CTF-IED Privacy Policy

The "Last updated" date for this Privacy Policy is set and displayed by the CTF-IED platform. Whenever we make a material change, that date is updated to reflect the current version.

This document is a general template written in plain language to help you understand how CTF-IED handles your data. It is intended to be genuinely useful and specific to our service, but it does not constitute legal advice. If you need advice for your own situation, please consult a qualified lawyer.

By creating an account or using CTF-IED, you agree to the practices described in this Policy.

CTF-IED ("we", "us", "our") is a bilingual (English and Arabic) online cybersecurity and AI learning platform, accessible at ctf-ied.com and operated from Jordan.

We teach hands-on offensive and defensive security and AI skills through lessons and practical labs across four tracks: penetration testing, SOC / blue-team defense, AI/ML, and IT administration.

For any questions about this Policy or your data, you can reach us at [email protected]. This address serves as our primary contact point for privacy matters.

We collect only what we need to run the platform and provide your learning experience. Specifically:

• Account information: your email address, display name, and a securely hashed version of your password. We never store your password in plain text.

• Learning and usage data: your progress through lessons and tracks, your virtual coin balance, and the labs and flags (challenges) you have solved.

• Technical data: your IP address, basic device and browser information, and cookies used for session and authentication purposes.

• Two-factor authentication (2FA) data: if you enable 2FA, we store the information needed to verify your second factor.

• Communications: any messages you send to [email protected] or through our support channels.

Importantly, we do NOT collect or store payment-card details. All card data is handled by our payment processor, as described in the Payment Data section below.

We use the information we collect to:

• Create and manage your account, and authenticate you securely (including via 2FA).

• Deliver lessons and labs, track your progress, award and manage your virtual coins, and record the flags and challenges you solve.

• Operate our subscription tiers (VIP, VIP+, and VIP Master) and give you access to the features they include.

• Send you essential transactional emails, such as email verification, password reset, and account or security notifications.

• Maintain the security, integrity, and reliability of the platform, including detecting abuse and preventing fraud.

• Provide support and respond to your requests.

• Comply with our legal obligations under applicable law.

We do not sell your personal data, and we do not use it for third-party advertising.

We process your personal data on the following bases:

• Performance of a contract: to provide the account, learning content, labs, and subscription features you sign up for.

• Legitimate interests: to keep the platform secure, prevent abuse and fraud, and improve and maintain our service, balanced against your rights.

• Consent: where required, for example for certain optional communications; you may withdraw consent at any time.

• Legal obligation: where we must retain or disclose data to comply with applicable law.

Where a legal framework such as the GDPR applies to you, these bases are how we justify processing. Our operations are governed by the laws of Jordan, as set out in the Governing Law provisions of our Terms.

All payments on CTF-IED (subscriptions and coin purchases) are processed by Lemon Squeezy, which acts as the Merchant of Record. This means Lemon Squeezy is the seller of record for your purchase and handles card processing and the calculation and remittance of any applicable sales tax or VAT.

CTF-IED never sees or stores your payment-card numbers. Your card details are entered directly with Lemon Squeezy and are handled under their security standards and privacy policy.

We receive from Lemon Squeezy only the limited information we need to fulfill your order and keep your account accurate, such as confirmation that a payment succeeded, the plan or item purchased, and your subscription status. We use this to activate your subscription or credit your coins.

Your use of the payment flow is also subject to Lemon Squeezy's own privacy policy, which we encourage you to review.

We rely on a small number of trusted third-party providers to operate CTF-IED. Each processes data only as needed to provide their service to us:

• Lemon Squeezy: our payment processor and Merchant of Record for all subscriptions and coin purchases (see the Payment Data section).

• Resend: our transactional email provider, which delivers essential emails such as verification and password-reset messages. To do this, it processes your email address and the contents of those messages.

• Hosting and infrastructure providers: the servers and infrastructure that host the platform and run our sandboxed lab containers.

We do not sell your data to these or any other parties, and we share data with them only to the extent necessary to run the service.

Note about labs: our hands-on labs run in isolated, sandboxed, time-limited containers that we provide. The offensive and defensive security skills taught are for educational purposes only. Activity you perform inside a lab happens within that sandbox; we log limited technical and progress data (such as which flags you solved) as described in this Policy.

We use cookies and browser local storage sparingly, and primarily to make the platform work rather than to track you:

• Authentication and session: to keep you securely signed in and to protect your account and sessions.

• Preferences: to remember choices such as your language (English or Arabic) and interface settings.

These are essential or functional in nature. We do not use third-party advertising or cross-site tracking cookies.

You can control or clear cookies and local storage through your browser settings, but disabling essential cookies may prevent you from signing in or using core features.

We keep your personal data for as long as your account is active, so that we can provide the service and preserve your learning progress and coin balance.

When you delete your account, we erase your associated personal data. Some limited information may be retained for a short period where necessary to complete transactions, comply with legal or tax obligations, resolve disputes, or protect against fraud and abuse.

Records held by Lemon Squeezy as Merchant of Record (for example, transaction and tax records) are retained under their own policies and applicable law.

Backups and logs are kept only for the limited period needed for security and operational purposes, after which they are deleted or overwritten in the normal course.

We take reasonable technical and organizational measures to protect your data, including:

• Password hashing: passwords are stored only in a securely hashed form, never as plain text.

• Two-factor authentication (2FA): available to add an extra layer of protection to your account.

• Encryption in transit: connections to the platform are encrypted so your data is protected as it travels between you and us.

• Isolated lab containers: hands-on labs run in sandboxed, time-limited environments that are separated from account and platform systems.

No system can be guaranteed to be perfectly secure, but we work continuously to protect your information and to respond promptly if an issue arises.

You have rights over your personal data, including the right to:

• Access the personal data we hold about you.

• Correct inaccurate or incomplete information, such as your email or display name.

• Delete your account and data: you can do this yourself at any time from your account settings, which erases your associated personal data.

• Object to or restrict certain processing, and where applicable, request a copy of your data in a portable format.

• Withdraw consent where our processing relies on it.

You can exercise most of these rights directly in your account settings. For anything else, contact us at [email protected] and we will respond within a reasonable time. You also have the right to complain to a relevant data protection authority.

CTF-IED is intended for adults and older learners, and is not directed at young children. We do not knowingly collect personal data from children below the age at which consent is required under applicable law.

If you are a minor, please use the platform only with the involvement and consent of a parent or guardian, as permitted by local law.

If we learn that we have collected personal data from a child without appropriate consent, we will take steps to delete it. If you believe a child has provided us with personal data, please contact us at [email protected].

We operate from Jordan, and our third-party providers (such as Lemon Squeezy, Resend, and our hosting and infrastructure providers) may process and store data in other countries.

This means your personal data may be transferred to, and processed in, locations outside your own country, where data protection laws may differ from those where you live.

When such transfers happen, we take reasonable steps to ensure your data remains protected, and we rely on our providers' safeguards and applicable legal mechanisms for cross-border transfers.

We may update this Privacy Policy from time to time to reflect changes in our service, our providers, or the law.

When we make a material change, we will update the "Last updated" date at the top of the Policy, and where appropriate we may notify you through the platform or by email.

Your continued use of CTF-IED after an update takes effect means you accept the revised Policy. We encourage you to review this page periodically.

If you have any questions, requests, or concerns about this Privacy Policy or how we handle your data, please contact us at [email protected].

We will do our best to respond to your inquiry within a reasonable time.