Privacy Policy
Effective 13 September 2026
About this policy
Seraph Cyber ("Seraph Cyber", "we", "us") provides cybersecurity services and the Seraph CTI platform. This policy explains what personal data we collect through this website, why we collect it, how long we keep it, who we share it with, and the rights you have over it. It covers seraphcyber.com and the forms on it. The Seraph CTI platform is governed by the agreement under which your organisation subscribes; where that agreement covers the handling of data you put into the platform, that agreement applies to it rather than this policy. For the purposes of the General Data Protection Regulation (GDPR) and the Kenya Data Protection Act, 2019, Seraph Cyber is the data controller for personal data collected through this website.
Information we collect
We collect what you type into a form, and nothing more. We do not buy contact lists, and we do not build behavioural profiles of visitors. Depending on which form you use, we collect: • Book a demo — your name, work email, organisation, country, role, team size, and any message you write. • Contact us — your name, work email, organisation, your reason for getting in touch, and your message. • Seraph CTI trial request — your work email, organisation, and the number of seats you expect to need. • Threat report download — your first and last name, work email, organisation, role, and which report you asked for. • Careers, express interest — your name, email, area of interest, a link to your LinkedIn profile or CV if you choose to provide one, and any message. We also record the date and time of each submission. Your IP address is used momentarily to rate-limit submissions, so the forms cannot be used for spam or abuse. It is held in memory for at most one minute and is never written to our database.
Why we use it, and our legal basis
We use the details you submit to respond to the specific enquiry you made: to reply to your question, arrange the demo you asked for, set up a trial, send you the report you requested, or consider your interest in working with us. Our legal basis is our legitimate interest in responding to enquiries about our services and in keeping this website secure, or, where you are asking us to take steps towards a contract, the performance of that contract. If we ever want to send you something beyond a reply to your enquiry — a newsletter, or a product announcement — we will ask for your consent first, and every such message will carry a one-click unsubscribe. We do not use your personal data for automated decision-making or profiling. We do not sell or rent it, and we do not share it with advertisers.
Cookies
This website sets one cookie, and only if you unlock a gated threat report. That cookie is named seraph_report_ followed by the report's name. It lasts 30 days, is marked HttpOnly so it cannot be read by scripts in your browser, and carries a signed token confirming you completed the form. It exists so you can return and download that report again without filling the form in a second time. It holds no personal data and cannot be used to identify or track you elsewhere. We set no advertising, tracking or cross-site cookies. Because we use no non-essential cookies, there is no consent banner on this site: there is nothing to consent to.
Analytics
We use Plausible Analytics to understand which pages are read and which links are followed. Plausible is cookie-free and privacy-focused by design: it sets no cookies, assigns no cross-site identifier, and reports only aggregate figures. It does not collect personal data and cannot be used to identify you. Its data is stored in the European Union. Plausible is the only third-party service your browser contacts when you use this website. Our fonts, images, styles and scripts are all served from our own domain, so visiting this site does not quietly announce your visit to anyone else.
Who we share information with
We share personal data only with service providers that operate parts of this website on our instructions, and only to the extent they need it: • Analytics — Plausible Analytics, as described above. • Email delivery — to deliver the notification that tells our team you have been in touch, and any reply we send you. • Hosting and infrastructure — the providers running the servers and database behind this site. Each of these acts as our processor under a contract that requires them to protect your data and use it only for the service they provide to us. A current list of these providers is available on request. We may also disclose personal data to professional advisers where necessary, or where we are required to do so by law or by a lawful request from an authority. We will not do so more broadly than the law requires.
International transfers
We are based in Kenya and some of our service providers operate outside it. Where personal data is transferred across a border, we rely on appropriate safeguards for that transfer — such as the European Commission's standard contractual clauses, or a finding that the destination country provides adequate protection — as required by the GDPR and by Part VI of the Kenya Data Protection Act, 2019. You can ask us which safeguard applies to a particular transfer.
How long we keep it
We keep enquiry and lead records for 24 months from your last contact with us, after which they are deleted automatically. If your organisation becomes a customer, the records relating to that relationship are kept for as long as the relationship lasts and for any period we are required to keep them afterwards, as set out in your agreement with us. You can ask us to delete your information sooner, and we will unless we are required to keep it.
Your rights
Under the GDPR and the Kenya Data Protection Act, 2019, you have the right to: • be told what personal data we hold about you, and be given a copy of it; • have inaccurate data corrected; • have your data deleted; • object to, or ask us to restrict, how we use it; • receive the data you gave us in a portable format; and • withdraw consent at any time, where we relied on consent. To exercise any of these, email info@seraphcyber.com. We will not charge you, and we will respond within one month under the GDPR, or within the period set out in the Kenya Data Protection Act, 2019 for requests made under that Act. We may ask you to confirm your identity before we act, so that we do not disclose your data to someone else. If you are not satisfied with our response, you can complain to a regulator. In Kenya this is the Office of the Data Protection Commissioner (odpc.go.ke). In the European Union or the United Kingdom it is the supervisory authority for the country you live or work in. We would rather you came to us first so we can put it right.
How we protect it
This site is served only over HTTPS and instructs browsers never to connect to it insecurely. It sets a content security policy that restricts what may run on the page, and a set of related security headers. Form submissions are rate-limited and screened for automated abuse. Gated files are served through an access check rather than sitting at a guessable address. Administrative access to the content system is restricted by role, and every change is attributable. The controls we operate are described on our Trust Center page. If you believe you have found a security issue, our responsible disclosure channel is described there, and we would be glad to hear from you. No system is perfectly secure, and we do not claim otherwise. We aim to be honest about what we operate rather than to imply assurances we have not earned.
Children
This website and the Seraph CTI platform are intended for business use by adults. They are not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We update this policy when our practices change. The effective date at the top of this page always tells you which version you are reading. Where a change materially affects how we handle personal data we already hold, we will take reasonable steps to tell the people affected rather than relying on the updated date alone.
How to contact us
For any question about this policy, or to exercise any of the rights described above, email info@seraphcyber.com or use the form on our contact page.