Privacy Policy

Who this notice concerns

cybee AG, Selnaustrasse 5, 8001 Zürich, Switzerland, provides Cybee for businesses and self-employed professionals. cybee AG is responsible for the processing described in this notice (the controller), except where the notice names another company as responsible. Contact us about personal data at [email protected].

This notice concerns website visitors, people who contact us and people whose information is involved when a business uses Cybee. A business subscription can involve personal data about administrators, employees, freelancers and other authorised users.

The current service

Cybee includes a security component installed on supported Macs. Its menu-bar icon shows status, training and updates. Customers can use supported functions through Chat, IDE, CLI or Terminal. After installation and assistant connection, /cybee provides access through the connected assistant. Access from a mobile device uses that assistant; it is not a separate Cybee mobile security application.

Depending on the features used, Cybee works with:

• Device security information: security settings, checks, events, alerts and actions.
• Installed tools: software and versions, browser extensions and permissions, and startup items.
• AI tools: installed agents, configured MCP connections and recorded activity, including the tool, action, time and phase. Action details can include commands and file paths.
• Security training: assignments and completion records.
• Security records: dated findings and the scope of the devices or connected accounts assessed.

These details can relate to identifiable people. Local security checks on a Mac and information passed to connected services are distinct processing activities.

Connected assistants, alerts and payments

When you use a connected assistant, its provider processes your conversation and the information returned to it under the applicable agreement and privacy terms. Only connect services and share information you are authorised to use.

Customers can share alerts through Slack, SMS or WhatsApp. The selected destination receives the alert information sent to it. Paid subscriptions use Stripe for payment processing. These service connections are separate from the marketing website's illustrative demos.

Contacting us and using this website

When you email us, we use what you send to answer you. The legal basis is our legitimate interest in answering enquiries or, if you ask about a subscription, the steps towards that contract (Art. 6(1)(f) and (b) GDPR). We keep emails as long as we need them for your enquiry and any follow-up, and longer only where the law requires us to keep business records. Avoid sending passwords, access keys or unrelated sensitive information in an ordinary email.

If you open the chat with Ask us, cybee's support desk at support.cybee.ai receives your messages, any files you send, the page of cybee.ai you are on, your IP address and details of your browser. cybee runs the desk itself, with the Libredesk software on its own server. Answers can come from cybee's AI help, which answers only from cybee's help articles; the chat marks it as AI help. For those answers your messages are sent to an AI service that works for cybee as a processor. We use chats to answer you, on the same legal basis as emails, and keep them as long as we need them for your question and any follow-up. The cookies the chat needs are listed in the Cookie Policy.

The website remembers a few choices in your browser, such as your currency. The Cookie Policy lists them. Interactive website demos use illustrative data and do not connect to your devices.

The website is delivered through Cloudflare, Inc., which hosts it and protects it against attacks. To deliver each page, Cloudflare processes your IP address and technical details of the request, such as the address requested, your browser and the time. cybee also uses Cloudflare Web Analytics, which loads for every visitor: it counts page views and measures how fast pages load. It sets no cookies, stores nothing on your device and does not recognise you on later visits; cybee sees only totals. The legal basis is our legitimate interest in a secure website that works and in knowing how much it is used (Art. 6(1)(f) GDPR). Cloudflare, Inc. is in the United States and is certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework.

If you accept in the cookie note, the website loads the Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. It then sends Meta information about your visit: the pages you open and the page you came from, your browser and device, your IP address and the identifiers in the Meta cookies listed in the Cookie Policy. It also tells Meta when you copy the install command or send yourself the setup guide; it does not send the command or anything else you type, and Meta's automatic tracking of button clicks is off. If you enter your email address in a form on the website, such as Talk to us, the pixel also sends Meta a scrambled (hashed) version of it, so Meta can match the visit to a Meta account; Meta states that it uses it only for this matching. cybee uses this to see which of its Facebook and Instagram ads bring visitors to the website and to show its ads to people who have visited it. The legal basis is your consent (Art. 6(1)(a) GDPR; for the cookies, § 25(1) TDDDG). People who visited the website stay in cybee's ad audiences for at most 180 days.

cybee and Meta are jointly responsible for collecting this information on the website and sending it to Meta (Art. 26 GDPR). Their agreement, the Meta Controller Addendum, says that Meta handles requests to see, correct, delete, restrict or move the data Meta stores; if you write to cybee instead, we pass your request on to Meta. What Meta does with the information afterwards, including combining it with what it knows from your use of Facebook and Instagram, is Meta's own responsibility under its Privacy Policy. Meta may transfer the information to Meta Platforms, Inc. in the United States, which is certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework. You can withdraw your consent at any time under Cookie settings at the bottom of each page.

If you accept in the cookie note, the website also loads Google Analytics from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which processes this information for cybee as a processor. It then sends Google information about your visit: the pages you open, with only the campaign details from the address, such as the ad or campaign that brought you here, the page you came from (another website only by its domain), your browser, device and language, a rough location worked out from your IP address, and the identifiers in the Google Analytics cookies listed in the Cookie Policy. Google Analytics does not log or store your IP address. It also tells Google about a few actions on the website: when you copy the install command, send yourself the setup guide, open the install window or the chat, switch language, choose a billing period or a currency, follow a link to another website (only its domain) or move through the setup walkthrough. It also notes when you scroll to the end of a page, start filling in a form (not what you type), play a video, download a file or search the website. It notes which sections of a page you reach, which section a link took you to and, if you open an address that does not exist on the website, that address. It does not send the command, your email address or anything you type. cybee uses this to count visits and to see which pages and which ads help people get started. Google shows cybee totals and trends, not your name or email address. Google signals, ad personalisation and the sharing of this data for Google's own purposes are switched off. cybee keeps this data in Google Analytics for 14 months. The legal basis is your consent (Art. 6(1)(a) GDPR; for the cookies, § 25(1) TDDDG). Google LLC in the United States may also process this information. Google LLC is certified under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework, which the European Commission and the Swiss Federal Council recognise as giving adequate protection. You can withdraw your consent at any time under Cookie settings at the bottom of each page.

Your requests

You can ask cybee whether we process personal data about you, for a copy of it, and to correct or delete it. Under the GDPR you can also ask us to restrict its use or to give it to you in a common format. You can object at any time, for reasons that concern your situation, to processing based on our legitimate interest. Where you gave consent, you can withdraw it at any time; this does not affect processing before the withdrawal. Write to [email protected]. We answer within one month, or within 30 days under Swiss law. We may need information to identify you and protect other people's data. Please do not send an identity document unless it is needed and requested.

You do not have to give us personal data. Without it, we cannot answer an email or a chat. cybee does not make decisions about you based only on automated processing.

You may also complain to a data protection authority. In Switzerland, this is the Federal Data Protection and Information Commissioner. In the EU and the EEA, you can complain to the authority where you live, where you work or where you think your rights were infringed; the European Data Protection Board lists them.