Privacy notice

Who runs this service

Lighthouse is a security awareness training service operated by CyberPools, Inc. ([To be confirmed by CyberPools: that this is the correct legal name, and a postal address]). It is provided to CyberPools member organizations, such as school districts, for training their staff. In this notice, “your organization” means the member organization that gave you access.

Your organization, or CyberPools on its behalf, decides who is enrolled and what training and phishing simulations they receive. [To be confirmed by CyberPools: the roles of CyberPools and each member organization under data protection law and your contract, and the governing law]

Who this notice covers

Lighthouse is for staff training. It has no fields for date of birth or age and is not designed for students. [To be confirmed by CyberPools: statement on student data, FERPA and any state student-privacy laws that apply to member organizations]

What we collect

Your profile

• Name, work email address and the organization you belong to.
• Where your organization provides them: department, job title and phone number, plus labels your administrators can add (a “VIP” flag and free-text tags).
• How your account was created (directory sync, added by an administrator, or added through CyberPools’s systems), whether it is active, when you last signed in, and your notification settings.

Directory data from Microsoft 365 or Google Workspace

If your organization connects its directory, Lighthouse copies a limited set of fields:

• Microsoft 365: for members of a sign-up group your organization chooses, the display name (split into first and last name), email address or user principal name, department, job title, hire date (when your organization records one), the date the account was created in the directory, and the directory’s internal user ID. For security groups your organization names for Lighthouse, the group name, group ID and who is in the group.
• Google Workspace: for every active user in the organization’s Workspace domain, the name, primary email, department, job title, the date the account was created in the directory, and the directory’s internal user ID.
• Disabled or suspended accounts are not added. People removed from the directory are marked inactive in Lighthouse.

Training activity

• Courses you are enrolled in, who assigned them, due dates, status, progress, start and completion dates, and scores.
• Progress through each module, time spent, visit counts, and how much of each video you watched (seconds and percentage).
• Quiz attempts, including the answer you chose for each question, whether it was correct, and your score.
• Certificates: your name, email, the course, completion date, score and a verification code.
• Points, coins, streaks, badges and reward-shop redemptions from the game features.

Phishing simulation results

Your organization may send you simulated phishing emails. Results are recorded against you by name:

• Whether and when a simulated email was sent to you, and the delivery result reported by the mail server.
• When you opened it, clicked its link, or reported it, with your browser’s user-agent string. For clicks and reports, and for an open recorded as part of a click, we also store your IP address.
• Opens made by automated email-security scanners are logged separately and not counted as your open. Links followed by an automated link scanner in your mail system may be recorded as your click.
• Clicking a simulated link can enroll you in follow-up training.
• Lighthouse has no feature for collecting what you type on its simulation landing pages.
• Some earlier simulations were sent through an older phishing engine (GoPhish) that CyberPools runs. Lighthouse no longer sends simulations through it, but event details it reported for those earlier simulations are kept, which can include browser and network details, and following one of those older simulated links can still sign you in to your training. [To be confirmed by CyberPools: whether those event details can include anything typed into a simulated page, and when the older engine is shut down entirely]

Administrator accounts and activity records

• For administrators: your role and which organizations or pools you manage.
• Records of administrator actions, including who created campaigns, assignments and courses, and a history of course publishing. When an administrator views the service as another organization, that is recorded in an audit log together with their browser’s user-agent string. The database blocks changes to and deletion of individual audit-log entries.
• A log of each simulated email placed directly into a recipient’s Microsoft 365 mailbox.

Signing in

• You sign in with a one-time link sent to your email, or with your Microsoft or Google work account. For Microsoft and Google sign-in, Lighthouse asks only for your basic profile and email address.
• The sign-in system records the IP address and browser user-agent of each active session.

Demo and contact requests

• If you use the request-a-demo or contact form on the public pages, we collect your name, email, organization, and any role, phone number and message you enter. They are emailed to CyberPools’s team together with the IP address the request came from.

Cookies and browser storage

• Lighthouse sets sign-in session cookies so you stay signed in. The app itself adds no advertising or analytics cookies or scripts. Embedded video players (below) are run by their providers.
• Your browser’s local and session storage hold display preferences (theme, text size, whether the side menu is open). For administrators it also remembers the organization or pool selected, list views, and some unsaved editor drafts.
• For learners, most training videos play in Vimeo’s embedded player with Vimeo’s “do not track” option turned on (some administrator course-building screens embed Vimeo without it). Some lessons use an embedded YouTube player, which can set YouTube’s own cookies. Your browser loads these players directly, and some video thumbnails from vumbnail.com, so those services receive your browser’s request under their own privacy policies.

How we use it

• To deliver your training and issue certificates.
• To send you training assignments, reminders and certificates by email.
• To run phishing simulations and measure how your organization is doing on security awareness.
• To report training and simulation results to your organization’s administrators.
• To operate, secure and support the service.

[To be confirmed by CyberPools: whether CyberPools uses any of this data for any other purpose, and a statement on selling or sharing personal information]

Who can see your information

• Your organization’s administrators can see your results. That includes your profile, training progress, quiz scores, certificates and phishing simulation results. Some administrator roles are limited, for example read-only reporting.
• Pool administrators can view, read-only, the records of learners in member organizations that belong to their pool. A pool is a group of member organizations, such as an insurance pool, and is a separate organization from your employer.
• CyberPools platform administrators can see records across all organizations, to run and support the service.
• Other learners in your organization see a leaderboard showing your first name and last initial (or the first part of your email address if no name is on file), with your points, coins and streaks. They do not see your email address, scores or phishing results.
• A certificate can be looked up on a public page by its verification code, which shows the name, course, date and score on that certificate.

Where it is stored and who processes it

• Lighthouse and its database run on a server operated by CyberPools, hosted by RackNerd in New York, United States.
• System emails (assignments, reminders, certificates) are sent through CyberPools’s Microsoft 365 email service. Simulated phishing emails are sent through mail servers CyberPools operates or, where your organization has granted permission, placed directly into your Microsoft 365 mailbox.
• Microsoft or Google, when you sign in with them or your organization connects its directory.
• Vimeo and YouTube, for training video playback.
• An AI service helps administrators draft phishing templates and quiz content. It receives the text and images an administrator provides and the organization’s name and web domain, not learner records or results. The AI service is Azure OpenAI (Microsoft), running in CyberPools’s own Microsoft Azure account. [To be confirmed by CyberPools: the AI provider’s data-handling terms]

How long we keep it

Lighthouse has no automatic retention or deletion schedule for learner records. Learner accounts with training or simulation history are deactivated rather than deleted, although administrators can remove individual assignments or reset a learner’s progress. [To be confirmed by CyberPools: retention periods for each kind of record and the deletion process when an organization leaves]

Your choices and requests

Questions about your training records or phishing results can go to your organization’s administrator. [To be confirmed by CyberPools: a contact address for privacy questions, and how to ask for access, correction or deletion]

Changes to this notice

This is a draft. CyberPools may change it, and the “Last updated” date above will change when it does.