Last updated: 25 October 2026
clvrminds respects your privacy and is committed to protecting personal information collected through clvrLAB, our cybersecurity education and practical training platform.
clvrLAB is operated by clvrminds, a business registered in Singapore.
This Privacy Policy explains what information we collect, how we use and protect it, how cybersecurity training activities may be monitored, how authorised personnel may access information, and the choices and rights available to users.
By registering for or using clvrLAB, you acknowledge that your personal information will be handled as described in this Privacy Policy, subject to applicable law and any consent requirements.
This Privacy Policy applies specifically to clvrLAB. Other clvrminds products and services, including clvrFOOD, may be governed by separate privacy policies.
When you register for or use clvrLAB, we may collect the following categories of information.
We aim to collect information reasonably necessary for the purposes described in this Privacy Policy.
clvrLAB uses account registration and supported authentication methods to manage access to training services.
Users may register using an email address, including Gmail or other supported email providers.
Where email OTP authentication is used, a verification code is sent to the email address provided.
We may process information necessary to:
Email verification establishes access to an email address but does not necessarily verify a person's legal identity.
Authentication information will be handled using appropriate security measures.
clvrLAB is currently intended for individuals aged 18 years or older.
During registration, users may be required to confirm that they meet the minimum age requirement.
We do not intentionally offer independent student registration to individuals below the stated minimum age.
If we become aware that an account was created contrary to applicable eligibility requirements, we may restrict the account and take appropriate action concerning the associated personal information.
Future supervised educational programmes involving younger learners may be subject to separate privacy notices, eligibility requirements and consent arrangements.
clvrLAB provides controlled cybersecurity training environments in which certain user activities may be recorded and reviewed.
This monitoring is intended to support educational delivery, maintain platform security, protect other users and investigate suspected misuse.
Depending on the laboratory, mission and technical capabilities, recorded information may include:
Not every laboratory necessarily records every activity listed above.
Where command-level or network-level monitoring is enabled, the information may be accessible to authorised personnel for legitimate educational, technical support, operational or security purposes.
Users should not expect their activity within managed cybersecurity laboratories to be private from authorised clvrLAB personnel.
Users must not store personal passwords, confidential corporate information, sensitive third-party data or other private information within laboratory environments unless expressly authorised for a legitimate training purpose.
clvrLAB may maintain records of a user's learning activities and achievements.
These records may include:
This information may be used to:
Learning progress records are not automatically made publicly available to other students.
Where rankings, leaderboards or public achievements are introduced, applicable visibility arrangements will be disclosed through the relevant feature.
clvrLAB may provide training services to universities, colleges, training providers, corporate organisations and other approved institutions.
Where a user participates in an institutional programme, authorised trainers or institutional representatives may receive access to information reasonably necessary to administer and evaluate that programme.
Such information may include:
Trainer and institutional access must be limited to assigned students, programmes and legitimate educational or administrative purposes.
Authorisation to monitor a student group does not automatically grant access to unrelated students, institutions or accounts.
Institutions may have their own responsibilities concerning personal data they provide to or receive from clvrLAB.
Additional institutional privacy or data processing arrangements may apply where appropriate.
clvrLAB may use an administrative and operational management interface referred to as the Control Room.
Control Room access is intended for authorised clvrminds personnel performing legitimate platform administration, technical support, training operations, security monitoring and incident investigation duties.
Authorised personnel may include:
Access to personal information and training records must be limited according to assigned responsibilities and applicable permissions.
Depending on their role, authorised personnel may access information necessary to:
Control Room access is subject to appropriate safeguards, which may include:
Access to student records does not automatically authorise unrelated account modifications, disclosure of personal information or unrestricted infrastructure administration.
Administrative access and sensitive operational actions may be recorded in security or audit logs.
Authorised personnel are expected to maintain confidentiality and use information only for legitimate assigned purposes.
Unauthorised copying, downloading, disclosure, distribution or personal use of student information is prohibited.
clvrminds may investigate suspected misuse of administrative privileges and take appropriate corrective action.
We may use personal information to:
We will process personal information for appropriate purposes and in accordance with applicable data protection requirements.
clvrLAB may use cookies, authentication tokens, session identifiers and similar technologies to operate its browser-based services.
These technologies may support:
Some cookies or technologies may be necessary for core platform functionality.
Where non-essential analytics, advertising or other technologies require additional notice or consent under applicable law, clvrminds will provide the necessary choices.
Users may manage certain browser settings, although disabling essential cookies or storage mechanisms may prevent parts of clvrLAB from functioning correctly.
clvrLAB aims to provide logically separated training environments to reduce interference between users.
Students should not be able to access another student's account, training records or laboratory merely because they use the same platform.
Access to laboratory resources is subject to the relevant authentication, authorisation and technical controls.
Users must not attempt to access, monitor or interfere with another student's training environment without appropriate authorisation.
While reasonable measures are intended to protect user environments, no internet-based system or technical isolation mechanism can guarantee absolute security.
clvrminds may use third-party providers to support clvrLAB operations.
These may include providers of:
Third-party providers may process information as reasonably necessary to deliver their services, subject to applicable contractual, privacy and security arrangements.
Where users access external third-party websites or services, those services may be governed by their own privacy policies and terms.
clvrminds does not sell your personal information.
We may share or disclose information where reasonably necessary to:
Information shared with trainers or institutions should be limited to legitimate educational or administrative requirements.
Personal information will not be made publicly available merely because a user participates in a cybersecurity training programme.
clvrminds takes reasonable administrative, organisational and technical measures designed to protect personal information against unauthorised access, disclosure, alteration, misuse and loss.
Such measures may include:
Security controls may evolve as the platform develops.
No internet-based service, cybersecurity platform or electronic storage system can guarantee absolute security.
Users should protect their email accounts, authentication codes and active sessions and promptly report suspected unauthorised access.
Personal information is retained only for as long as reasonably necessary for the purposes for which it was collected, to provide services, resolve disputes, maintain security or comply with applicable legal requirements.
Different categories of information may have different retention periods.
These may include:
Deletion from active systems may not immediately remove information from backups, security logs or records subject to legitimate retention requirements.
When information is no longer required, clvrminds will take appropriate steps to delete, anonymise or otherwise dispose of it in accordance with applicable requirements.
Where an account is suspended or restricted due to suspected misuse, security concerns or a violation of the Terms of Use, clvrminds may retain relevant account information and security records for legitimate operational, investigation or legal purposes.
Account suspension does not automatically result in account deletion.
A suspended account does not, by itself, justify indefinite retention of unnecessary personal information.
Where appropriate, access to personal information may be restricted while an investigation or review is ongoing.
Information will be handled according to applicable retention and privacy requirements.
Subject to applicable law and operational requirements, users may contact clvrminds to request access to, correction of or deletion of their personal information.
Where supported, users may manage:
Users may withdraw consent where applicable, subject to legal or contractual limitations and the consequences of withdrawal for particular services.
Requests involving personal information may require reasonable identity verification.
Deletion requests may be subject to legitimate legal, security, institutional, investigation or retention requirements.
Where required by applicable law, users may have additional rights concerning objection, restriction of processing, data portability or complaints to relevant data protection authorities.
clvrLAB is currently intended for individuals aged 18 years or older.
We do not knowingly provide independent registration or training access to children below this age.
If we become aware that personal information has been collected from an ineligible user, we will take appropriate action in accordance with applicable laws.
Any future supervised educational programmes for younger learners will be subject to additional safeguards, eligibility rules and consent arrangements where required.
clvrLAB may be accessed by users from Singapore and other countries.
The platform may use infrastructure and service providers located in different jurisdictions.
Personal information may therefore be processed, accessed or stored outside the country in which a user resides.
Where personal information is transferred across borders, clvrminds will take reasonable steps to comply with applicable data protection requirements and implement appropriate safeguards.
Such safeguards may include contractual protections, access restrictions, security controls and other measures appropriate to the nature of the information and relevant legal requirements.
clvrminds may investigate suspected or confirmed security incidents affecting personal information or platform operations.
Where appropriate, we may take measures to:
Information concerning an incident may be retained where reasonably necessary for investigation, legal compliance or security improvement.
clvrminds may analyse platform usage, mission completion, training participation and operational performance to improve clvrLAB.
Where appropriate, information may be aggregated or de-identified to produce statistics such as:
Aggregated or de-identified information may be used for legitimate business planning, educational improvement and operational reporting.
Where information remains capable of identifying an individual, it will continue to be handled as personal information under applicable law.
clvrminds may update this Privacy Policy as clvrLAB develops, including when new training environments, authentication methods, monitoring capabilities, payment services or institutional features are introduced.
The latest version will be made available through the platform with an updated effective date.
Where changes materially affect the handling of personal information, clvrminds may provide additional notice or obtain consent or acknowledgement where required.
Material changes concerning training activity monitoring, institutional access or personal information sharing will be communicated as appropriate.
For questions about this Privacy Policy, personal information, privacy rights or data protection requests, please contact:
clvrminds
Singapore
Email: support@clvrminds.com
Website: https://clvrminds.com
We will review privacy-related requests and respond in accordance with applicable legal requirements.
Before completing registration, users must acknowledge the following:
Privacy Policy
[ ] I acknowledge that I have read the clvrLAB Privacy Policy and understand how my personal information will be collected, used and protected.
Cybersecurity Laboratory Monitoring
[ ] I understand that my activities within clvrLAB training environments, including relevant commands, network activity and mission submissions, may be recorded and reviewed by authorised personnel for educational, operational and security purposes.
The registration process must also require acceptance of the separate clvrLAB Terms of Use and confirmation of minimum-age eligibility.
Last updated: 25 October 2026
These Terms of Use govern your registration, access to and use of clvrLAB, a cybersecurity education and practical training platform operated by clvrminds, a business registered in Singapore.
clvrLAB provides browser-based cybersecurity laboratories, simulated environments, practical missions, educational resources and related learning services.
By registering for an account, accessing a training environment or using clvrLAB services, you agree to these Terms of Use and acknowledge our Privacy Policy.
If you do not agree with these Terms, you must not register for or use clvrLAB.
clvrLAB is designed to support cybersecurity education, technical skills development and practical learning through controlled training environments.
Services may include:
Training content, laboratory availability and supported technologies may change as the platform develops.
clvrLAB is an educational platform. It does not authorise users to conduct cybersecurity testing against systems outside their expressly permitted training scope.
Users must be at least 18 years old to register for and independently access clvrLAB.
By registering, you confirm that:
clvrminds may introduce supervised educational programmes for users under 18 in the future, subject to separate eligibility requirements, appropriate consent arrangements and applicable laws.
clvrminds may request reasonable verification of eligibility where necessary.
Certain clvrLAB services require a registered account.
Registration may require your name, email address, institution or other information reasonably necessary to provide the service.
clvrLAB may use email-based one-time passwords (OTP) or other supported authentication methods to verify identity and provide account access.
You agree that:
Email verification confirms access to an email address; it does not necessarily establish a person's legal identity.
clvrminds may restrict registration, require additional verification or suspend accounts where reasonably necessary to protect the platform.
clvrLAB may offer free, trial, educational, institutional and paid membership plans.
Training levels may include:
Different levels may provide access to different laboratories, missions, difficulty settings, training resources and platform capabilities.
Access may depend on:
Registration does not automatically guarantee access to every training level, mission or laboratory.
clvrminds may modify training content, eligibility requirements and available features with appropriate notice where material changes affect users.
All cybersecurity activities performed through clvrLAB must remain within expressly authorised training environments and assigned laboratory boundaries.
Users may conduct security exercises only against targets specifically designated as part of their authorised clvrLAB activities.
Permitted activities may include scanning, enumeration, vulnerability identification, controlled exploitation, password testing and other techniques expressly included within an assigned mission.
Permission to perform a technique in a clvrLAB environment does not constitute permission to perform the same technique elsewhere.
Users must not assume that a system is available for security testing merely because it is publicly accessible, connected to the internet or technically reachable.
Explicit authorisation from the relevant system owner is required before conducting security testing against any external system.
You must not use clvrLAB, its training environments, tools, resources or knowledge gained through its services to facilitate unauthorised or unlawful cybersecurity activities.
Prohibited activities include, but are not limited to:
Learning a cybersecurity technique does not grant legal permission to use it against real-world systems.
Users are responsible for ensuring that their cybersecurity activities comply with all applicable laws and regulations.
These may include laws concerning:
Relevant laws may include those applicable in Singapore, the user's country of residence, the country where an activity takes place and the jurisdiction in which a target system or affected person is located.
For example, Singapore users may be subject to applicable provisions of the Computer Misuse Act 1993, the Cybersecurity Act 2018 and the Personal Data Protection Act 2012, where relevant.
Other jurisdictions may impose different or additional requirements.
Users must obtain appropriate authorisation before undertaking cybersecurity testing outside clvrLAB.
Where local laws restrict particular tools, techniques or activities, users are responsible for complying with those restrictions.
These Terms do not replace applicable legal requirements.
clvrLAB provides controlled laboratory environments intended to separate training activities from production systems and other users.
You agree not to:
Where privilege escalation, exploitation or similar activities form part of a mission, they are permitted only within the expressly designated training target and mission scope.
clvrminds may immediately restrict laboratory access where activity presents a material security risk.
clvrLAB may provide access to security tools, scripts, commands, simulated vulnerabilities and instructional resources.
These materials are supplied for authorised educational purposes.
Users acknowledge that certain cybersecurity tools and techniques are dual-use and may cause harm when applied improperly.
You are responsible for understanding the scope of your authorisation before using any tool or technique.
clvrminds does not endorse or authorise unlawful hacking, unauthorised surveillance, credential theft, malicious exploitation or attacks against third-party systems.
clvrLAB may provide Capture-the-Flag challenges, missions, assessments and other practical exercises.
Users may be required to investigate systems, identify evidence, retrieve flags or complete specified technical objectives.
You agree not to:
Collaboration may be permitted where expressly authorised by the trainer, institution or mission rules.
clvrminds may invalidate results or achievements obtained through misuse, subject to appropriate review.
clvrLAB may award experience points (XP), badges, achievements, completion records or other indicators of progress.
XP and achievements are intended to support learning, motivation and assessment.
They:
clvrminds may revise scoring methods, mission difficulty, hint penalties and achievement requirements as the platform develops.
clvrLAB may support universities, colleges, training providers, corporate organisations and other approved institutions.
Where an institution sponsors or administers training, authorised trainers or institutional representatives may receive access to relevant student participation, progress and assessment information within their assigned scope.
Such access must be limited to legitimate educational, administrative or operational purposes and governed by applicable privacy requirements.
Institutional participation does not authorise a trainer or organisation to access unrelated student accounts, laboratories or confidential information.
Additional institutional agreements may apply where appropriate.
To operate and protect clvrLAB, clvrminds may collect and review relevant operational and security information.
This may include:
Authorised clvrminds personnel may access relevant records for legitimate purposes, including platform administration, troubleshooting, training support, security monitoring, incident investigation and enforcement of these Terms.
Monitoring and access will be subject to appropriate authorisation, confidentiality, access controls and applicable data protection requirements.
Users should not treat clvrLAB training environments as private storage or as suitable locations for confidential personal or business information.
Details of personal data handling, retention and applicable rights will be addressed in the clvrLAB Privacy Policy.
clvrminds processes personal information in connection with account registration, authentication, training delivery, progress tracking, security monitoring and platform administration.
Such information may include account details, email addresses, institutional affiliation, training activity and technical records.
Personal data will be handled in accordance with the clvrLAB Privacy Policy and applicable data protection laws.
Users should not upload real personal data, confidential corporate information, production credentials or sensitive third-party information into training environments unless expressly authorised and necessary for an approved activity.
Users may contact clvrminds regarding applicable privacy rights and account information.
clvrLAB laboratories may be created, suspended, reset, recycled, modified or deleted as part of normal platform operations.
Users acknowledge that:
Users should not rely on laboratory environments for permanent storage.
Account information, learning progress and relevant records may be retained separately according to operational requirements and the Privacy Policy.
clvrLAB may offer paid subscriptions, training licences, institutional access and other commercial services.
Where paid services are introduced, applicable prices, billing periods, renewal terms and material restrictions will be disclosed before purchase.
Payments may be processed by authorised third-party payment providers.
Users are responsible for reviewing the applicable pricing and subscription conditions before completing a purchase.
Cancellation, renewal, refunds and other payment matters will be governed by the terms presented at purchase and applicable consumer protection laws.
clvrminds will not impose undisclosed recurring subscription charges.
Free trials or promotional access may be subject to eligibility requirements and stated expiry conditions.
The clvrminds and clvrLAB names, branding, software, laboratory designs, mission content, instructional materials and other proprietary resources are protected by applicable intellectual property laws.
Unless expressly permitted, users must not:
Users receive a limited, non-exclusive, non-transferable permission to access training materials for their authorised educational use.
Third-party tools and materials remain subject to their respective licences and rights.
Users who identify a suspected vulnerability in clvrLAB infrastructure should report it promptly through the official support channel.
Users must not exploit a suspected vulnerability beyond what is necessary to identify and describe the issue safely.
You must not access unrelated accounts, extract data, establish persistence, disrupt services or publicly disclose sensitive technical information in a manner that creates unnecessary risk.
Discovering a vulnerability does not automatically authorise further testing or exploitation.
clvrminds may establish a separate vulnerability disclosure or bug bounty policy in the future.
No bug bounty, reward or testing authorisation is implied by these Terms.
clvrminds may investigate suspected violations of these Terms and apply proportionate restrictions where reasonably necessary.
Possible actions include:
Serious violations may justify immediate protective action without advance notice.
Account suspension does not automatically result in account deletion.
Where appropriate, users may contact clvrminds to request a review or appeal.
Reinstatement following a confirmed serious security violation is subject to approval by the clvrminds Owner.
An appeal does not guarantee reinstatement.
Any retention of account information or security evidence remains subject to applicable legal and privacy requirements.
clvrLAB provides cybersecurity education, training exercises and simulated technical environments.
Completion of missions, courses or training levels does not guarantee:
Users remain responsible for obtaining appropriate qualifications, permissions and supervision when undertaking real-world cybersecurity activities.
clvrLAB may use third-party infrastructure, software, authentication providers, payment processors and educational resources.
Third-party products and services may be governed by separate terms and licences.
clvrminds is not responsible for the independent acts or services of third parties except where responsibility cannot lawfully be excluded.
Users must comply with applicable third-party software licences and service conditions.
clvrminds aims to maintain reliable and useful training services.
However, clvrLAB may experience interruptions due to maintenance, upgrades, infrastructure limitations, security incidents, technical failures or circumstances beyond reasonable operational control.
Features, laboratory environments, missions, training levels and supported technologies may be added, modified, restricted or discontinued.
Where material changes affect paid services or established user rights, clvrminds will provide appropriate notice and comply with applicable legal obligations.
To the extent permitted by applicable law, clvrminds is not responsible for losses arising from:
Users remain responsible for their own unlawful or unauthorised conduct.
Nothing in these Terms excludes or limits liability, statutory rights, remedies or protections that cannot legally be excluded or limited under applicable law.
clvrminds may revise these Terms as clvrLAB develops or as legal, operational and security requirements change.
The latest version will be made available through the platform with an updated effective date.
Where changes are material, users may receive additional notice or be required to accept the updated Terms before continuing to use relevant services.
clvrminds may maintain records of user acceptance, including the applicable Terms version, acceptance date and associated account.
These Terms are governed by the laws of Singapore, subject to any mandatory rights or protections applicable under relevant law.
Any dispute arising from the use of clvrLAB will be handled in accordance with applicable legal procedures.
For questions concerning these Terms, account access, cybersecurity concerns or suspected platform vulnerabilities, contact:
clvrminds
Singapore
Email: support@clvrminds.com
Website: https://clvrminds.com
Before registering for clvrLAB, users must confirm:
Age confirmation
[ ] I confirm that I am at least 18 years old.
Terms acceptance
[ ] I have read and agree to the clvrLAB Terms of Use and acknowledge the clvrLAB Privacy Policy.
Cybersecurity responsibility
[ ] I understand that cybersecurity tools and techniques learned through clvrLAB must only be used in expressly authorised environments. I agree not to conduct unauthorised testing, hacking or other unlawful activities, and to comply with applicable cybersecurity and computer misuse laws.
All three confirmations are required before registration can proceed.
PRIVACY POLICY — clvrLAB by clvrminds