CyRep Terms of Service

1. Scope and Acceptance

These Terms form a binding agreement between you and CISOAIA. They apply to all use of CyRep, including the web app (Progressive Web App), the iOS application, and any features or content made available through these platforms.

By creating an account, signing in, or otherwise using CyRep, you accept these Terms in full. If you do not agree with any part of these Terms, you must not use CyRep.

These Terms should be read alongside our Privacy Policy, which explains how we collect and process your personal data.

2. Description of Service

CyRep is a gamified cybersecurity awareness and training application. It is designed to help individuals understand cybersecurity risks, build good security habits, and develop practical knowledge through engaging learning formats.

CyRep includes, but is not limited to, the following features:

• Learning modules covering cybersecurity topics such as phishing, password hygiene, social engineering, and secure browsing.
• Quizzes and interactive scenarios to reinforce learning and test knowledge.
• Gamification elements including streaks, points, badges, and leaderboards.
• AI coaching that provides personalised guidance, tips, and feedback based on your progress (see Section 7 for important disclosures and limitations).
• Progress tracking and performance summaries.

Some features are available only on the paid subscription plan. The distinction between free and paid features is described in Section 4.

We may update, extend, or modify the features of CyRep from time to time, as described in Section 8.

2.1 Technical Requirements and Compatibility

CyRep is a web-based Progressive Web App (PWA) accessible via modern browsers on desktop and mobile, and as a native iOS application. Recommended browsers: Chrome 100+, Firefox 100+, Safari 15+, Edge 100+.

No digital content is available for download; all content is accessed online through your account. CyRep does not apply digital rights management (DRM) restrictions to learning content. CyRep does not currently interoperate with third-party learning management systems (LMS) or export completion certificates to external platforms unless explicitly stated within the app.

The AI coach feature is powered by third-party AI inference services; see Section 7.

3. Account Registration

3.1 Eligibility

You must be at least 18 years old to create an account and use CyRep. By registering, you confirm that you are 18 years of age or older. If you are under 18, you may not use CyRep.

3.2 Registration and Authentication

To use CyRep, you must create an account using one of the following methods:

• Email magic link — we send a sign-in link to your email address.
• Apple Sign-In — via your Apple ID.
• Google Sign-In — via your Google account.

You agree to provide accurate, current, and complete information during registration and to keep your account details up to date.

3.3 One Account Per Person

Each person may hold only one CyRep account. Creating multiple accounts for the same individual is not permitted. Accounts are personal and non-transferable.

3.4 Account Security

You are responsible for maintaining the security of your account. You must notify us promptly at hello@cisoaia.com if you believe your account has been accessed without your authorisation. We are not liable for any loss or damage resulting from unauthorised access to your account where you have failed to take reasonable precautions.

4. Free and Paid Plans

4.1 Free Tier

CyRep's core learning content is always available free of charge. We are committed to the principle that learning is never paywalled. The free tier includes access to learning modules, quizzes, and foundational content without any time limitation.

4.2 Paid Subscription — CyRep Pro

CyRep offers a paid subscription plan ("CyRep Pro") that unlocks additional convenience and premium features, which may include advanced analytics, priority access to new content, enhanced gamification features, and other benefits described in the app.

Before completing your subscription purchase, you will be presented with a pre-purchase summary showing: the plan name, price (including VAT where applicable), billing frequency, auto-renewal terms, and the total amount charged today. The final confirmation button uses the label "Subscribe — payment required" (or equivalent unambiguous language) to make clear that clicking it creates a payment obligation.

Payments for web subscriptions are processed securely by Stripe. By subscribing, you authorise CISOAIA to charge the applicable subscription fee to your chosen payment method via Stripe.

4.3 Pricing

Current pricing for CyRep Pro is displayed within the app and at cyrep.cisoaia.com. All prices are shown in the applicable currency and include VAT where required by applicable law.

4.4 Auto-Renewal and Cancellation Notice

Your CyRep Pro subscription renews automatically at the end of each billing period (monthly or annual, depending on the plan you selected) unless you cancel before the renewal date.

Monthly subscriptions: you may cancel at any time before your next monthly renewal date to avoid the next charge.

Annual subscriptions: you may cancel at any time. We will send you a reminder at least 30 days before any annual renewal date. To avoid renewal, cancel before the renewal date.

Maximum notice period: regardless of your plan, you may always cancel your CyRep Pro subscription with no more than 30 days' notice, effective at the end of the current billing period.

4.5 Right of Withdrawal (EU and Swiss Consumers — Web Subscriptions)

If you are a consumer resident in the EU, EEA, or Switzerland and you subscribed directly through our web app, you have a statutory right of withdrawal within 14 days of your initial subscription purchase.

How the withdrawal right works for digital services: because CyRep is a digital service, we ask you at checkout — via a checkbox — to (a) expressly request that performance of your subscription begins immediately (before the 14-day withdrawal period ends) and (b) acknowledge that you will lose your right of withdrawal once performance has begun. If you tick this checkbox and confirm your purchase, your right of withdrawal is extinguished once we begin providing the service.

If you did not provide this express consent and acknowledgment at checkout, your 14-day right of withdrawal remains intact regardless of how much you have used the service. To exercise your right of withdrawal, contact us at hello@cisoaia.com or use the online withdrawal button in your account settings (see Section 4.6 below).

Cancellation of a subscription after the withdrawal period has elapsed is governed by Section 4.4 above and does not entitle you to a refund for any used portion of the billing period, unless required by applicable mandatory law.

4.6 Online Withdrawal Button (EU Consumers — Directive 2023/2673)

If you are a consumer resident in the European Union, you may also withdraw from your subscription contract using the "Withdraw from contract" button available in your CyRep account settings.

The process is as follows:

1. Click the "Withdraw from contract" button in account settings.
2. A confirmation screen will display the details of your withdrawal, including refund information.
3. Click "Confirm withdrawal" to complete the process.

Upon confirmation, we will acknowledge your withdrawal by email and process a full refund within 14 days. This button will be available no later than 19 June 2026, in compliance with Directive 2023/2673.

4.7 Cancellation — General

You may cancel your subscription at any time through your account settings. Cancellation takes effect at the end of the current billing period — you will retain access to paid features until that date. We do not offer partial-period refunds unless required by applicable mandatory law or exercised under the withdrawal right in Section 4.5.

4.8 In-App Purchases (iOS)

If you subscribe via the iOS App Store, Apple's payment terms and refund policies apply. Cancellations must be made through your Apple ID account settings. CISOAIA has no ability to process refunds for App Store purchases.

5. User Content and Conduct

5.1 Acceptable Use

You agree to use CyRep only for lawful purposes and in a manner consistent with these Terms. You must not use CyRep to:

• Violate any applicable law or regulation.
• Impersonate any person or entity or misrepresent your affiliation with any person or entity.
• Interfere with or disrupt the integrity or performance of CyRep or its underlying infrastructure.
• Attempt to gain unauthorised access to CyRep, its systems, or any related services.
• Upload or transmit any malicious code, malware, or harmful content.

5.2 Quiz Content and Educational Materials

CyRep's quizzes, scenarios, and educational materials are intended for personal learning only. You must not:

• Share, distribute, reproduce, or publish quiz questions, answers, or scenario content for commercial purposes.
• Sell or license access to CyRep's content or any derivative works based on it.
• Use CyRep's content to create competing training products or services without our prior written consent.

Personal note-taking and sharing content for non-commercial educational discussion is permitted.

5.3 No Automated Access

You must not access CyRep using automated tools, bots, scripts, or similar means without our prior written permission. This includes using automated means to complete courses, accumulate points, or manipulate gamification elements.

5.4 User-Generated Content

Where CyRep allows you to submit content (such as community posts or feedback), you retain ownership of that content but grant CISOAIA a non-exclusive, worldwide, royalty-free licence to use, display, and reproduce it for the purpose of operating and improving the service. You confirm that any content you submit does not infringe third-party rights and is not unlawful.

6. Intellectual Property

6.1 CISOAIA Ownership

All content, materials, and features within CyRep — including but not limited to text, graphics, course content, quiz questions and answers, scenarios, gamification elements, software, and the CyRep and CISOAIA trademarks and logos — are owned by or licensed to CISOAIA and are protected by applicable intellectual property laws.

6.2 Personal Licence

Subject to these Terms, we grant you a limited, non-exclusive, non-transferable, revocable licence to access and use CyRep for your own personal, non-commercial learning purposes. This licence does not include any right to:

• Copy, reproduce, or distribute CyRep's content beyond what is necessary for personal use.
• Modify, adapt, translate, or create derivative works from CyRep's content.
• Reverse-engineer, decompile, or disassemble any part of CyRep's software.
• Sublicence or transfer your rights to any third party.

6.3 Feedback

If you provide feedback, suggestions, or ideas about CyRep, you grant CISOAIA the right to use that feedback without restriction or compensation to you.

7. AI Coach — Disclosures and Limitations

CyRep includes an AI coaching feature that provides personalised guidance, tips, explanations, and feedback based on your activity and progress within the app.

7.1 AI Transparency Disclosure (EU AI Act Art. 50)

Before you interact with the AI coach for the first time, and at the start of each new session, you will be clearly informed that you are interacting with an AI system, as required by EU Regulation 2024/1689 (EU AI Act), Article 50. All AI-generated responses are labelled as AI-generated within the app interface.

The AI coach is powered by third-party AI inference services (currently OpenAI, DeepL, and Groq, Inc. — all US-based). Your message and relevant learning context are processed by these services to generate responses in real time. We do not send your name or email address to these providers; only your message and pseudonymous learning context are included.

7.2 Limitations

• The AI coach provides general educational information only. It does not constitute professional cybersecurity advice and should not be relied upon as a substitute for qualified professional guidance in specific security situations.
• AI-generated content may occasionally contain errors, inaccuracies, or outdated information. We strive to improve quality over time but cannot guarantee that AI outputs are always accurate or complete.
• The AI coach is not designed for, and must not be used for, diagnosing live security incidents, conducting security assessments, or making critical organisational security decisions.

7.3 Data Security Warning

If you are dealing with a live security incident or require professional security advice, please consult a qualified cybersecurity professional.

7.4 Fair Use

The CyRep Pro AI coach is unlimited for normal individual educational use. Automated or programmatic usage exceeding approximately 50 messages per 24-hour period may be subject to fair-use rate limiting, consistent with industry practice. Fair-use limits are not applied to genuine personal learning activity.

8. Availability and Changes

8.1 Uptime

We strive to make CyRep available at all times, but we do not guarantee uninterrupted or error-free access. CyRep may be temporarily unavailable due to maintenance, technical issues, or circumstances beyond our control.

8.2 Modifications to the Service

We reserve the right to modify, update, add, or remove features and content at any time. Where a change significantly affects free or paid functionality, we will endeavour to give you reasonable advance notice — either in-app or by email — before the change takes effect.

8.3 Discontinuation

In the event we decide to discontinue CyRep entirely, we will provide at least 30 days' notice via the app and/or email. Where you hold an active paid subscription at the time of discontinuation, we will provide a pro-rata refund for any unused period of your subscription.

9. Limitation of Liability

9.1 Disclaimer of Warranties

CyRep is provided on an "as is" and "as available" basis. To the fullest extent permitted by applicable law, CISOAIA makes no warranties — express or implied — regarding the accuracy, completeness, reliability, or fitness of CyRep for any particular purpose.

9.2 Cap on Liability

To the fullest extent permitted by applicable mandatory law, CISOAIA's total aggregate liability to you for any claims arising out of or in connection with these Terms or your use of CyRep shall not exceed the greater of (a) the total amounts you paid to CISOAIA in the 12 months immediately preceding the event giving rise to the claim, or (b) CHF 100 — provided that the CHF 100 floor applies only where permitted by the mandatory law of your jurisdiction.

Where mandatory consumer protection law in your country of habitual residence sets a higher or different standard, that mandatory standard prevails over the cap above.

9.3 Exclusion of Indirect Damages

To the extent permitted by applicable mandatory law, CISOAIA shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to loss of profits, loss of data, or loss of goodwill, whether arising in contract, tort, or otherwise.

9.4 Mandatory Carve-Outs

Nothing in these Terms limits or excludes any liability that cannot be lawfully excluded or restricted under applicable mandatory law, including:

• (a) liability for death or personal injury caused by negligence;
• (b) liability for fraud or fraudulent misrepresentation;
• (c) for EU consumers: any statutory rights you hold under EU consumer protection law, including rights under the EU Consumer Rights Directive and EU Directive 93/13/EEC on unfair contract terms, that cannot be contractually restricted;
• (d) for UK consumers: any statutory rights you hold under the Consumer Rights Act 2015 or any other mandatory UK consumer protection law.

To the extent any provision of Sections 9.2 or 9.3 conflicts with applicable mandatory consumer law, that mandatory law prevails.

10. Termination

10.1 Termination by You

You may close your account at any time through the account settings in the app, or by contacting us at hello@cisoaia.com. Closing your account will end your access to CyRep. If you hold an active paid subscription, your access continues until the end of the current billing period (Section 4.7 applies).

10.2 Termination by CISOAIA

We may suspend or terminate your account if:

• You breach these Terms in a material way and, where the breach is capable of remedy, fail to remedy it within a reasonable period after receiving notice from us.
• We are required to do so by applicable law or a regulatory authority.
• We discontinue the CyRep service (Section 8.3 applies).

Where possible, we will give you advance notice before suspension or termination.

10.3 Effect of Termination

Upon termination of your account, your licence to use CyRep ends immediately. We will handle your personal data in accordance with our Privacy Policy, including applicable data retention and deletion procedures. You may request deletion of your personal data at any time by writing to privacy@cisoaia.com.

11. Dispute Resolution

11.1 Informal Resolution

Before bringing any formal legal proceedings, we encourage you to contact us first so we can attempt to resolve the issue informally. Please write to us at hello@cisoaia.com describing the nature of your complaint. We will acknowledge your message within 5 business days and aim to reach a resolution within 30 days.

11.2 EU Online Dispute Resolution

If you are a consumer resident in the European Union and we cannot resolve your complaint informally, the European Commission provides an Online Dispute Resolution (ODR) platform at https://ec.europa.eu/consumers/odr. CISOAIA's contact email for ODR purposes is hello@cisoaia.com. We are not obliged to participate in alternative dispute resolution procedures, but we will engage in good faith with any ODR complaint submitted through that platform.

11.3 Governing Law

These Terms and any disputes arising out of or in connection with them — including non-contractual disputes — are governed by and construed in accordance with Swiss law, in particular the Swiss Code of Obligations (Obligationenrecht, OR).

This choice of law does not deprive you, as a consumer, of the protection afforded by mandatory provisions of the law of your country of habitual residence that cannot be derogated from by agreement (in accordance with Rome I Regulation Art. 6(2) for EU consumers and equivalent rules for other jurisdictions).

11.4 Jurisdiction

The place of jurisdiction for any disputes between you and CISOAIA shall be the courts competent for Seuzach, Canton of Zurich, Switzerland, unless mandatory provisions of applicable consumer protection law designate a different or additional jurisdiction.

EU consumers may also bring proceedings before the competent courts in their country of habitual residence.

12. California and US Users

CyRep does not sell or share personal information as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA). We do not use personal information for cross-context behavioural advertising.

CyRep honors the Global Privacy Control (GPC) browser signal. If we detect a valid GPC signal from a California resident, we treat it as an opt-out of any sharing of personal information for cross-context behavioural advertising purposes.

California residents may exercise their CCPA rights by contacting privacy@cisoaia.com.

13. Accessibility

We are committed to making CyRep accessible to as many people as possible. We aim to meet Web Content Accessibility Guidelines (WCAG) 2.1 Level AA standards across the web app and work to address accessibility issues promptly when they are identified. If you encounter an accessibility barrier or have a specific access need, please contact us at hello@cisoaia.com.

14. Contact Information

If you have any questions, concerns, or requests relating to these Terms or your use of CyRep, please contact us:

15. Changes to These Terms

We may update these Terms from time to time to reflect changes in our service, applicable law, or business practices. When we make material changes, we will notify you by:

• Displaying a notice within the CyRep app, and/or
• Sending an email to the address associated with your account.

The updated Terms will state a new "Last updated" date at the top. If you continue to use CyRep after the effective date of the updated Terms, you are deemed to have accepted the changes. If you do not agree with the updated Terms, you must stop using CyRep and may close your account as described in Section 10.1.

For minor or non-material changes (such as corrections, clarifications, or editorial updates), we may update the Terms without formal notification, though the "Last updated" date will always reflect the most recent revision.