Who we are
This Policy describes how CYBERX TECNOLOGIA E ANALISE DE DADOS LTDA, registered with CNPJ no. 44.663.533/0001-29, headquartered at SHS Quadra 6, Conjunto A, Bloco A, S/N, Sala 501, Parte 297, Brasil 21, Asa Sul, Brasília/DF, CEP 70.316-102, Brazil ("CyberX", "we"), processes personal data on the website https://cyberx.to (the "Site"), as controller, under Brazilian Law no. 13,709/2018 — the General Personal Data Protection Law ("LGPD").
CyberX is the brand under which CYBERX TECNOLOGIA E ANALISE DE DADOS LTDA operates.
This Policy covers people who browse the Site, send us a request, check a crypto wallet, report a scam or respond to a report, and use the search. It does not cover:
- the client area (app.cyberx.to), which has its own privacy notice, shown at sign-up;
- the investigation, intelligence and anti-fraud services provided to clients, which are governed by contract and by a specific data processing instrument.
Data protection officer
The data protection officer is the channel between CyberX, data subjects and the Brazilian National Data Protection Authority (ANPD):
- Name
- Robert Franco
- encarregado@cyberx.to
- SHS Quadra 6, Conjunto A, Bloco A, S/N, Sala 501, Parte 297, Brasil 21, Asa Sul, Brasília/DF, CEP 70.316-102, Brazil
What we process, in each situation
3.1When you browse the Site
For each page visited, we record browsing and device data:
- IP address and the approximate location derived from it;
- device type, system, browser and other technical characteristics;
- technical identifiers of the device and browser, which can recognise the same device across visits, without cookies;
- the page visited and the referring site;
- signs of interaction on the page, such as scrolling and pointer movement.
We do not record what you type. This data serves Site security, bot and abuse detection and audience measurement. You can object to this collection (section 5).
3.2When you send a request through the form
Request type, description, organisation (optional), e-mail, language and, if you came from a wallet check, its protocol number. The server also records the IP, country, city and time zone, and a bot-check score. The request reaches our team by e-mail. Please do not include sensitive data or confidential details in the first contact.
3.3When you check a crypto wallet
On the check, without e-mail: the wallet address or transaction hash you enter, the network, the result of the analysis and, to prevent abuse, the IP, country, city and time zone.
When you request the report, through the consent box on the form: your e-mail, a unique link to the online report and, if you save the PDF, a record of the file's hash, so that anyone can check on the verification page whether a PDF is the original. The PDF cover shows your e-mail masked.
Wallet addresses and transactions are public, pseudonymous records of blockchain networks. In this tool CyberX does not link the address checked to a person: the report describes on-chain behaviour signals, presence on public sanctions and freeze lists and entity labels obtained from public sources and blockchain intelligence databases. The result is a signal, not a decision, and does not profile the person who runs the check. These sources are queried only with the address or hash entered: none of your data leaves in that query.
The check may be cross-referenced with ongoing CyberX investigations. Your e-mail is kept as the contact of the person who requested the report, separate from the wallet analysis, and not as a link to it.
3.4When you report a scam
- About you, if you choose to identify yourself
- name and e-mail, whether you want to be contacted and, if you want public credit, the name or handle you choose. You can report without identifying yourself. The form asks you to declare that you are of age and that the report is true.
- About the scam
- type, channel, date, amount and currency, the text of the report and the identifiers you provide (for example, website, profile, wallet, company registration number, phone, Pix key or account).
- Technical
- IP, country, city and time zone, and the bot check.
The same applies to later additions you make to the report's trail.
Third-party data provided in a report. Phone, Pix key, account and text are encrypted. What may appear on a scam page, what only answers by search and what is never published are described on the "how it works" page of the scam hub. A natural person's name, Brazilian taxpayer number (CPF) and the account's institution are never published.
"Me too". The button keeps, for seven days, a code derived from your IP with a secret of ours, only to count once per person. The IP itself is not stored.
3.5When you respond to a report or ask for concealment or removal
Anyone named on a scam page can respond, ask for an identifier to be concealed or ask for removal from search. We process the name, e-mail and text of the request (encrypted), the identifier it refers to and the IP.
3.6When you use the search
What you type in the scam hub search and in the wallet check preview is recorded without your IP and without a visit identifier, with the language, the term type and whether there was a result. When the term is a phone, Pix key, account or transaction hash, only the type is kept. Other terms are kept as typed — avoid putting personal data in the middle of a search phrase.
To limit the number of searches per hour, we keep for one day a code derived from your IP with a secret of ours, together with the time.
3.7When you write to us
Whatever you choose to include in a message sent to contato@cyberx.to or encarregado@cyberx.to.
Purposes and legal bases
When processing is based on legitimate interest, it is limited to what the purpose requires, and CyberX keeps a documented legitimate interest assessment. When the basis is consent, you can withdraw it at any time through the data protection officer, without affecting what was done before the withdrawal.
Tracking and how to object
The Site identifies devices without cookies, using the technique described in section 3.1, based on legitimate interest. You can object without writing to us:
- with the tracking button in the Site footer, which stores your choice in this browser;
- with your browser's Do Not Track or Global Privacy Control signal, which prevails over the footer choice.
With the objection active, the tracking script does not run: no device fingerprint, no interaction record, no audience measurement. What remains is the minimum any server records when delivering a page, such as the IP and time of the request, and whatever you send in a form yourself.
Who we share data with
CyberX does not sell or rent personal data. It may be shared only with:
- Processors acting on our behalf: Site hosting and execution; database and private file storage; e-mail delivery (our e-mails are sent without open or click tracking).
- Our internal team, as needed for each purpose.
- Public authorities, when there is a legal obligation, court order or legitimate request, or to investigate fraud and crime.
- Successors, in a corporate reorganisation, with this Policy maintained.
What is published from a report follows the rules on the "how it works" page of the scam hub.
International transfer
Some processors are outside Brazil, in the United States. These transfers follow articles 33 to 36 of the LGPD and ANPD Resolution CD/ANPD no. 19/2024.
How long we keep data
A period is extended only on evidence that justifies an inquiry, arising within the period, or by order of an authority, and the extension is recorded with reason, date and new period. At the end of each period, data is deleted or anonymised, unless the law requires it to be kept.
Your rights
You can ask, free of charge, through the data protection officer (section 2) for:
- 01confirmation that we process your data, and access to it
- 02correction of incomplete, inaccurate or outdated data
- 03anonymisation, blocking or deletion of unnecessary data or data processed unlawfully
- 04portability
- 05deletion of data processed on the basis of consent, and withdrawal of consent
- 06information on who we share data with and on the possibility of not consenting
- 07objection to processing based on legitimate interest
- 08review of decisions taken solely on automated processing that affect your interests
The full statement about your data is provided within 15 days of the request. We may ask for information to confirm your identity before acting. You can also petition the ANPD (https://www.gov.br/anpd).
Security
The whole Site uses an encrypted connection (HTTPS). Reporter identity, report text, phone, Pix key and account are encrypted, with the key kept outside the database. The search compares derived codes and does not return the stored value. Issued PDFs are kept in private storage, without public access. Address segments that give access to a report or scam report do not enter the browsing records. Access to data is restricted to the team that needs it.
No system is completely secure. In an incident that may cause relevant risk or harm, we will notify affected data subjects and the ANPD, as the law requires.
Children and adolescents
The Site is not intended for people under 18, and the report form asks for a declaration of age.
Changes
This Policy may change. The current version is always on this page, with the date of the last update, and relevant changes are highlighted.
Contact
About this Policy or your data: encarregado@cyberx.to. Other matters: contato@cyberx.to.
Governing law and venue
This Policy is governed by Brazilian law. The courts of Brasília/DF, the controller's seat, are chosen, without prejudice to the consumer's domicile where the law so provides.