Entity: Northeast Cybersecurity Service LLC d/b/a CardinalsByte

Effective Date: January 1, 2026

Last Updated: April 14, 2026

​

1. OUR PRIVACY COMMITMENT

Northeast Cybersecurity Service LLC (“Company,” “We,” “Us”) recognizes that the data entrusted to us by CPAs, Financial Institutions, and Telecommunications providers is of a highly sensitive and fiduciary nature. This Policy outlines how we protect that data in accordance with the NY SHIELD Act, CCPA/CPRA, and international data protection standards.

 

2. INFORMATION WE COLLECT

a. Information You Provide to Us

We collect "Personal Information" (PI) and "Non-Public Personal Information" (NPI) when you register for the CardinalsByte GRC Intelligence Platform. This includes:

• Identification Data: Name, business address, professional title, and tax identification numbers.

• Financial Data: Credit card or banking information processed via secure, PCI-compliant third-party gateways.

• Professional Metadata: Industry, firm size, and regulatory jurisdictions (e.g., IRS, SEC, NYDFS).

b. Automated System Data & AI Ingestion

When you use our Services, we automatically collect "Usage Data" and "System Logs."

• Agentic Data: Our autonomous AI Agents process system metadata to identify vulnerabilities.

• PII Redaction: Our ingestion engine is programmed to attempt automated redaction of sensitive PII before it is processed by the Large Language Model (LLM) sub-processors.

​

3. AI AND AGENTIC DATA PROCESSING 

We utilize advanced Artificial Intelligence (AI) and autonomous "AI Agents" to provide automated risk assessments and threat monitoring.

• Enterprise Isolation: We utilize Enterprise-grade API connections (Google Gemini Business/Enterprise). By contract, these providers are prohibited from using Your data to train their global foundational models.

• No Training on Client Data: We do not use Your specific financial, tax, or personal data to "train" or "fine-tune" any AI models used by other customers.

• Automated Decision-Making (ADM): We use AI to categorize risks and flag security incidents. Pursuant to New York law, these processes are monitored by human cybersecurity experts. No "Final Audit" or "Certification" is issued solely by an automated process.

• Duty of Reasonable Care: Pursuant to Colorado SB24-205 (2026), the Company utilizes "Reasonable Care" to protect Subscribers from foreseeable risks of algorithmic discrimination. We maintain a publicly available "AI Impact Statement" and conduct recurring risk assessments to ensure our GRC logic remains objective and free from illegal bias.

​

4. INFORMATION SHARING & SUB-PROCESSORS

We do not sell, rent, or trade Your Personal Information. We share data only with the following categories of sub-processors necessary for the Platform's operation:

• Cloud Infrastructure: Vercel (Hosting) and Supabase (Encrypted Database).

• AI Intelligence: Google Gemini Business (LLM Processing).

• Communication: Standard SMS/Email gateways for system alerts. Mobile Opt-In Data Exclusion: Notwithstanding any other provision in this Policy, mobile opt-in data and consent information will NOT be shared with any third party for any purpose, including marketing or affiliate tracking.

 

5. CALIFORNIA & MULTI-STATE RESIDENT RIGHTS

While we are a New York-based LLC, we extend the following rights to all professional users where applicable:

• Right to Know/Access: You may request a list of the categories of data we have collected and the sub-processors who have handled it.

• Right to Deletion: You may request the deletion of Your data, subject to our legal obligations to maintain audit logs for regulatory compliance (e.g., IRS record-keeping requirements).

• Right to Opt-Out of ADM: You may request a human review of any automated risk-scoring decision.

 

6. DATA SECURITY & THE "HEPPNER" DISCLOSURE

We safeguard Your information with physical, electronic, and administrative procedures, including industry-standard SSL/TLS encryption.

• Encryption-at-Rest: All database volumes in Supabase are encrypted using AES-256.

• The Heppner Waiver Warning: As disclosed in our Terms of Service, Subscriber acknowledges that despite our security measures, the use of AI sub-processors may be viewed by certain courts (Ref: US v. Heppner, 2026) as a waiver of professional privilege. Use of the Platform constitutes an assumption of this risk.
   

7. SMS & MOBILE MESSAGING TERMS

By providing your phone number, you consent to receive text messages from Northeast Cybersecurity Services LLC regarding informational and marketing updates.

• Consent: Consent is not a condition of purchase.

• Opt-Out: Reply STOP to unsubscribe; reply HELP for assistance.

• Privacy: Mobile information is used strictly for Platform alerts and requested marketing; it is never shared for third-party advertising.

• ​

8. ACCESS & UPDATES

You may review and update your personal information at any time by contacting us at cyberinfo@cardinalsbyte.com. We reserve the right to update this Policy as AI regulations evolve. Continued use of the Platform after an update constitutes acceptance of the revised Policy.

​

Right to Access AI Logic (ADMT): Pursuant to the 2026 CCPA/CPRA updates, if our Platform is used to make a "significant decision" regarding Your business or employment status, You have the right to request:

• The specific Personal Information used by the AI to reach that decision.

• The logic and key factors the AI considered.

• An explanation of why the AI reached a specific risk score or compliance finding.

Note: We provide this through our "Explainability Dashboard" to protect our trade secrets while ensuring Your right to transparency.

Additional Privacy :
 

1. DATA SHARING & THIRD-PARTY DISCLOSURE

We do not sell, rent, or lease Your Personal Information to third parties. Disclosure of Your information is strictly limited to the following "Business Purposes" as defined under modern privacy statutes (CCPA/CPRA/GDPR):

• Sub-Processors: We share data with enterprise-level infrastructure providers (e.g., Vercel, Supabase, Google Gemini Business) strictly to facilitate Platform functionality. These entities are contractually prohibited from using Your data for their own independent purposes or to train their global AI models.

• Compliance Mapping: We may share pseudonymized metadata with regulatory databases to provide accurate, real-time GRC mapping (e.g., verifying latest IRS/FTC safeguard updates).

• Legal Necessity: We share information when required by law, as detailed in Section 8 (Information Disclosed for Our Protection)

 

2. INFORMATION SHARED WITH EMPLOYEES & SERVICE PROVIDERS

Access to Your Personal Information is strictly governed by the Principle of Least Privilege (PoLP).

• Internal Access: Access is granted only to Company employees and contractors who require the information to perform specific administrative, technical, or support functions. All such personnel are bound by stringent non-disclosure agreements (NDAs) and specialized cybersecurity training.

• Service Provider Rigor: Third-party service providers (e.g., payment processors, customer support tools) are "Service Providers" under the law. We perform recurring due diligence on these providers to ensure their security controls meet or exceed our internal standards.

​

3. DATA USE: HOW WE USE YOUR PERSONAL INFORMATION

Your information is processed under the following legal bases:

• To Provide Services: Fulfilling Your requests for WISP generation, risk assessments, and GRC tracking.

• For the Operations and Administration of Our Business: This includes "Business Analytics" to ensure the Platform remains stable, scalable, and responsive to Your firm’s needs.

• For Account and Network Security Purposes: We use Your device data and login patterns to proactively detect "Account Takeover" (ATO) attempts and to harden our firewall against adversarial AI attacks.

 

4. SECURITY PROTOCOLS & AGENTIC BOUNDARIES

We utilize "Secure-by-Design" principles to protect Your data from loss, misuse, or unauthorized access.

• Encryption: Data is encrypted at-rest using AES-256 and in-transit via TLS 1.3.

• Agentic Isolation: Our AI Agents operate within "Sandboxed" environments. This prevents data from one Subscriber from ever interacting with the logic or outputs of another Subscriber.

 

5. MARKETING & COMMUNICATIONS

For Our Own Marketing Purposes: We may use Your contact information to send newsletters, product updates, or informational content regarding cybersecurity trends.

• Opt-Out: You may opt-out of marketing communications at any time via the "Unsubscribe" link in any email.

• Transactional Messages: You cannot opt-out of "Administrative" messages (e.g., billing alerts or security breach notifications), as these are required for your protection and our legal compliance.

​

6. COMPLIANCE ENFORCEMENT & MALICIOUS ACTIVITY

To Enforce Compliance with Our Terms and Agreements: We process Your Personal Information to actively monitor for, investigate, and prevent prohibited or illegal activities on our Services. This includes:

• Detecting "Prompt Injection" or attempts to reverse-engineer our proprietary GRC logic.

• Investigating violations of our Acceptable Use Policy.

• Mitigating fraudulent activity that could jeopardize the Company’s reputation or its foundational AI partnerships.

 

7. PROTECTION OF OTHERS & LEGAL DISCLOSURE

Information Disclosed for Our Protection and the Protection of Others: We cooperate with government and law enforcement officials. We may disclose Your information if we have a good-faith belief that such disclosure is reasonably necessary to:

1. Comply with a valid legal process (e.g., subpoena or court order);

2. Protect the safety of any person or the public;

3. Address national security concerns or emergency situations;

4. Defend the Company against third-party legal claims or allegations of malpractice.

 

8. YOUR PRIVACY RIGHTS (CCPA/CPRA/NY SHIELD)

Pursuant to the 2026 Privacy Frameworks, You (and Your clients, where applicable) have the following rights:

A. Right of Know (Access)

You have the right to request, up to twice per year, that we disclose the categories and specific pieces of Personal Information we have collected about You, the sources of that data, and the third parties with whom it was shared.

B. Right to Deletion

You have the right to request that we delete Personal Information collected from You. Important Exception: We may deny Your deletion request if retaining the information is necessary for us to:

• Complete the transaction for which the information was collected;

• Comply with a legal obligation (e.g., maintaining audit logs for IRS/FTC compliance);

• Protect against "Malicious, Deceptive, or Fraudulent" activity.

​

8.1 Right to Opt-Out of Automated Decision-Making (ADMT)

Pursuant to the California ADMT Regulations (2026) and the Colorado Artificial Intelligence Act (CAIA), You have the right to opt-out of any "High-Risk" automated decision-making process that has a "consequential effect" on Your business.

• Our Response: While our AI flags risks, we maintain a "Human-in-the-Loop" requirement. You may request that any AI-generated risk assessment be manually reviewed by a human cybersecurity analyst.

​

8.2 Right to Know AI Training Data & Logic

Under the NY RAISE Act (2026), Subscribers have the right to receive a summary of the types of data used to "prompt" or "guide" our AI Agents.

• Disclosure: We do not use Your "Private Information" (as defined by the NY SHIELD Act) to train global models. Our AI logic is based on publicly available regulatory frameworks (NIST, CIS, IRS Pub 4557) and proprietary Company mapping.

​

8.3 Right to Correction (AI Hallucinations)

You have the right to correct any inaccurate Personal Information or business metadata processed by our AI. If our AI generates a report containing an error about Your firm’s infrastructure, You may submit a correction request, and we will update the underlying data model for Your specific instance within thirty (30) days.

​

8.4 Universal Opt-Out Mechanisms (GPC)

We recognize Global Privacy Control (GPC) signals. If Your browser transmits a GPC signal, our Website will automatically treat it as a request to opt-out of "Targeted Advertising" and the "Sharing" of data for cross-contextual behavioral purposes.

​

9. DATA RETENTION & THE "SHIELD" DISPOSAL RULE

Pursuant to the NY SHIELD Act Administrative Safeguards, we do not retain Your data longer than is reasonably necessary for the business purposes outlined in this Policy.

• Disposal: Once Your subscription is terminated, Your "Private Information" and AI-specific data clusters are securely "wiped" using industry-standard cryptographic erasure within one hundred and eighty (180) days, unless a longer retention period is required for federal regulatory compliance (e.g., IRS audit windows).

​

10. INCIDENT NOTIFICATION & BREACH RESPONSE

10.1 Definition of Breach: Consistent with the NY SHIELD Act, a "Security Breach" is defined as any unauthorized access to, or acquisition of, computerized data that compromises the security, confidentiality, or integrity of "Private Information."

• AI-Specific Access: You specifically acknowledge that unauthorized "Access" includes, but is not limited to:

  • Prompt Injection Attacks: Unauthorized manipulation of AI prompts to exfiltrate system logic or Subscriber data.

  • API Hijacking: Unauthorized use of Platform API keys to bypass front-end security.

  • Model Inversion: Any adversarial attempt to reconstruct training data or individual Subscriber inputs from AI outputs.

10.2 Notification Timelines (The 30-Day Rule):

• To Subscribers: In the event of a confirmed breach affecting Your data, the Company will notify You in the most expedient time possible. Pursuant to the 2025/2026 New York General Business Law amendments, this notification shall occur no later than thirty (30) days after the discovery of the breach, unless a shorter window is required by Your specific industry regulator (e.g., 72 hours for NYDFS-regulated entities).

• To Regulators: * The 500+ Rule: If an incident affects more than 500 New York residents, the Company will notify the New York Attorney General, the Department of State, and the Division of State Police within ten (10) days of the determination that a breach occurred.

  • NYDFS Notification: If the Company determines that a "Cybersecurity Event" has occurred that has a reasonable likelihood of materially harming any material part of the normal operations of the Company, we will notify the NYDFS Superintendent within 72 hours.

10.3 Law Enforcement Deferral: Notification to Subscribers may be delayed if a law enforcement agency determines that such notification will impede a criminal investigation. Such delay shall be authorized only for the period designated by the law enforcement agency in writing.

10.4 Content of Notice: Any breach notification provided to You will include:

1. The categories of information that were, or are reasonably believed to have been, accessed;

2. The approximate date and time of the incident;

3. A summary of the Company’s initial response and containment actions;

4. Standard advice regarding credit monitoring and identity theft protection where applicable.

10.5 Your Cooperation: In the event of a breach originating from Your account (e.g., via Your compromised credentials), You agree to cooperate fully with our forensics team and to provide all necessary logs or documentation requested by state or federal investigators.

 

Contact Us

Name: Founder
Email: cyberinfo@cardinlabytes.com
Phone Number: 1-800-759-1342
Message: Privacy Policy
​Our Privacy Policy may change from time to time and without notification.