Privacy Policy

Who We Are

TelcoSec ("TelcoSec", "we", "our", or "us") is the data controller for the personal data described in this policy:

• Country: Portugal
• Privacy contact:[email protected]

1. Data We Collect

• Account data (via Auth0): email address, display name, avatar, login provider, and email-verification status.
• Profile and onboarding data you provide: operator handle, job title, employer, school/institute, city, country, region, faction, interests, and social links.
• Platform activity: lessons, labs and quizzes completed, XP, streaks, achievements, certifications earned, and lab progress.
• ProLab data: the per-user lab SIM credentials and UE configuration generated for you, your WireGuard VPN configuration and connection details, and the hardware you register (e.g. SDRs).
• Payment data: we never receive or store your card number. Payments are processed by Stripe; we keep only the subscription/purchase status and Stripe customer and subscription IDs.
• Messages you send us: contact, training-enquiry and contribution forms (name, email, company, team size, message).
• Technical data: IP address and browser user-agent (rate limiting, abuse prevention and bot checks), and error reports with your user ID, plan and the page URL when something breaks.
• Analytics and advertising data: only with your consent - see section 4.

What Is Public

Your display name/handle, country, faction and XP appear on the leaderboard. Certificates you earn have a public verification page (/verify/…) showing your name, the credential and the issue date, and designation pages show the designation you earned. Anyone with the link can view them.

2. Why We Use It and Our Legal Basis

• Running your account and delivering the courses, labs and certificates - performance of our contract with you (GDPR Art. 6(1)(b)). Without account data we cannot provide the service.
• Payments, invoicing and tax records - contract, and legal obligation (Art. 6(1)(c)).
• Transactional email (email verification, receipts, lab-access and billing notices, notifications you have switched on) - contract.
• Security, fraud and abuse prevention, error monitoring - our legitimate interest in keeping the platform secure and working (Art. 6(1)(f)).
• Customer records in our CRM (HubSpot: your account email, plan and lifecycle stage, and the enquiries you send us) - contract and our legitimate interest in supporting customers and answering enquiries.
• Analytics, session recording and advertising measurement - your consent (Art. 6(1)(a)), which you can withdraw at any time via "Cookie settings" in the footer.

We do not sell your personal data, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

3. Service Providers (Processors)

We share the minimum data each provider needs. They process it on our instructions under a data processing agreement.

• Auth0 (Okta) - sign-in, accounts and sessions (EU tenant).
• Stripe - payments, subscriptions, invoices and the billing portal.
• Resend - delivery of all our email, including the verification, password-reset and welcome emails sent by Auth0.
• Cloudflare - hosting, CDN, database (D1), file storage, and Turnstile bot checks on our forms.
• Sentry - error monitoring (user ID, plan, page URL, technical error details; tokens and cookies are stripped).
• HubSpot - CRM for customer and enquiry records, and (with marketing consent only) website tracking.
• Google Analytics & Microsoft Clarity - usage analytics, heatmaps and session recording (analytics consent only).
• Meta Pixel & LinkedIn Insight Tag - advertising conversion measurement (marketing consent only).
• YouTube (Google) - some lessons embed videos; YouTube receives your IP and device data when a video player loads.

TelcoSec also runs two companion services that share your account: the profile portal (account, subscription and notification settings) and the ProLabs portal (lab provisioning). They are operated by us under this same policy.

4. Cookies and Tracking

Essential cookies keep you signed in and protect the platform; they cannot be switched off. Analytics and marketing tools load only after you opt in to that category in the cookie banner. When you are signed in and have consented, Google Analytics and Clarity link activity to your account ID, and HubSpot tracking links it to your email. See the Cookie Policy for every cookie we use. You can change or withdraw consent at any time via "Cookie settings" in the footer; withdrawing does not affect processing that took place before.

5. International Transfers

Several providers above (including Stripe, Resend, Cloudflare, Sentry, HubSpot, Google, Microsoft, Meta and LinkedIn) are based in, or may process data in, the United States or other countries outside the EEA. Where they do, transfers rely on the EU-U.S. Data Privacy Framework for certified providers, or on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.

6. How Long We Keep It

• Account, profile, progress and lab data - while your account exists. When you delete your account, it is removed from our database immediately, your Auth0 identity is deleted, and any active subscription is canceled.
• Invoices and payment records - 10 years, as Portuguese tax and accounting law requires (held by Stripe and in our accounting records).
• CRM records and enquiries - up to 24 months after our last interaction, or sooner on request.
• Error reports - up to 90 days.
• Rate-limiting and security data (IP-based counters) - minutes to hours.
• Your cookie-consent choice - 6 months, after which we ask again.

7. Your Rights

Under the GDPR you have the right to access, rectify, erase and port your data, to restrict or object to processing (including processing based on legitimate interest), and to withdraw consent at any time.

• Access & export: your profile and progress are visible on your Profile . For a full export, email us.
• Correction: edit your details on the profile portal, or email us for anything you can't change yourself.
• Deletion: delete your account at any time from your Profile. This also cancels any active subscription.
• Consent: change or withdraw it via "Cookie settings" in the footer.

To exercise any right, email [email protected] or use the Contact page. We reply within one month. You also have the right to lodge a complaint with a supervisory authority - in Portugal, the Comissão Nacional de Proteção de Dados (CNPD, cnpd.pt), or the authority where you live or work.

8. Security

We protect your data with encryption in transit (TLS) and at rest, access controls, and secret handling for lab credentials. Card data is handled entirely by Stripe.

9. Changes to This Policy

We update this policy when our processing changes. Material changes are announced by email or in the app before they take effect; the date at the top shows the latest version.