Home / Privacy Policy
Privacy Policy
Effective date: 2026-11-14
1. Who we are
In this policy, "CyberMedia", "we" and "us" mean the operator of the website cybermedia.ai, reachable at hello@cybermedia.ai. This policy explains what personal data we collect on the site, why, how we use and protect it, and what rights you have. This policy is governed by the laws of Hong Kong, including the Personal Data (Privacy) Ordinance (Cap. 486).
2. What we collect and why
We only collect what we need to provide our services.
- Sign-in email: When you sign in with your email, we store your address and send you a one-time sign-in link. It works for 30 minutes and only once. We use it to identify your account so you can see your orders and saved items.
- Orders and payments: When you submit a tool or a GPT, skill or agent listing, book an ad placement, or buy a guest post or another service, we store: the order details (such as the tool's name, description, website, category, ad title, run dates or guest post text); the logo and thumbnail you upload (stored in Cloudflare R2); the amount and order status; and the order and transaction IDs PayPal sends back. We use these to process the order, review the content, publish it, handle refunds and keep transaction records.
- Ad and service inquiries: When you send an inquiry, we store your email and what you enter: placement, period, service type, project goal, timing, budget and message. Service inquiries can also include your name and company. We use this to reply and send quotes.
- Order and inquiry alerts: When a new order is paid, or someone sends an ad or service inquiry, our system emails the order or inquiry details to our own inbox so we can handle it quickly.
- Tool corrections: When you report a mistake on a tool page, we store your report. Your email is optional. We use it to check and fix the listing, and to contact you if needed.
- Newsletter: When you subscribe to CyberMedia Picks, we store your email, language, the page you signed up on, the version of the consent text you agreed to, and when you confirmed or unsubscribed. Your subscription only starts after you click the link in our confirmation email (double opt-in). Unconfirmed addresses don't count as subscribed and don't receive CyberMedia Picks. We use this to email you once you've agreed, and to keep a record of your consent. For how long we keep these records, see section 6.
- Email records and suppression list: When we send you sign-in, order, subscription confirmation or similar emails, we record the recipient address, the type of email and its sending status, plus results our email service reports back (such as delivered, bounced or complained). If you unsubscribe, an email to you bounces, or you mark one of our emails as spam, your address goes on a suppression list. We use this to confirm delivery and to make sure we don't email people who have unsubscribed.
- Saved items: Tools and news you save while signed in are kept in your account. You can remove them at any time.
- Form drafts: While you fill in a submission form, a draft is kept in your own browser (local storage) so it can be restored when you come back to the page. It isn't sent to us. The draft is deleted once your order reaches the payment page, or when you click "Clear form". Uploaded logos and thumbnails aren't kept in the draft.
- Page counts and search data: We count how many times each type of page is viewed per day. This is only a count; it doesn't record who visited. We don't use Google Analytics, and the site doesn't load any other analytics or tracking scripts. We use Google Search Console to see how the site performs in Google Search. Its data comes from Google Search itself; the site doesn't load a script or set a cookie for it.
- IP addresses and logs: Our site's code does not store your IP address in our database. To deliver and protect the site, our host Cloudflare processes the technical information every visit needs, such as your IP address and browser details. We keep Cloudflare's runtime logs and tracing switched on to troubleshoot problems.
3. Cookies and local storage
Our own code only uses cookies the site needs to work. It doesn't use analytics, advertising or tracking cookies.
| Name | Purpose | Expires |
|---|---|---|
| cm_user | Keeps you signed in | 14 days |
| cm_csrf | Protects forms so no one else can submit them as you | 12 hours |
| cm_session | Admin sign-in only, for site staff | 12 hours |
| cm_bar_hide | Remembers that you closed the ad bar at the top of the home page, so it stays hidden for the rest of the day. It only records whether you closed our own ad-spot notice or a specific sponsor's ad, and contains no personal information. | Until 24:00 Beijing time (UTC+8) on the day you close it |
All four cookies are HttpOnly, so scripts on the page can't read them.
Form drafts are kept in your browser's local storage; see section 2.
On news pages with an embedded X post, and on the PayPal payment page, scripts from X and PayPal may use cookies or similar technologies under their own privacy policies.
4. Third-party services
We use the following third-party services, and only share data with them when it's needed to run our services:
- Cloudflare: hosts the site and stores our data (Workers, D1, KV, R2); receives email sent to hello@cybermedia.ai; and sends sign-in links, order confirmations, subscription confirmations and similar emails (Cloudflare Email Sending). When we send an email, we give it your address and the content of the email.
- Google (Gmail): email sent to hello@cybermedia.ai, and our order and inquiry alerts, are sent or forwarded to our Gmail inbox. Google handles these emails under its own privacy policy.
- PayPal processes payments. You enter your payment details directly with PayPal. We never receive your card number, only the order and transaction IDs PayPal sends back. PayPal handles your data under its own privacy policy.
Some news pages also embed posts from X. Those pages load content from X, and X may collect information about your visit under its own privacy policy; pages without an embedded post don't load anything from X. News images, some tool logos and the logos in banner ads are loaded directly from their original websites. Your browser requests these images from those sites directly, so they can see your IP address and browser details.
5. International transfers
Cloudflare runs on a global network, and Google and PayPal also process data in many countries and regions. Your data may therefore be stored or processed outside Hong Kong.
6. How long we keep data
We keep the following for up to 2 years: email sending records; subscription records that were never confirmed or have been unsubscribed; ad and service inquiries; and tool corrections. The 2 years count from the last day you used our services. "Using our services" means signing in, subscribing, confirming a subscription, sending an inquiry, sending a correction or placing an order with the same email.
Records older than 2 years are deleted automatically.
Your account and the time you last signed in, your saved items, and any address that is still subscribed are kept until you ask us to delete them; see sections 7 and 11.
Order and invoice records (including what you submitted with an order, such as tool details, ad creatives and guest posts), and our suppression list, are handled separately and aren't covered by the 2 years above: order and invoice records are kept for 7 years from the date of payment, and the suppression list is kept permanently so we never email people who have unsubscribed.
You can also ask us to delete your data sooner at any time; see section 11.
7. Your rights
Under the Personal Data (Privacy) Ordinance, you can: access, and get a copy of, the personal data we hold about you; and ask us to correct data that is inaccurate.
You can unsubscribe from marketing emails at any time, using the unsubscribe or manage link in any email, or by contacting us.
You can also ask us to delete your data. We'll check the request by hand and then act on it.
Please contact us from the email you use on our site so we can verify your identity. We'll reply within the time the Ordinance requires.
8. Who the service is for, and children
Our site is for users worldwide. You must be at least 16 to use our services.
9. Security
We take reasonable steps to protect your data: sign-in links and sign-in credentials are stored only as hashed values, never in plain text; the sign-in cookie can't be read by scripts on the page; forms are checked to prevent forged submissions; and only authorized staff can access the admin area. Even so, no transmission or storage over the internet can be guaranteed 100% secure.
10. Changes to this policy
We may update this policy. When we do, we'll post the new version on this page and change the effective date above.
11. Contact us
For any privacy question or request, contact us. For privacy requests, email is best, so we can verify your identity.
Email: hello@cybermedia.ai
WeChat: on a computer, hover over the WeChat icon to show the QR code. On a phone, tap the icon.
