Last updated: October 14, 2026
1. Who we are
Cyber Strategy Institute Inc. (“CSI,” “we,” “us”), 1207 Delaware Ave #3397, Wilmington, DE 19806, is responsible for the personal information described in this policy.
This policy covers cyberstrategyinstitute.com and its subdomains, agency-check.app, our free assessments and tools, our checkout, the Strategic Certainty Session, and our hosted MCP Services (AI SAFE² MCP and Agency Check). It works alongside our Terms of Service.
2. The short version
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
Content you send to our MCP Services is processed in memory and never stored. Retention: 0 days.
We do not use your content or your data to train AI models.
Security metadata from the MCP Services is kept 90 days. Free assessment answers are kept 24 months. Then both are deleted.
You can ask us to see, correct, or delete your information at any time at policy@cyberstrategyinstitute.com.
3. What we collect and how long we keep it
| What we collect | Examples | Where it comes from | How long we keep it |
|---|---|---|---|
| Content sent to the MCP Services | Text, drafts, quotes, forms, or code you submit for a check or review | Agency Check, AI SAFE² MCP | 0 days. Processed in memory only, never written to storage or logs |
| Security metadata | Time, client or token identifier, tool called, ruleset version, response status, IP address | MCP Services | 90 days |
| Agency Check receipts | Cryptographic hashes and the outcome of a check, never the content | Agency Check | 90 days |
| Contact details | Name, work email, phone number, company, job title | Forms, assessments, checkout, newsletter sign-up | While you are a customer or subscriber, plus 3 years |
| Free assessment responses | Your answers and your results | Our free assessments | 24 months |
| Session materials | Intake answers, session notes, your Strategic Certainty Brief | Strategic Certainty Session | 3 years after delivery |
| Account and token records | Token identifier, plan, account email | MCP paid tiers, client portal | While active, plus 1 year |
| Purchase records | Products bought, amounts, billing address, last four digits of your card | Checkout | 7 years, as tax and accounting law requires |
| Payment card numbers | Full card number and security code | Entered directly with SamCart or Stripe | Never received or stored by CSI |
| Website usage | Pages viewed, referring site, device and browser type, approximate location derived from IP address | Cookies and analytics on our website | 14 months |
| Messages to us | Support emails and contact form submissions | You | 3 years |
| Consent records | When and how you opted in to or out of marketing email or texts | Forms and checkout | 5 years after you opt out, as proof of your choice |
We do not ask for sensitive personal information, such as government identification numbers, health data, or precise location, and we ask you not to send it to us. When a retention period ends, we delete the information or de-identify it so it can no longer be linked to you. We may keep information longer only where the law requires it or to resolve a dispute.
4. How we use your information
We use personal information only to:
provide what you asked for: your assessment results, Decision Cards, MCP outputs, purchases, Sessions, and course access;
run billing, accounts, tokens, and customer support;
protect the Services, prevent abuse, and investigate security incidents;
measure and improve our website and Services using analytics and aggregate, de-identified data;
send transactional messages, and marketing messages if you opted in;
build de-identified, aggregated research and benchmarks that never identify you or your organization;
meet legal obligations and enforce our Terms.
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
5. AI processing
MCP Services. Our hosted MCP Services do not send your content to third-party AI models. If that changes, we will update this policy before the change takes effect.
Strategic Certainty Session. We prepare a preliminary analysis of your intake answers with third-party AI tools, under terms that prohibit the provider from training its models on our customers’ data. A person reviews every finding before it reaches you.
No training. We do not use your content, assessment answers, or Session materials to train AI models, ours or anyone else’s.
6. Who we share it with
We share personal information only with the service providers that help us run CSI, under contracts that limit their use of it to providing services to us:
| Provider | What they do for us | What they receive |
|---|---|---|
| SamCart | Checkout | Contact details, purchase records, payment details |
| Stripe | Payments for some Services | Contact details, payment details |
| SuiteDash | Client portal, customer records, token delivery | Contact details, account records, Session materials |
| Cloudflare | Hosting and security for the MCP Services | Security metadata; content in transit, which is not stored |
| Google (Analytics, through Site Kit) | Website analytics | Website usage data |
| Our website host | Hosting cyberstrategyinstitute.com | Website usage data, form submissions |
| AI model providers | Preliminary Session analysis, under no-training terms | Session intake answers |
| Email delivery provider | Sending transactional and opted-in marketing email | Name, email address |
| Course platform | Hosting courses you buy | Name, email address, course progress |
We may also disclose information when the law requires it, such as a valid subpoena or court order; to protect the rights, safety, or security of CSI, our users, or the public; in connection with a merger, acquisition, or sale of assets, where the information stays subject to this policy; or with your consent.
We do not sell personal information, and we have not sold it in the past 12 months.
7. Cookies and analytics
Our website uses two kinds of cookies:
Essential cookies keep the site working, such as remembering a form you are filling in or securing checkout. The site does not work properly without them.
Analytics cookies from Google Analytics tell us which pages are visited and how people find us. Google’s use of this data is described at policies.google.com/privacy.
We do not use advertising cookies or cross-site tracking pixels. You can block or delete cookies in your browser settings, and you can opt out of Google Analytics with Google’s browser add-on at tools.google.com/dlpage/gaoptout. We honor Global Privacy Control (GPC) signals as a request to opt out of any sale or sharing of personal information.
The hosted MCP Services set no cookies.
8. Email and text messages
Transactional messages (receipts, access details, scheduling, security notices, and changes to our terms) are sent while you have an active purchase or subscription.
Marketing email and our newsletter are sent only if you opt in. Every message has an unsubscribe link, and we honor it within 10 business days.
Text messages. We send marketing texts only to numbers whose owner opted in through a separate consent. Consent is never a condition of a purchase. Message frequency varies. Message and data rates may apply. Reply STOP to cancel or HELP for help.
We do not sell or rent your email address or phone number, and we do not share your phone number with anyone for their own marketing.
9. Security
We protect personal information with encryption in transit, access limited to the people who need it, credential and token controls, and security logging. Content sent to the MCP Services is never stored, so there is none to expose. No system is perfectly secure. If a breach affects your personal information, we will notify you and any regulator as the law requires.
10. Your rights
Wherever you live, you can ask us to:
tell you what personal information we hold about you and give you a copy;
correct information that is wrong;
delete your information, subject to the legal holds in Section 3;
stop sending you marketing email or texts;
withdraw any consent you gave us.
US state privacy laws. If you live in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, or another state with a comprehensive privacy law, you also have the right to receive your information in a portable format and to opt out of the sale of personal information, sharing for cross-context behavioral advertising, targeted advertising, and profiling. We do none of those things, so there is nothing to opt out of, but you may still send the request.
California notice. In the past 12 months we collected these categories of personal information, from the sources and for the purposes described in Sections 3 and 4: identifiers (name, email, phone, IP address, token identifiers); commercial information (purchase records); internet activity (website usage and MCP security metadata); professional information (company and job title); and approximate location derived from IP address. We did not sell or share any of it for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics about you. We do not disclose personal information to third parties for their own direct marketing.
How to make a request. Email policy@cyberstrategyinstitute.com with the subject line “Privacy request.” We will verify your identity by confirming details we already hold, such as your email address, before acting. You may use an authorized agent, who must show us your written permission. We respond within 45 days and will tell you if we need up to 45 more. If we decline your request, you may appeal by replying to our decision with the word “Appeal.” If you are not satisfied with the outcome of your appeal, you may contact your state attorney general. We will not treat you differently for exercising any of these rights.
11. European Union and United Kingdom
If you are in the European Economic Area or the United Kingdom, CSI is the controller of your personal information. We rely on these legal bases:
Contract: to provide Services you request or buy;
Legitimate interests: to secure the Services, prevent abuse, and improve our website, balanced against your rights;
Consent: for marketing messages and, where the law requires it, analytics cookies. You can withdraw consent at any time;
Legal obligation: to keep tax and accounting records and respond to lawful requests.
You also have the right to object to processing based on legitimate interests, to restrict processing, and to complain to your local data protection authority.
12. Children
Our Services are for adults. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.
13. International transfers
CSI is based in the United States, and our service providers may process information in the United States and other countries. When we transfer personal information from the European Economic Area or the United Kingdom, we rely on approved safeguards such as the European Commission’s Standard Contractual Clauses.
14. Changes to this policy
We will post any update on this page with a new “Last updated” date. If a change materially affects how we use information we already hold, we will email customers and subscribers before it takes effect.
15. Contact
Cyber Strategy Institute Inc., 1207 Delaware Ave #3397, Wilmington, DE 19806
Email: policy@cyberstrategyinstitute.com
Web: cyberstrategyinstitute.com/contact-us/