child's personal information through the assessment or by email.

We may update this policy from time to time. The date at the top tells you when it last changed.