CypherScribe

GDPR overview

The privacy policy carries a dedicated section headed Additional Disclosures for General Data Protection Regulation (GDPR) Compliance (EU). It names lawful bases (consent, performance of a contract, legitimate interests, legal obligation), requires parental consent below the age of sixteen, and states that transfers outside the European Economic Area rely on standard contractual clauses approved by the European Commission or on binding corporate rules. Access, rectification, restriction, objection, portability, deletion, non-discrimination and the right to complain to a supervisory authority are all set out. Two gaps stand out: the section names the controller as Parichay Solutions, which appears nowhere else on the site, and points to an address in the contact section that the contact page does not publish. No Article 27 EU representative and no data protection officer are named.

Who owns the data?

The terms and the privacy policy describe what CypherScribe collects: name, email address, Google account details when Google authentication is used, and automatically generated log and transaction data covering IP addresses, browsers, pages visited, stored files, user profiles and analytics. Neither document contains a clause assigning ownership of customer documentation to the publisher, and none grants it a content licence. Users are told they may access, correct, update, delete, object to, restrict and port their personal data, with requests sent to govind@cypherscribe.io. Personal data is deleted within sixty days of account deletion. The publisher may share data with service providers, related entities, authorities, and any party acquiring its business.

Reuse rights

Reuse of the publisher's own material is restricted rather than granted. The terms forbid copying, modifying, preparing derivative works from, decompiling or reverse engineering any material or software on the website, removing proprietary notices, and transferring or mirroring that material onto another server. No licence to redistribute is given anywhere in the documents. Content that a customer writes and publishes through the platform is treated differently: nothing claims ownership of it and nothing limits what its author may do with it. On its own side, the publisher states it uses collected data to operate and maintain the service, provide support, run analytics, market research and business development, keep internal records, and prevent fraud. Analytics features are reserved for the higher-priced tiers.

Data retention & training

Hosting summary

No hosting jurisdiction is declared. Neither the privacy policy nor the terms names a country, a region or a cloud provider for stored data, and the site has no trust or security page. The terms do say that personal information may be transferred to and processed in countries other than the user's own, with appropriate safeguards, and the privacy policy adds that transfers out of the European Economic Area rely on standard contractual clauses or binding corporate rules. Two technical signals are worth noting, though neither is a statement by the publisher: the site's images, videos and favicon are served from an Amazon S3 bucket in the ap-south-1 region, which is Mumbai, India, and the site itself resolves to an Amazon-operated anycast address geolocated in the United States. The terms are governed by Indian law, with exclusive jurisdiction in Indian courts. No hosting certification such as SOC 2 or ISO 27001 is claimed, no subprocessor list is published, and no data processing agreement is offered.