Privacy Policy

Introduction

Cyndra AI ("Cyndra," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit cyndra.ai and interact with our services.

This policy is written to comply with the EU General Data Protection Regulation (GDPR), the UK Data Protection Act, and the California Consumer Privacy Act (CCPA/CPRA), and applies to users from any jurisdiction. If you do not agree with our practices, please do not use our services.

1. Information We Collect

1.1 Information You Provide Directly

• Contact form data: your name, email, company, team size, and message content.
• Booking data: when you schedule a call through Cal.com, we receive your name, email, meeting time, and any details you share during booking.
• Communications: emails, messages, and correspondence you send us.

1.2 Information Collected Automatically

• Analytics data: pages visited, time on page, referring sites, clicks, and user interactions, collected via Google Analytics and Microsoft Clarity (which includes anonymized session recordings and heatmaps).
• Advertising data: limited identifiers used by the LinkedIn Insight Tag for campaign measurement and retargeting (see Section 5).
• Device information: browser type, operating system, screen size, approximate location (derived from IP), and device identifiers.
• Cookies: first- and third-party cookies used for analytics, preferences, and advertising (see Section 10).

2. How We Use Your Information

We use the information we collect to:

• Respond to inquiries and provide customer support.
• Deliver, operate, and improve our AI services and website.
• Send service updates and — where you've consented — marketing communications.
• Analyze website usage, improve UX, and debug issues.
• Measure the performance of our advertising and retarget visitors who have shown interest.
• Detect fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our terms.

3. Legal Bases for Processing

Under the GDPR, we rely on the following legal bases to process your personal data:

• Consent — for non-essential cookies, analytics, and marketing communications. You can withdraw consent at any time.
• Contract — to respond to your inquiries, set up calls, and deliver services you've requested.
• Legitimate interests — to secure our systems, measure and improve our services, and communicate about our offering, balanced against your rights.
• Legal obligation — where we must process data to comply with applicable law.

4. Third-Party Data Processors

We work with a small set of vetted sub-processors. Each is contractually obligated to use your data only for the purposes we specify and to maintain appropriate security controls. We do not sell or rent your personal information.

5. Advertising & Conversion Tracking

We use the LinkedIn Insight Tag on our website. When loaded, it allows LinkedIn to set cookies or similar identifiers to:

• Measure the effectiveness of LinkedIn ad campaigns (e.g., which ads lead to visits or contact form submissions).
• Build audiences for retargeting — showing Cyndra ads to people who have already visited our site.
• Report aggregated demographic insights about our audience.

LinkedIn acts as an independent data controller for the data it collects via the Insight Tag. For details on how LinkedIn processes this data and your choices (including opting out of interest-based advertising), see LinkedIn's Privacy Policy.

You can disable analytics and advertising cookies at any time via our cookie banner, your browser settings, or industry opt-out tools such as the DAA WebChoices tool.

6. Data Retention

We retain personal data only for as long as necessary for the purposes it was collected:

• Contact & booking data: up to 24 months after your last interaction, unless a commercial relationship is established.
• Analytics data: typically 14 months (Google Analytics) and up to 12 months (Microsoft Clarity).
• Advertising identifiers: LinkedIn Insight Tag data is retained by LinkedIn for up to 180 days by default.
• Email correspondence: retained for as long as reasonably necessary for recordkeeping.

After these periods, data is securely deleted or anonymized. You may request earlier deletion at any time.

7. Your Privacy Rights (GDPR / UK GDPR)

If you are located in the EEA, UK, or Switzerland, you have the following rights regarding your personal data:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data ("right to be forgotten").
• Restriction — limit how we use your data in certain situations.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests or direct marketing.
• Withdraw consent — at any time, without affecting the lawfulness of prior processing.

We respond to verified requests within 30 days. You may also lodge a complaint with your local data protection authority.

8. Your Privacy Rights (California & US)

If you are a California resident, the CCPA/CPRA gives you the right to know what personal information we collect, request deletion, correct inaccurate information, and opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising.

While we do not sell personal information for money, use of advertising tools such as the LinkedIn Insight Tag may be considered "sharing" under the CPRA. You can opt out using our cookie banner or by emailing us (see Section 9). We will not discriminate against you for exercising these rights.

9. How to Exercise Your Rights

To exercise any of your rights, contact us at the address below. We may need to verify your identity before acting on a request.

10. Cookie Policy

We use cookies and similar technologies to run the site, understand how it is used, and measure the performance of our marketing.

Categories of cookies we use

• Essential: required for security, navigation, and form submission.
• Analytics: Google Analytics and Microsoft Clarity — understanding usage and improving UX.
• Advertising: LinkedIn Insight Tag — measuring and optimizing LinkedIn ad campaigns and retargeting.
• Preferences: storing your cookie consent and UI preferences.

Managing cookies

You can accept or reject non-essential cookies via our cookie banner and change your choice any time by clearing the site's local storage. Most browsers also let you block or delete cookies through their settings. Blocking certain cookies may affect site functionality.

11. Data Security

We maintain reasonable technical and organizational measures to protect personal data, including:

• HTTPS/TLS encryption for all traffic in transit.
• Vetted, SOC 2-aligned infrastructure (Vercel, Google, Microsoft).
• Access controls and least-privilege permissions for internal systems.
• Regular review of dependencies, logs, and third-party integrations.

No system is perfectly secure. We cannot guarantee absolute security but work to industry-standard practices.

12. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and the EU–US Data Privacy Framework (for eligible providers) to ensure your data remains protected.

13. Children's Privacy

Our services are not directed to individuals under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with data, contact us and we will delete it.

14. Changes to This Policy

We may update this Privacy Policy as our practices, tools, or legal requirements evolve. When we make material changes, we'll update the "Last updated" date at the top of this page and, where appropriate, notify you through the site.

15. Contact Information

Questions, concerns, or requests related to this Privacy Policy? Get in touch:

If you're not satisfied with our response, you may lodge a complaint with your local data protection authority (for example, your relevant EU supervisory authority, the UK ICO, or the California Privacy Protection Agency).