This Privacy Policy explains how Cyla AI (“Cyla AI”, “we”, “us” or “our”) collects, uses, discloses and safeguards information when you use the Cyla AI platform at https://cylaai.com and any related services, applications and APIs (together, the “Service”).
Cyla AI is a multi-tenant software-as-a-service platform for digital marketing agencies. It combines CRM, ERP, AI and messaging tools in a single workspace. Our customers are agencies (each a “Workspace”), and those agencies use Cyla AI to manage their own clients, leads and conversations. Where we process data on behalf of an agency, that agency is the data controller and Cyla AI acts as a data processor; where we process data about the agency’s own account and users, we act as a controller.
1. Information we collect
We collect the following categories of information.
Account information
When you or your agency creates an account, we collect your name, email address, password (stored only as a secure hash), workspace name, role, profile details, billing contact information and authentication data (including data from Google sign-in if you choose to use it).
CRM and lead data
Agencies store business data in Cyla AI, including contacts, leads, clients, deals, projects, proposals, invoices, notes, tasks and related records. This data belongs to the agency and may include personal information about the agency’s own customers and prospects.
Connected-channel messaging data
If your agency connects a messaging channel, we process the conversation and contact data made available through official provider APIs. This includes WhatsApp Business, Instagram and Facebook Messenger data obtained through Meta Platforms’ official APIs, with the consent of the connecting user. Such data may include message content, sender and recipient identifiers, timestamps, message status, media attachments and contact profile details permitted by the provider.
Usage, device and cookie data
We automatically collect certain technical information when you use the Service, such as IP address, browser and device type, pages viewed, actions taken, referring URLs and timestamps. We use strictly necessary cookies to keep you signed in and to secure your session, and limited analytics cookies to understand and improve the Service. You can control non-essential cookies through your browser settings.
2. How we use information
- To provide, operate, maintain and secure the Service.
- To authenticate users, manage workspaces and enforce role-based access controls.
- To power features you request, including AI-assisted proposals, content, insights and messaging workflows.
- To send and receive messages on connected channels at your direction.
- To provide customer support and respond to your requests and enquiries.
- To process payments and manage subscriptions and billing.
- To monitor, troubleshoot, prevent abuse and improve the reliability and performance of the Service.
- To comply with legal obligations and enforce our Terms of Service.
We do not sell your personal information, and we do not use connected messaging data for advertising.
3. AI processing
Some features use artificial intelligence to generate proposals, content, summaries and insights from the data you provide. To deliver these features, relevant content may be sent to third-party AI providers acting as our subprocessors under confidentiality obligations. We do not permit these providers to use your content to train their foundation models except where you have explicitly opted in.
4. Legal bases for processing
Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases: performance of a contract (to provide the Service you or your agency requested); legitimate interests (to secure, support and improve the Service, balanced against your rights); consent (for optional features, non-essential cookies and connecting third-party channels); and compliance with legal obligations. You may withdraw consent at any time without affecting processing already carried out.
5. Data obtained from Meta Platforms
Data that we obtain through the Meta Platforms APIs (including WhatsApp, Instagram and Facebook Messenger) is collected, used and stored in accordance with the Meta Platform Terms and Meta Developer Policies. We only request the permissions needed to provide the features you connect, we use this data solely to provide those features to your agency, and we delete it on request or when a channel is disconnected, as described in our Data Deletion instructions.
6. How we share information
We share information only as described below and do not sell it:
- Within your workspace. Data is accessible to authorised users of your agency according to their role and permissions.
- Subprocessors. We use trusted service providers to run the Service, including cloud hosting and database infrastructure, authentication, payment processing, email delivery, error monitoring and AI providers. They may process data only on our instructions and under contractual confidentiality and security obligations.
- Connected platforms. When you send messages or sync data, information is shared with the relevant platform (such as Meta) to carry out your request.
- Legal and safety. We may disclose information where required by law, legal process, or to protect the rights, property or safety of Cyla AI, our users or the public.
- Business transfers. In connection with a merger, acquisition or sale of assets, information may be transferred, subject to this Privacy Policy.
7. International transfers
Cyla AI may process and store information in countries other than your own. Where personal data is transferred internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an equivalent mechanism to protect your information.
8. Data retention
We retain personal information for as long as your account is active or as needed to provide the Service. When an account or workspace is closed, we delete or de-identify the associated data within a reasonable period, typically within 30 days, except where we are required to retain certain records to comply with legal, tax, accounting or security obligations, or to resolve disputes and enforce our agreements.
9. Security
We implement technical and organisational measures designed to protect your information, including encryption in transit, access controls, tenant isolation, hashed credentials and monitoring. No method of transmission or storage is completely secure, but we work continuously to protect your information and to respond promptly to any incident.
10. Your rights
Depending on your location, you may have the right to access, correct, update, port, restrict or delete your personal information, and to object to certain processing. Under the GDPR you may also lodge a complaint with your supervisory authority. Under the California Consumer Privacy Act (CCPA/CPRA) you may request access to and deletion of your personal information and are entitled to non-discrimination for exercising these rights; we do not sell or share personal information as those terms are defined by the CCPA.
If your data is held within an agency’s workspace, you may need to direct your request to that agency as the controller. You can exercise your rights, or ask us to route your request, by emailing sathya.moorthy.v@gmail.com. See our Data Deletion instructions for how to request deletion.
11. Children
The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 13 years of age. If you believe a child has provided us with personal information, please contact us and we will delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you through the Service. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.
13. Contact us
If you have questions about this Privacy Policy or how we handle your data, contact us at sathya.moorthy.v@gmail.com.