Privacy Policy
Effective date: October 30, 2026
1. Who we are and what this policy covers
This Privacy Policy explains how Cyberbricks LLC, a US limited liability company, handles personal information collected through the website at cyberbricks.ai and through email sent to info@cyberbricks.ai. In this policy we call the website the “Site”, and “we”, “us” and “our” mean Cyberbricks LLC.
For the purposes of the EU General Data Protection Regulation and the UK GDPR, Cyberbricks LLC is the controller of the personal information described here.
This policy does not cover information we handle while delivering services to a client. The agreement we sign with that client governs that information.
2. The short version
- We collect what you send us through the “Start a build” form or by email, and we use it to reply to you and follow up about a possible engagement.
- Our web analytics are cookieless and aggregate.
- We do not sell or share personal information, we do not run targeted advertising, and we do not profile you.
- We keep contact form submissions for 24 months after you send them, then delete them at the next automatic clean-up. We delete them sooner if you ask.
- You can ask to access, correct or delete your information by emailing info@cyberbricks.ai.
3. Information we collect
3.1 The “Start a build” form
When you submit the “Start a build” form (on the home page or at /contact/), we collect:
| Field | Required |
|---|---|
| Name | Yes |
| Work email | Yes |
| Company | No |
| Message | No |
| The challenges you select from the list | No |
We store submissions in Cloudflare D1, a database that runs in Cloudflare’s infrastructure. Only our staff can access it.
The form also contains a hidden field that people do not see but automated spam bots tend to fill in. We use it to filter out spam. It does not collect any information about you.
With each submission we also record the date and time it arrived and which page you used (the home page or the contact page).
3.2 IP address for abuse prevention
When you submit the form, we use your IP address at that moment to limit how many submissions can come from one source. We do not store the IP address itself in our database. We store a keyed one-way hash of it (for IPv6, of the network prefix) alongside your submission. We treat that hash as personal data. Once it is more than 30 days old, we clear it at the next automatic clean-up, which runs each time someone submits the form and each time we review submissions.
Our hosting provider’s request logs may briefly include your IP address as part of delivering the Site (see 3.3); we have turned off the detailed request logs for the form.
3.3 Hosting and security data
Cloudflare hosts and delivers the Site. To deliver pages and protect the Site from attacks, Cloudflare processes your IP address, your browser’s user agent string and the URL you request. If a page fails to load because of a network error, your browser may send Cloudflare a short technical error report (Network Error Logging); successful visits are not reported. Cloudflare may set strictly necessary security cookies, for example to tell normal visitors apart from malicious traffic.
3.4 Web analytics
We use Cloudflare Web Analytics to understand how the Site is used. It gives us aggregate figures on page views, referring websites, browser and device type, country and page performance. Cloudflare states that Web Analytics does not use cookies or local storage, and does not fingerprint visitors or track them across sites. We see totals and trends, not profiles of individual visitors.
3.5 Your theme preference
If you switch between the light and dark themes, your browser saves that choice in local storage under the key cb-theme. It holds only the theme setting, stays on your device and is never sent to us. You can remove it by clearing your browser’s site data.
3.6 Interactive demos
The sandbox, the BrickYard idea-to-manifest generator and the impact estimator run entirely in your browser. We do not receive what you type into them.
3.7 Email
If you email info@cyberbricks.ai, we receive your email address, your message, any attachments and anything else you choose to include. Our email provider handles these messages for us, and we keep them as business correspondence.
We do not ask for sensitive personal information, such as health, financial account or government ID details. Please do not include it in the form or in email.
4. How we use information
We use personal information to:
- respond to your inquiry;
- follow up with you about a possible engagement;
- prevent spam and abuse and keep the Site secure;
- understand, in aggregate, how the Site is used and how it performs, so we can improve it;
- keep business records, meet our legal obligations, and establish, exercise or defend legal claims.
We do not use personal information for targeted advertising. We do not profile you, and we do not make automated decisions about you that have legal or similarly significant effects.
5. Legal bases for processing in the EEA and UK
If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:
- Contact form and email. Our legitimate interests in responding to business enquiries. Where you ask us about a possible engagement, processing is also necessary to take steps at your request before entering into a contract.
- Rate limiting and the spam filter. Our legitimate interests in securing the Site and keeping out spam and abuse.
- Hosting and security. Our legitimate interests in delivering the Site and protecting it.
- Web analytics. Our legitimate interests in understanding aggregate use of the Site. The analytics are cookieless and do not identify individual visitors.
- Legal obligations. Where the law requires us to keep or disclose information.
You can object to this processing at any time, as described in section 12.
6. Cookies and similar technologies
We do not use advertising, tracking or analytics cookies. The only cookies on the Site are strictly necessary security cookies that Cloudflare may set to protect it. The only other item stored in your browser is the cb-theme theme preference described in section 3.5.
7. Who we share information with
We share personal information only with service providers that help us run the Site and our business. They process it on our behalf and under our instructions:
- Cloudflare, for hosting, security, the database that stores form submissions, and web analytics. Cloudflare acts as our service provider and processor.
- Our email provider, for handling email sent to info@cyberbricks.ai.
We may also disclose personal information where the law requires it, to respond to valid legal process, or to protect the rights, safety or property of Cyberbricks LLC, our users or others. If we are involved in a merger, acquisition, reorganization or sale of assets, personal information may transfer as part of that transaction, and we will require the recipient to protect it in line with this policy.
8. No selling, sharing or targeted advertising
We do not sell personal information. We do not “share” personal information for cross-context behavioral advertising, as California law defines that term. We do not use personal information for targeted advertising or for profiling. We have not done any of these things in the past 12 months.
9. International transfers
Cyberbricks LLC is based in the United States, and Cloudflare operates a global network. Your personal information may therefore be processed in the United States and in other countries whose data protection laws may differ from those where you live.
When we transfer personal information from the EEA or the UK to the United States, we rely on appropriate safeguards recognized under the GDPR and the UK GDPR, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, or a framework the provider is certified under. You can ask us for more information about these safeguards at info@cyberbricks.ai.
10. How long we keep information
| Information | How long we keep it |
|---|---|
| Contact form submissions | 24 months after you send them, then deleted at the next automatic clean-up. Sooner if you ask. If we start working together or keep corresponding, we keep what we need as business records. |
| Keyed hash of your IP address (rate limiting) | Cleared once it is more than 30 days old, at the next automatic clean-up (each time someone submits the form and each time we review submissions) |
| Email to info@cyberbricks.ai | As long as we need it as business correspondence and for our legal and record-keeping obligations |
| Hosting, security and analytics data | Processed by Cloudflare under its own retention practices. The analytics we see are aggregate. |
| Theme preference | On your device until you clear it |
11. Security
We protect personal information with these measures:
- All traffic to and from the Site is encrypted with TLS.
- Only our staff can access form submissions.
- We collect only what we need to reply to you, and we keep IP addresses only as salted hashes for rate limiting.
No system is completely secure. If a security incident affects your personal information, we will notify you and the authorities where the law requires it.
12. Your rights in the EEA and UK
If you are in the EEA or the UK, you have the right to:
- access the personal information we hold about you and get a copy of it;
- have inaccurate or incomplete information corrected;
- have your information erased;
- restrict how we process your information;
- object to processing based on our legitimate interests;
- receive the information you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where technically feasible.
You also have the right to complain to a data protection supervisory authority, in particular in the country where you live or work or where you think a breach of the law happened. In the UK, that is the Information Commissioner’s Office.
13. Your rights under US state privacy laws
If you live in California or another US state with a comprehensive privacy law, you may have the right to:
- Know. Ask what personal information we have collected about you, where it came from, why we collected it, and who we disclosed it to, and get a copy of the specific pieces.
- Delete. Ask us to delete personal information we collected from you.
- Correct. Ask us to correct inaccurate personal information.
- Opt out of sale, sharing and targeted advertising. We do not do any of these, so there is nothing to opt out of.
- Non-discrimination. We will not treat you differently, for example by denying service or changing the quality of our response, because you exercised any of these rights.
What we collect. In the past 12 months we have collected these categories of personal information:
| Category | Examples | Source |
|---|---|---|
| Identifiers | Name, work email, IP address used for rate limiting and stored only as a hash | You, and your browser or device |
| Professional information | Company name, and the challenges you select | You |
| Internet or network activity | Pages requested, referrer, browser and device type, page performance | Your browser or device |
| Approximate location | Country, derived from your IP address for aggregate analytics | Your browser or device |
| Other information you choose to send | The contents of your message or email | You |
We use these categories for the purposes in section 4. We disclose them for business purposes only to the service providers listed in section 7. We do not sell or share any category. We do not seek sensitive personal information and do not use any for purposes that would give rise to a right to limit its use.
Global Privacy Control. We honor Global Privacy Control signals as a valid request to opt out of the sale and sharing of personal information. We do not sell or share, so there is nothing for the signal to switch off, but we treat it as an opt-out request all the same.
14. How to make a request
To exercise any of the rights in sections 12 or 13, email info@cyberbricks.ai. Tell us what you are asking for and, if you know it, which law you are relying on.
- Verification. We will verify your identity before acting on your request, usually by matching details you give us against the information we hold, such as by confirming the request with the email address you used to contact us. We will ask only for what we need to verify you.
- Timing. We will respond within 30 days. Where the applicable law allows more time, we may take up to 45 days, and we will tell you if we need it.
- Authorized agents. You can have an authorized agent make a request for you. We will ask the agent for proof, such as your signed written permission, and we may ask you to confirm your identity with us directly.
- Cost. Requests are free. Where the law allows, we may refuse or charge a reasonable fee for requests that are manifestly unfounded or excessive.
- Appeals. If we decline your request, we will explain why. You can ask us to reconsider by replying to our response. If you are still not satisfied, you may contact the attorney general or privacy regulator in your state.
15. Children
The Site is for businesses. It is not directed at children under 13, or under 16 in the EEA, and we do not knowingly collect personal information from them. If you believe a child has sent us personal information, contact us at info@cyberbricks.ai and we will delete it.
16. Links to other websites
The Site may link to websites that we do not operate. This policy does not apply to them. Please read the privacy policies of any website you visit.
17. Changes to this policy
We may update this policy from time to time. When we do, we will post the new version on the Site and change the effective date at the top. If a change is significant, we may also give notice on the Site.
18. Contact
For any privacy question or request, email info@cyberbricks.ai.