Legal information

1. Provider identification

This service is operated by:

• HEXENKRAFT s.r.o.
• Registered office: V zahradách 2462/31, Libeň, 180 00 Praha 8, Czech Republic
• Company registration number (IČO): 29665931
• VAT ID: CZ29665931
• Registered in the Commercial Register kept by the Municipal Court in Prague (Městský soud v Praze), section C, file 450419
• Represented by its managing director (jednatel)
• Contact: hello@cybiq.eu

2. Privacy policy

Controller

The controller of your personal data is HEXENKRAFT s.r.o. (details above). For any privacy request, contact hello@cybiq.eu.

What we process, and why

• Your wizard answers: processed entirely in your browser. They are stored only in the page URL (the permalink) and are never transmitted to us unless you choose to share that link or include them in an email to us. No account is created.
• Server access logs: our EU web server records the IP address, time and requested page for every request to cybiq.eu, for security and abuse prevention (Art. 6(1)(f) GDPR). These logs are kept for 30 days.
• Agent and API classification (POST /api/classify and the MCP tool classify_cra): answers sent on this path, including by an agent acting for you, are processed on our EU server in memory and the result is returned. We keep no record of your answers. Stripe is not involved in free classification. We rate-limit by client address; that address is held in memory as the rate-limit key. Legal basis: our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). Application logs do not store your IP address or your answers in readable form; they may record a fingerprint of the address.
• Your email address, if you email us (early-access requests, support, a re-delivery or invoice request): to reply and, where you ask us to resend a pack or issue an invoice, to identify your order against the payment record below. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Payment records (once you have paid): the Stripe Checkout Session id, the pack purchased, the amount and the timestamp, kept as a redemption ledger so each session unlocks a pack only once and so we can handle a re-delivery or invoice request. Legal basis: Art. 6(1)(b) and, for retention, our legal obligation under accounting/tax law (Art. 6(1)(c) GDPR).
• Customer record (once you have paid): your name, email address and country, linked to your order, in our customer database on our own EU server, to manage your order, invoices and support requests. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Kept for as long as we must keep the invoice.
• Watch-list address, if you subscribe to CRA change updates: to email you when the law or its published dates change. Legal basis: your consent (Art. 6(1)(a) GDPR). Used for nothing else, never shared or sold, every message carries an unsubscribe link.
• Aggregate analytics: this site runs cookieless web analytics (Umami) that we host ourselves, served from this domain. For each page view it records the page, the referring site, browser, device type and country, tied to a pseudonymous visit identifier. Our analytics store no IP address and set no cookies; we read the figures only in aggregate. The part of the page address after ? or #, which is where your answers live, is excluded from what it records. There is no advertising and no third-party tracker, so no cookie banner is needed. Legal basis: our legitimate interest in measuring traffic (Art. 6(1)(f) GDPR).

Processors and where data sits

Payments are handled entirely by Stripe. You pay through a Stripe-hosted payment page; we never see or store your card details. After payment, Stripe returns you to cybiq.eu with a signed unlock token, valid for 15 minutes and usable once per Stripe Checkout Session, that releases your pack for download in your browser. We keep only the Stripe Checkout Session id, the pack purchased, the amount and the timestamp, as a redemption record confirming the token was used once, and never any card data. Stripe's own privacy policy governs the payment data it holds. We also use an EU hosting provider to run the service.

Free applicability check

The free CRA applicability check in the browser wizard runs on the answers in your page and returns a result in your browser. No account is created. The downloadable determination memo and draft pack are generated locally in your browser. Classification over HTTP (POST /api/classify) or MCP (classify_cra) is the separate path described under Agent and API classification above.

Retention

Email correspondence is kept only as long as needed to handle your request. Payment records (the Stripe Checkout Session id, pack, amount and timestamp) are kept as a redemption ledger and to satisfy statutory accounting and tax retention periods, then deleted. Rate-limit state for the agent and API classification path is held in memory only. Application logs for that path are rotated by size on the container and may hold fingerprints of client addresses, not raw IP addresses or answers. Server access logs for every request to cybiq.eu are kept for 30 days.

Your rights

Under the GDPR you have the right to access, rectify, and erase your personal data, to restrict or object to its processing, and to data portability. Contact hello@cybiq.eu to exercise them. You may also lodge a complaint with the Czech Office for Personal Data Protection (ÚOOÚ, uoou.gov.cz) or with the supervisory authority in your country of residence.

3. Terms of service

The product

Cybiq provides automatically generated compliance documents (digital content) based on the answers you provide, grounded in Regulation (EU) 2024/2847 (Cyber Resilience Act). The documents are not legal advice: they are a structured starting point. For a binding legal assessment, consult a qualified lawyer.

Price and delivery

The compliance packs are one-time purchases at the prices displayed on this site. Offer for business customers only. HEXENKRAFT s.r.o. is a VAT payer in the Czech Republic. The VAT treatment of each purchase is stated on the invoice. Business customers in another EU country with a valid VAT ID are invoiced without Czech VAT under the reverse-charge mechanism (Art. 196 Directive 2006/112/EC); you account for the VAT. You pay through a Stripe-hosted payment page. Once Stripe confirms your payment, you are returned to cybiq.eu with a signed unlock token, valid for 15 minutes and usable once per Stripe Checkout Session, that releases your pack for download in your browser immediately. Before you can pay, Stripe requires you to accept these terms, which carry the express consent to immediate delivery described below; we refuse delivery, and no token is issued, unless that acceptance is recorded.

You receive a payment receipt from Stripe by email at the time of purchase. An invoice from HEXENKRAFT s.r.o. is issued on request: email hello@cybiq.eu with your receipt. The pack is generated and downloaded once, at unlock time. If you need it again afterwards, email hello@cybiq.eu with proof of your Stripe receipt and we will send it again within one business day.

Agency co-branding licence

The Agency co-branding licence, €490, is not a pack. It is a 90-day term licence: you receive one signed token, and while it is valid the documents you generate on this site carry your agency name as a "Prepared by" field and your token id in the document meta line. It changes nothing else. The Cybiq attribution, the citations and the disclaimer are unchanged, and the licence gives you no other rights over the documents than any other visitor has.

For agencies and consultancies delivering CRA work for clients: a signed token that puts your name on every document you generate here, for EUR 490 per 90 days, one agency name, no report limit. Co-branding only: the Cybiq attribution, the citations and the disclaimer stay exactly as they are.

• The token is a bearer credential: anyone holding it can generate co-branded documents.
• It is a co-branding unlock, not a paywall: the engine runs in your browser and every document is free to generate without a token.
• No per-report counting is possible without a backend, so this is a term licence and never a per-report price.
• Traceability, not prevention: the token id appears in every document generated with it, so a leaked token is attributable after the fact.
• Revocation means rotating the published public key, which invalidates every token signed with it, so keys are issued per cohort.

Two consequences follow that you should read before buying. First, a token stops working the day its term ends; documents already generated are unaffected, because the co-branding is inside the document and inside its hash, but no new document is co-branded until you renew. Second, rotating a cohort key can end your term early: revocation is not per token, so if another agency in your cohort leaks its token and we rotate the key, your token stops working too. If that happens we issue you a replacement token for the remaining term at no charge, on request at hello@cybiq.eu. We do not shorten a paid term without replacing it.

The agency licence is not sold through the pack checkout. You order it by email at hello@cybiq.eu and we invoice you. The 14-day withdrawal terms below apply to this licence in the same way they apply to a pack: performance begins when we send you the token.

14-day right of withdrawal, and its waiver for digital content

As a consumer you normally have the right to withdraw from a distance contract within 14 days without giving a reason. However, for digital content not supplied on a tangible medium, this right expires once performance has begun with your prior express consent and your acknowledgement that you thereby lose the right of withdrawal (Art. 16(m) of Directive 2011/83/EU; Sec. 1837(l) of the Czech Civil Code).

You give this express consent at checkout: our Stripe payment page requires you to accept these terms before you can pay, and that acceptance carries your agreement that the pack is delivered as soon as payment is confirmed and your acknowledgement that you thereby waive your 14-day right of withdrawal. We do not deliver, and no unlock token is issued, unless Stripe confirms that acceptance. If you do not want to give it, do not complete the purchase; your statutory withdrawal right is then preserved and you may use the model form below. If you purchase as a business rather than as a consumer, the 14-day withdrawal right does not apply at all.

Complaints and defective performance

Your statutory rights regarding defective digital content are unaffected by the withdrawal waiver. If your pack fails to generate, cannot be downloaded, or does not correspond to the answers you submitted, contact hello@cybiq.eu and we will remedy the defect or refund you. We resolve consumer complaints within 30 days.

Out-of-court dispute resolution

You may submit a consumer dispute to the Czech Trade Inspection Authority (ČOI, coi.gov.cz) for out-of-court resolution. Consumers resident elsewhere in the EU may use the consumer-protection body of their own country.

Governing law

These terms are governed by the law of the Czech Republic. Where you contract as a consumer, the mandatory consumer-protection provisions of your country of habitual residence remain unaffected (Art. 6 Rome I Regulation 593/2008).

4. Model withdrawal form

Complete and return this form only if you wish to withdraw from the contract and you did not consent to immediate delivery (see section 3).

To: HEXENKRAFT s.r.o., V zahradách 2462/31, Libeň, 180 00 Praha 8, Czech Republic, hello@cybiq.eu

I/We hereby give notice that I/We withdraw from my/our contract for the supply of the following digital content:

- Ordered on / received on: ____________
- Name of consumer(s): ____________
- Address of consumer(s): ____________
- Order reference: ____________
- Signature (only if on paper) and date: ____________

5. Accessibility statement

HEXENKRAFT s.r.o. is committed to making Cybiq usable by everyone. We apply the European Accessibility Act, Directive (EU) 2019/882, which has applied since 28 June 2025, and the European standard EN 301 549, which sets out accessibility requirements for websites.

Conformance target

Cybiq targets the Web Content Accessibility Guidelines (WCAG) 2.1 at level AA, the level EN 301 549 requires. This is a self-assessment: it reports our own testing, and no external body has audited or certified this site.

How we tested it

• Automated testing with axe-core 4.12.1 over every public page, in both the light and the dark theme, at a 1280 pixel desktop width and a 390 pixel mobile width, including the applicability check after it has produced a verdict.
• A manual keyboard walk of the check: skip link, header, wizard questions, verdict and footer, confirming focus order and a visible focus indicator on every control.
• Colour contrast checked on every documented colour pair in both themes, re-asserted by the automated test suite on every build.

Date of this statement and of the most recent review: 3 September 2026.

Known limitations

• The applicability check needs JavaScript. Without it the page shows a short explanation and the static summary beneath it, but the check itself cannot run.
• The compliance documents are HTML files you print to PDF yourself. We have not tested the accessibility of the PDF your own printer or browser produces.
• Automated tools find only part of what can go wrong. Beyond the keyboard walk above, we have not tested with screen readers, screen magnification or voice control, and no testing with disabled users has taken place.
• Quoted legislative text is reproduced verbatim from the Official Journal, in its own wording and structure. We do not simplify it, because a paraphrase would stop being a citation.

Feedback and enforcement

If any part of this site blocks you, write to hello@cybiq.eu, naming the page and what went wrong. We aim to reply within 30 days, the same period we apply to consumer complaints. If our reply does not resolve it, you can contact the market surveillance authority responsible for accessibility in your country of residence.

6. Content sources

All legislative quotations on this site come from Regulation (EU) 2024/2847, OJ L, 20.11.2024 (CELEX 32024R2847). EU publications are reusable under the reuse policy of EU data.