Privacy Policy
This policy explains what information CS Concepts collects, why, and what you can do about it. CS Concepts is run by Secure Mango, LLC, a Delaware limited liability company ("we", "us"). It covers the free learning site at learn.securemango.com and the members' deck at cs.securemango.com (together, "the service").
1. Summary
- You can read the free site without an account. We do not use advertising, tracking or analytics cookies.
- If you sign in, we keep your name and email address so we can give you access. If you sign in with Google, we receive only your basic profile (name, email address and profile picture), never your Gmail, Drive, contacts or other Google data.
- Payments are handled by our payment provider. We never see or store your card number.
- We do not sell or rent your personal information, and we do not use it for advertising.
2. Information we collect
When you visit any page
Our web server records standard technical information for each request: IP address, browser type, the page requested, the referring page and the time. We use these logs only to keep the service running and secure, and we delete them after 14 days.
When you watch an embedded video
Videos are embedded from YouTube in its privacy-enhanced mode (youtube-nocookie.com). YouTube does not set cookies until you press play. Once you play a video, YouTube and Google process data under the Google Privacy Policy.
When you sign in with Google
We use Google Sign-In (OpenID Connect) with the scopes openid, email and profile only. Google shares with us your Google account identifier, email address, whether the email is verified, your name and your profile picture address. We store your email address, name and Google account identifier; we do not store your profile picture. We do not request access to any other Google data and cannot post or act on your behalf.
When you sign in with an email link
We store your email address and send you a one-time sign-in link. The link expires after 15 minutes and works once.
When you buy access
Payments are processed by our payment provider (Stripe or Paddle, shown at checkout). The provider collects your payment details and billing country under its own privacy policy and may act as the merchant of record for tax purposes. We receive your email address, the product bought, the amount, the currency, your country, the payment status, and a transaction reference. We never receive your full card number.
When you contact us
If you email us, we keep your message and our reply so we can help you.
3. Cookies
The free site sets no cookies of its own. When you sign in to the members' deck, we set one essential session cookie that keeps you signed in. It is marked Secure and HttpOnly, is used only by our service, and expires after 30 days or when you sign out. We use no advertising, analytics or third-party tracking cookies. Because we only use cookies that are strictly necessary, we do not show a cookie banner.
4. How we use information
- To give you access to the content you are entitled to, and to recognise you when you return.
- To confirm purchases, handle refunds and keep records required by tax and accounting law.
- To answer your questions and send messages about your account or purchase (for example, a sign-in link or a receipt). We do not send marketing emails unless you ask to receive them.
- To keep the service secure, for example to detect shared accounts, abuse or fraud.
If you are in the European Economic Area or the UK, our legal bases are: performing our contract with you (access and purchases), our legitimate interests (security and service operation), and legal obligations (tax and accounting records).
5. Google user data
CS Concepts' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to sign you in and identify your account. We do not use it for advertising, do not sell it, do not use it to train artificial intelligence models, and do not let anyone read it except where needed for security, to comply with the law, or with your consent.
6. Who we share information with
We share information only with service providers that help us run the service, and only as much as they need:
- Hetzner Online GmbH: hosts our servers in Helsinki, Finland (European Union).
- Google: provides Google Sign-In and hosts the embedded YouTube videos.
- Our payment provider (Stripe or Paddle): processes payments and taxes.
- Our email delivery provider: sends sign-in links and receipts.
We may also disclose information if the law requires it, to protect our rights or users' safety, or to a buyer of our business, who would have to follow this policy. We do not sell or share personal information for advertising.
7. International transfers
Secure Mango, LLC is a United States company and our servers are in the European Union. Some providers may process data in other countries, including the United States. Where the law requires it, these transfers are covered by safeguards such as the European Commission's Standard Contractual Clauses.
8. How long we keep information
- Server logs: 14 days.
- Sign-in links: 15 minutes.
- Account information: while your account is active, and up to 12 months after you close it or after your last sign-in, unless you ask us to delete it sooner.
- Purchase records: as long as tax and accounting law requires, usually up to 7 years.
9. Your choices and rights
You can ask us to show you, correct, export or delete your personal information, or object to how we use it, by emailing support@securemango.com. We will answer within 30 days. We may need to keep purchase records that the law requires. You can also remove our access at any time from your Google Account under Security, Third-party apps with account access. If you are in the EEA or UK, you may complain to your data protection authority. California residents have the right to know, delete and correct their information, and not to be discriminated against for using these rights. We do not sell or share personal information as those terms are defined in California law.
10. Security
All traffic uses HTTPS. Sign-in passes through Google or a one-time link, so we never store passwords for your account. Access to our servers and data is limited to the people who run the service. No method of storing or sending data is completely secure, but we take reasonable steps to protect it.
11. Children
The service is for adults and older students studying cybersecurity. It is not directed at children under 16, and we do not knowingly collect information from them. If you believe a child has given us information, contact us and we will delete it.
12. Changes
If we change this policy, we will update the effective date above. If a change is significant, we will tell signed-in users by email or on the site before it takes effect.
13. Contact
Secure Mango, LLC
Email: support@securemango.com
Website: learn.securemango.com