Privacy Policy
Last updated: September 13, 2026
Oberon Services ("Oberon," "we," "us") operates Oberon Playground (the "Platform"), a cybersecurity awareness training service. This Privacy Policy explains what personal information we collect, how we use it, and the choices you have. It applies to all three account types: Employees enrolled by a client organization, Students enrolled by a partner educational institution, and members of the General Public who register directly.
Information We Collect
Account information: name, email address, and optionally phone number. For Employees: company and department, optionally an employee ID. For Students: institution name, batch/cohort, and optionally a student ID. Training activity: lesson progress, quiz results, and issued completion certificates. Technical data: your IP address, used only transiently to prevent abuse of sign-in and sign-up, and session tokens needed to keep you signed in. If you enable optional two-factor authentication, a cryptographic authentication factor tied to your account — we never see your authenticator app's contents. We do not collect payment information, since the Platform has no paid tier at this time.
Age Requirement for Self-Registered Accounts
You must be at least 18 years old to create a General Public account directly. The Student track is only available through enrollment by a partner educational institution, which is responsible for confirming any necessary parental or guardian consent has been obtained for students under the age of majority, consistent with applicable law, before enrolling them.
How We Use Your Information
To create and manage your account and deliver training relevant to your track. To track your progress and issue completion certificates. To give your sponsoring organization or institution's authorized administrators visibility into Employee/Student training progress — General Public accounts are never visible to any organization. To maintain Platform security, including abuse prevention and administrative audit logging. To communicate with you about your account, such as password resets. We do not send marketing email.
Where and How Your Data Is Stored
The Platform is hosted on infrastructure located in Bangladesh; we do not use third-party cloud platforms to store your personal information. Safeguards in place include access controls limiting each user to their own data, encrypted transmission between your browser and our servers, rate limiting on authentication, daily automated backups, optional two-factor authentication, and audit logging of administrative actions. No system can guarantee complete security, and we cannot promise information you provide will never be exposed to unauthorized access, but we take reasonable, ongoing steps to protect it.
Sharing Your Information
We do not sell your personal information, and we do not currently use third-party advertising or analytics services. We may in the future use a third-party provider solely to deliver account-related emails, such as password resets; if so, that provider will process only your email address, strictly to provide that service on our behalf.
Certificates and Public Verification
Completion certificates include a unique verification code that lets anyone with the code confirm it's genuine, along with the recipient's name and course completed — this is intentional, so you can share proof of completion. If your account is later deleted, any certificates issued to you are deleted too, and any previously shared verification link will stop working.
How Long We Keep Your Information
Active accounts: for as long as the account remains active. Deactivated accounts: retained for up to 3 years to preserve historical training records, unless deletion is requested sooner. Backups: retained on a rolling 7-day basis. Administrative audit logs: retained for up to 2 years. You, or your organization's administrator for Employee/Student accounts, may request deletion at any time.
Your Rights
You may have rights to access, correct, or delete your personal information, subject to applicable law. Employees and Students should generally contact their organization's or institution's administrator first. General Public users may contact us directly.
Data Breach Notification
If a breach occurs affecting your personal information, we will notify affected users without undue delay, consistent with applicable law.
Cookies
The Platform uses one non-tracking cookie to remember a display preference. It does not identify you. Your sign-in session is stored in your browser rather than in cookies.
Changes to This Policy
We may update this Privacy Policy as our practices evolve. Material changes will be communicated within the Platform.