Privacy policy.
Last updated: 5 November 2026
1. Who we are
SuperCyber is a trading name of Love the Idea Ltd (registered in England and Wales, company number 11339413; registered office 124 City Road, London EC1V 2NX; ICO registration ZB190313). We are the controller of personal data collected through this site. You can reach us through the contact form.
2. The short version
- We do not use analytics or advertising trackers, and we do not set cookies (see our cookies page).
- Your password never leaves your device when you use the password check.
- Your Cyber Essentials answers, country choice and theme choice stay in your browser.
- We only keep your details when you send us a message or use the email breach check, and only as described below.
3. What happens when you use the site
| When you… | What is used | Who receives it |
|---|---|---|
| Visit any page | Your IP address, browser type and the page requested, in server logs | Cloudflare, our hosting provider |
| Load a page | Your IP address, so your browser can fetch the Inter, Inter Tight and JetBrains Mono fonts | Google Fonts. The accent font is hosted on our own site. |
| Choose a country, switch theme or answer the Cyber Essentials check | Your choices, saved in your browser's local storage | Nobody. They never leave your device. |
| Use the email domain check | The domain you type, to read its public DNS records | Cloudflare's public DNS service (cloudflare-dns.com), directly from your browser. We do not receive it. |
| Use the password check | Your browser turns the password into a one-way SHA-1 fingerprint and sends only its first five characters | The Pwned Passwords service. The password is never sent, and we receive nothing. |
4. Email breach check
This toolkit needs us to handle your email address, so it works differently.
- You enter an email address. We send a 6-digit code to it, through our email provider Mailjet, to prove the address is yours. The code expires after 10 minutes and we keep only a one-way hash of it.
- When you enter the code, we send the address to LeakCheck to look up known data breaches, and show you the breach names, dates and the kinds of data exposed. We never show or keep passwords or other exposed values.
- We do not keep the email address or the results after answering you. To stop abuse, we keep counters of recent requests, tied to a one-way hash of your IP address and of the email address, for up to one hour.
- Lookups run one at a time across all visitors, so you may see a short wait in a queue.
Our lawful basis is your request for the service and our legitimate interest in keeping it secure and free from abuse.
5. Messages to our team
If you use the "Talk to our team" form, the "Under attack?" form or the Enterprise form, we receive what you type: your name, email address, phone number, organisation, team size, country and message. The forms are handled by Formward, a form service operated in the EU, and use Cloudflare Turnstile to block bots. Turnstile runs a short check in your browser and shares the result with Cloudflare and Formward. We use your details to reply to you, to book a call and to deal with your enquiry or incident. We also send an automatic reply through Mailjet.
Our lawful basis is your request, and our legitimate interest in running our business. We keep enquiries for as long as we need them to deal with your request and for our records, and we review them at least once a year. We do not add you to a mailing list unless you ask us to.
6. Who else handles your data
We use these providers to run the site. Each acts under its own terms and, where it processes data for us, under a data processing agreement.
- Cloudflare: hosting, content delivery, public DNS lookups and the service that runs the breach check.
- Google Fonts: fonts.
- Mailjet: sending the confirmation code and automatic replies.
- LeakCheck: breach look-ups.
- Formward: contact forms.
- Cloudflare Turnstile: a security check on our forms that tells people from bots.
- Pwned Passwords: the password check (receives only part of a hash).
We do not sell personal data. Some providers are based outside the UK, for example in the United States. Where that happens we rely on approved safeguards such as the UK International Data Transfer Addendum or an adequacy decision.
7. Your rights
Under UK data protection law you can ask us for a copy of your personal data, ask us to correct or delete it, ask us to restrict or stop using it, object to how we use it, and ask for it in a portable format. Use our contact form and tell us what you need. We will reply within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would like the chance to put things right first.
8. Children
The site is written for businesses and is not aimed at children. We do not knowingly collect data from children.
9. Changes
We will update this policy when we add or change a toolkit that handles personal data. The date at the top shows when it last changed.