Privacy

CSI uses Google Analytics to count which pages are read. It loads only if you accepted the banner — not before, and not if you declined, opted out on Your Privacy Choices, or your browser sent a Global Privacy Control signal. If none of those is a yes, no script from Google is sent to your browser at all.

It is configured not to feed Google’s advertising audiences and not to personalise ads. Your browser sends each page view to Google directly, and like any connection to any server, that connection shows Google your IP address. The analytics data itself — the page (its address without anything after a “?”, so the words of a search are not included), the time, basic details of the device (screen size, language, browser) and a cookie identifier — contains no IP address: this site does not add one. Google Analytics 4 uses the connection’s address only to work out an approximate location (country, region and city) and does not log or store the address itself. There is no tag manager, no advertising pixel and no other third-party script.

Cookies here do two jobs: keeping you signed in, and remembering your answer about analytics. If you accepted, Google Analytics sets its own cookies as well; if you declined, it is never loaded and sets nothing.

A sign-in cookie holds a signed token and nothing else — no name, no email address, no record of what you looked at. It is marked HttpOnly, so no script can read it,SameSite=Lax, so another site cannot cause your browser to send it, and Secure, so it is only ever sent over an encrypted (HTTPS) connection — the site redirects plain HTTP to HTTPS and tells browsers to use HTTPS only. It is a first-party cookie, sent only to this site and to no one else, and no script — ours included — can read it. It ends when you close your browser — unless you tick “Keep me signed in” when signing in, which keeps it for 30 days. That is your choice, and the box starts unticked.

That is why there is a banner. Consent is required before a cookie that is not strictly necessary is set, and an analytics cookie is not necessary — the site works identically without it. Nothing is loaded while the banner is unanswered, so leaving it alone is the same as declining. The sign-in cookie needs no consent, because without it signing in would not work.

That is every cookie this site sets for visitors; ordinary pages set none until you sign in or answer the banner. People who work on the site have one more sign-in cookie of their own, with the same protections as the sign-in cookie above (HttpOnly, Secure, SameSite=Lax); it is set only in the staff area, which cannot be reached from the internet, and never for visitors.

Signing in with Google or Facebook takes you to that provider’s own sign-in page, which sets cookies of its own under its own address. Those belong to the provider and are covered by that provider’s privacy policy, not this one; this site cannot read them.

Do Not Track and Global Privacy Control. A Global Privacy Control signal is honoured as an opt-out: with it, analytics is not loaded even if the banner was accepted on this browser before. CSI does not sell personal information or share it for advertising.

Like any web server, the host serving this site records requests — the address requested, the time, the response status, and the IP address it came from. These are operational records used to keep the site running and to investigate abuse. They are not joined to anything else on this site and are not used to build a profile of a visitor. Searches, and anything typed into a list’s search box, are not recorded there at all.

Once a day the log of the day before is turned into totals: how many requests and visitors there were, which pages were read, which sites sent visitors, how many visitors were signed in, and how many came from each country. The country is looked up from the IP address on our own server, without sending it anywhere, while the totals are counted. Only the numbers are kept — no IP address, no code made from one, and no account.

Answers about analytics are counted the same way: how many times a day the banner was accepted or declined, and how many times someone opted out or back in on Your Privacy Choices. A number per day is all that is kept — nothing about who answered.

To stop password guessing and floods of submissions, a failed sign-in or a sent form is counted against a scrambled, one-way code made from your IP address (or your account, when you are signed in) — never the address itself. A successful sign-in deletes the count, and every count is deleted within a few hours.

When you search this site, CSI records the words you searched for, the time, and how the search was answered, so we can see what people look for and improve the results. That record does not say who searched — no IP address, account or cookie is stored with it. The words are deleted after 90 days; only the count of searches is kept after that.

Searches are also left out of the web server’s access log (see Server logs), so what you searched for is not kept anywhere together with your IP address.

A search written as a sentence — “free antivirus for Mac with a firewall” — is sent to Google’s Gemini service, which turns it into the filters you see applied. Google receives the words of that search, and nothing that says who you are: no account, cookie or address of yours is sent with it. Gemini does not see CSI’s database or your account, and the results do not come from it — they are CSI’s own data, filtered. Short keyword searches are answered here without it. Avoid typing anything personal into the search box.

We use Gemini through Google’s paid API service. Under its terms, Google does not use the words sent to improve its products; it may keep them for a limited time to detect abuse, under Google’s data processing terms.

Most of what CSI holds is about organisations and their products, not about people: product names, versions, platforms, capabilities, prices, test results and certifications, each recorded with the source it was read from and the date.

Where a source names an individual — an author of a test report, for instance — CSI stores the source and its date rather than reproducing personal detail. If you believe personal information about you appears anywhere on this site, write to info@cyberindex.com and it will be reviewed.

You can read and search this site without an account. Sending a correction or adding a product needs one. CyberIndex is intended for people aged 18 and over, using it for their work, and accounts are for people aged 18 or over.If you create one by signing in with Google or Facebook, CSI receives from that service your name, your email address and the number it uses to identify your account there — nothing else. We do not receive your password, your contacts or your posts, we never post anything on your behalf, and we do not keep the access keys the service issues once you are signed in.

When you first sign in we ask a few details about your work — job title, company, company size, industry, country and job function, and optionally a work email address, your seniority and the product categories you follow. They tell our reviewers whose view a submission represents, and like the rest of your profile they are seen only by you and the CyberIndex team.

On your account page you can add links to your LinkedIn, X, Facebook or TikTok profiles if you wish. They are optional, and they are seen only by you and the CyberIndex team — never shown on a public page.

We keep your account until you delete it. You can do that at any time from your account page; deleting it removes your profile, your social profiles and your sign-in methods immediately. To get a copy of what we hold about your account, write to info@cyberindex.com.

Sending a correction or a product submission needs an account with the work profile described above. What you send is stored with what you typed and linked to your account, so you can follow it under My submissions and someone can come back to you about it; the email address used is your account’s. Neither form sets a cookie of its own.

If you delete your account, it is deleted at once. What you sent stays in the review record, because it is where a published fact came from — but at that same moment your name, email and role are removed from it and its link to your account is cut, so it no longer says who sent it.

CSI reads vendors’ own public pages to keep the index current. It identifies itself in every request with a contact address, honours robots.txt, and stores derived facts, a link and a content hash rather than copies of the pages it reads. If you operate a site CSI reads and want it to stop, that address reaches a person.

CyberIndex is run by the CyberIndex team. The team decides what information this site collects and why, and is responsible for looking after it — in data-protection terms, the team is the controller of the personal information described on this page.

The same people review the submissions and corrections, answer the address below and act on your requests. Google processes analytics data on our behalf, and only for visitors who consented; the services that run the rest of the site are listed under Where it is held.

If you are not satisfied with how we have handled your information or a request about it, please tell us first so we can put it right. You also have the right to complain to the data-protection authority in the country where you live or work.

• Your account and profile — to provide the account you asked for and to show reviewers whose view a submission represents. Basis: providing the service you signed up for (a contract with you). The required profile questions are a condition of sending a correction or a product; you can browse and search without answering them.
• Links to your social profiles — only if you add them. Basis: your consent, which you withdraw by emptying the box.
• Submissions and corrections — to check what you sent, and to come back to you about it. Basis: our legitimate interest, and yours, in keeping the index accurate.
• Searches — to answer them and to see what people look for. Basis: our legitimate interest in a search that works.
• Server logs and sign-in counters — to keep the site running and stop abuse. Basis: our legitimate interest in a secure site.
• Google Analytics — to see which pages are read. Basis: your consent, given on the banner and withdrawn at any time on Your Privacy Choices or by a Global Privacy Control signal. Nothing is loaded before you consent, and withdrawing stops it from loading again. Legitimate interest is deliberately not claimed here: analytics is not necessary to run the site, and the site works identically without it.

Nothing about you is decided by a machine: no profiling, no automated decision with legal or similar effect. Every submission and correction is read by a person.

A vendor submission or a correction is kept while it is open, and for a period after it is resolved so we can go back to you with a question. After that the address is replaced with a marker, and the name and role are cleared. The record of what was reported stays — it is the origin of whatever it changed, and a published correction whose source had been deleted would be a fact we could no longer explain.

The details are cleared once the submission or correction has been resolved and 365 days have passed since it was sent. Something still open waits longer — erasing an address in the middle of a conversation would strand the person who wrote to us — but not indefinitely: 730 days after it was sent, its details are cleared whether or not it has been resolved. The clearing is done by code, not by anyone remembering to do it.

Server logs are the web server’s access log, which records the address a request came from. It is rotated by size rather than by date: three files of up to 10 MiB each, and then the oldest is overwritten. How long that is in days depends on how busy the site is — we would rather tell you what actually happens than promise a period nothing enforces. Nothing in that log is joined to anything else here, and none of it is used to build a picture of you.

Analytics. Google deletes the events a browser sent (pages viewed, and when) 2 months after they were collected. The identifier that links a browser’s visits is user-level data, also kept for 2 months, counted from that browser’s last visit (the property’s “reset on new activity” setting). Separately, the cookie that holds the identifier in your browser expires 2 months after your last visit (see the cookie table). Reports built from that data are aggregated — counts, with nobody in them — and Google keeps those under its own rules. Declining the banner, or withdrawing consent later, stops anything further being sent and deletes Google’s cookies from your browser; it does not reach back and delete what Google already has.

You can ask:

• what we hold about you, and for a copy of it (access);
• for it to be corrected (rectification);
• for it to be deleted (erasure);
• for a copy in a machine-readable file to take elsewhere (portability);
• us to stop or pause using it while a question is settled (objection and restriction);
• to withdraw a consent you gave — for social-profile links, by emptying the box.

With an account you can do most of this yourself: edit your profile, and delete the account on your account page. For anything else, write to the address below. We will search every place an address can appear — accounts, vendor submissions and correction requests — and tell you what was found, including if the answer is nothing. We may ask you to confirm the request from the email address concerned, so that nobody else can ask on your behalf. Using these rights costs nothing, and you will not be treated differently for using them.

These are the rights the European and UK GDPR give, and they cover what the privacy laws of US states give their residents too (to know, delete, correct and get a copy). CSI does not sell personal information, share it for targeted advertising, or use it to profile anyone. Analytics is configured not to feed Google’s advertising audiences, so it is not “sharing” in the sense those laws mean — but you can switch it off for yourself anyway on Your Privacy Choices, and we honour Global Privacy Control without being asked.

We answer within one month of your request reaching the address below, which is the deadline the GDPR sets; we aim for four weeks. It is read by the people who run this index; there is no department to be passed between. If a request is complex, or you send several, the law allows up to two further months — if we need them, we will tell you within the first month and say why.

If we turn a request down, we will say why. You can appeal by replying to that answer with the word appeal; someone who did not make the first decision reviews it and answers within 60 days, explaining the outcome. If the appeal is refused too, you can complain to the Attorney General of your state — and if you are in the UK or the EU, you can complain to your data protection authority at any time.

The site and its database run on servers in the United States, on hosting rented from a commercial provider. If you are in the United Kingdom or the European Economic Area, that means an address you send us is transferred to the United States and held there.

Who else is involved. Only the services that make the parts above work, each for that purpose alone:

• the hosting provider that runs the servers (GoDaddy);
• Google or Facebook, if you choose to sign in with one of them — they learn that you signed in here;
• Google’s Gemini service, for the words of sentence-like searches (see Searches);
• Microsoft, whose email service holds the messages you send to our address.
• Google, for analytics — but only for visitors who accepted the banner. Google receives the page you looked at and its own cookie identifier; your IP address reaches it from the connection itself — the analytics data contains none — and is used only for an approximate location, not stored (see Analytics above). It is a transfer to the United States, made under Google’s standard terms and the EU–US Data Privacy Framework.

This site itself sends no email — there is no mailing system and no newsletter. No advertising or tracking service runs here, and analytics runs only for visitors who accepted it. Nothing about you is sold or handed to anyone outside this list. The only people who read a submission are the ones reviewing it.

When what CSI does with personal information changes, this page changes first, and the date at the top moves. Information we already hold is not used for a new purpose until this page says so — and where that new purpose would need your consent, not until you have given it.

info@cyberindex.com — for anything on this page, including a request to see or remove information about you.