Legal

Privacy Policy

Last updated: May 2026  ·  Effective: May 2026

At ShieldIQ, your privacy matters. This policy explains what data we collect, why we collect it, how we use it, and your rights regarding your data. We are committed to being transparent and keeping your information secure.

1. Who We Are

ShieldIQ is a cybersecurity awareness training platform operated by Glitch Factory FX, based in Nairobi, Kenya. We are the data controller for personal information collected through this platform. For any privacy-related questions, contact us at privacy@shieldiq.com.

2. Data We Collect

We collect the following categories of data:

📋 Account Information

Name, email address, company name, job role, and password (stored as a bcrypt hash — never in plain text).

🎯 Training & Activity Data

Quiz scores, modules completed, time spent, answers submitted, risk level assessments, and leaderboard rankings.

🏢 Company Data (Admin Accounts)

Employee lists, company-wide training performance, risk distribution reports, and module completion rates.

🔧 Technical Data

IP address, browser type, device information, and access timestamps — collected automatically for security and service improvement.

📧 Communication Data

Messages you send us via the contact form, and your email preferences for notifications.

3. How We Use Your Data

We use your data to:

  • Provide and personalise your training experience
  • Power our AI risk engine and adaptive training recommendations
  • Enable admin dashboards for company-level reporting
  • Send training reminders, OTP verification, and account notifications
  • Improve our platform, fix bugs, and develop new features
  • Detect and prevent fraud, abuse, and security threats
  • Comply with legal obligations

We do not sell your personal data to third parties. Ever.

4. Data Sharing

We may share your data with:

  • Your company admin — if you joined via a company account, your training scores and risk level are visible to your admin
  • Email service providers — to send transactional emails (OTPs, reminders). They process email addresses only
  • Hosting/infrastructure providers — our servers and database providers operate under strict data processing agreements
  • Law enforcement — only when required by law or to protect the rights and safety of users

5. Data Security

We take security seriously — after all, it's our business. We protect your data with:

  • Bcrypt password hashing (passwords are never stored in plain text)
  • JWT authentication with expiring tokens
  • Email verification and OTP for sensitive actions
  • Rate limiting to prevent brute-force attacks
  • HTTPS encryption for all data in transit
  • Regular security reviews of our codebase

Despite these measures, no system is 100% secure. Please report any suspected vulnerabilities to security@shieldiq.com.

6. Data Retention

We retain your account data for as long as your account is active. If you delete your account, your data will be permanently deleted within 30 days. Training performance data may be retained in anonymised, aggregated form for product improvement purposes even after account deletion.

7. Your Rights

You have the right to:

  • Access — request a copy of the personal data we hold about you
  • Correction — update inaccurate or incomplete data via Settings
  • Deletion — request deletion of your account and personal data
  • Portability — request your training data in a machine-readable format
  • Objection — object to certain uses of your data
  • Withdraw consent — opt out of marketing emails at any time

To exercise any of these rights, contact us at privacy@shieldiq.com. We will respond within 14 days.

8. Cookies

ShieldIQ uses minimal browser storage. We use localStorage to store your authentication token and user session data on your device. We do not use advertising cookies or third-party tracking. You can clear this data at any time by logging out or clearing your browser storage.

9. Children's Privacy

ShieldIQ is intended for professional use by adults (18+). We do not knowingly collect data from individuals under 18. If you believe a minor has created an account, please contact us immediately and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy periodically. When we make significant changes, we will notify you by email and update the date at the top of this page. Your continued use of ShieldIQ after updates constitutes acceptance of the revised policy.

11. Contact Us

For any privacy concerns or data requests:

📧 privacy@shieldiq.com 🔒 security@shieldiq.com (security issues) 📍 Nairobi, Kenya — A Glitch Factory FX Product

Also read our Terms of Service  ·  Contact Us