Privacy notice

We hold the data your agency puts into Kyrovane so that Kyrovane can run your agency. We do not sell it, we do not use it to train AI models, and we do not let one customer see another’s — that last one is enforced by the database, not by a policy.

For your own account data — the people in your agency, your billing details — we decide how it is used, so we are the controller.

For the data you put in about creators and your clients, you decide what to collect and why. You are the controller and we process it on your instructions. That means your agency is responsible for having a lawful basis to hold a creator’s contact details, and for answering a request from that creator — we will help you find and export or delete the records.

• Account data: name, work email, password hash, timezone, role, and the agency you belong to.
• Security data: sign-in times, IP address and browser string for your active sessions, failed sign-in counts, and — if you turn it on — an encrypted second-factor secret and hashed recovery codes.
• Your business data: clients, creators, products, campaigns, messages, samples, content and results. This is the bulk of it, and it is yours.
• Billing data: your plan, invoices, payment outcomes, and the brand, last four digits and expiry of the card. Never the card number or security code — those are entered on our payment provider’s page and never reach us.
• Operational data: audit entries for significant actions, error reports, and performance metrics.
• Demo requests: if you ask for a demo on this site, the name, work email, company, kind of business, team size, markets and message you send, so that a person can reply. Not the address your request came from: only a keyed hash of it, which shows that one source sent many requests and nothing else. Only the people at Kyrovane who answer these requests can read them; the database refuses everyone else. We do not add you to a mailing list.

• Sell it, or share it with advertisers.
• Use it to train AI models. Every AI request records that it was made with training opt-out in force, so this is a fact in a log rather than a promise in a document.
• Put it in an AI prompt beyond what is needed to answer the question asked, inside your own permissions.
• Let one tenant read another’s. Row-level security in PostgreSQL enforces it, and an isolation test suite attempts the crossing on every domain to prove the enforcement is real.

Running the service needs a small number of processors: a cloud host for the servers and database, a payment provider for card processing, an email provider for transactional messages, and an AI provider for the assistant. Each receives only what its job needs — the AI provider, for example, receives the question and the facts needed to answer it, not your database.

We do not yet publish a named sub-processor list with locations, because the production deployment is not finalised. When it is, that list will be published here and changes announced in advance. Until then, ask and we will tell you exactly who is involved.

• Your business data: for as long as the workspace exists, including after a plan ends, when it stays read-only so you can still export it. A record you delete, such as a creator or a client, leaves every screen at once; the row is kept, marked deleted, so reports already sent stay explainable, until the workspace is erased or a person erases it at your request.
• A deleted workspace: its owner deletes it from Settings, Privacy. It keeps working for 14 days, in which it can be exported and the deletion cancelled; then it closes and nobody can sign in to it; no sooner than 30 days after that, the people who run Kyrovane erase it from the database, with the accounts of people who belonged to no other workspace. A record that the erasure happened is kept, with dates, counts and what was billed (references, amounts and dates, no names or addresses). Each step in full.
• Audit entries: kept for the life of the account. They are append-only and hash-chained, so they cannot be selectively edited — including by us.
• Sessions: refresh tokens expire, and expired ones are deleted on a schedule.
• Demo requests: a year, or 30 days if it was filed as spam, then deleted by a daily job. Ask and we will delete yours sooner.
• Reset and verification links: minutes to hours. The record that one was used is kept, because “that link was already used on Tuesday” answers a support question.
• Backups: copies of the database made for disaster recovery, deleted after 14 days. Data erased from the database leaves them over that time, and a restored backup has every workspace erased since it was taken erased again before it is used.

The periods above are what the software does today. Whether they are the right periods, and whether any record must be kept for longer by law, requires legal review.

Your workspace’s owner can download everything it holds, and delete it, from Settings, Privacy; anybody in it can export creators, reports and the audit log where they work. You can ask us to erase one person’s details, including your own, from the same page. You can see where you are signed in and end any of those sessions yourself.

Depending on where you are, the law may give you further rights — access, correction, portability, objection, and a complaint to a regulator. Write to privacy@kyrovane.com and we will act on it. We will not make you pay or subscribe to exercise a right.

Passwords are hashed with Argon2id; tokens are stored only as digests; integration credentials and second-factor secrets are encrypted at rest. Traffic is served over HTTPS, and the browser never holds an API token. The security page describes the controls in detail, including what has not been independently verified.

Kyrovane is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a creator record in your workspace belongs to a child, delete it — and remember that the responsibility for what you collect about creators is yours.

This notice was written by the engineers who built the system so that it describes the implementation accurately. It has not been reviewed by a privacy lawyer, and it does not claim compliance with GDPR, CCPA or any other regime — that claim needs a review that has not happened. What it does claim is that the behaviour described here is the behaviour in the code.