Privacy policy

Who we are

This policy is published by KLYRO. You can reach us about anything in it at privacy@klyro.tech.

Two kinds of data, two roles

• Data we decide about. Information about visitors to this website and about the people who use our products on behalf of a business (our customers' staff): names, work email addresses, sign-in records, support messages and billing details. For this data we are the data fiduciary (or controller), and this policy applies in full.
• Data our customers decide about. When a business uses our products, the data about its own customers passes through them: reviews and the names reviewers show on Google, enquiries, messages, phone numbers and email addresses, viewing bookings and documents the business uploads. For this data the business is the data fiduciary (or controller) and we process it only on its instructions, under our data processing agreement. If you wrote a review for, or sent an enquiry to, a business that uses KLYRO, please contact that business first. We will help it answer you.

What we collect and why

On this website

• Contact and assessment forms: your name, email, company and message, to reply to you.
• Booking a call: the details you give the online scheduler, to hold the meeting. The scheduler may set its own cookies when it loads.
• Server logs: our hosting provider records basic request data (such as IP address, browser and pages requested) to run and protect the site. We use no advertising or analytics cookies.

In our products

• Account data: the names, email addresses and roles of a customer's users, sign-in links and sessions, and a log of the actions taken in the product, to provide the service, keep it secure and show the customer who did what.
• Customer content: the reviews, enquiries, messages, bookings, listings and documents described above, to provide the service the customer asked for. We do not use customer content for any other purpose.
• Connections: when a customer connects an account (Google Business Profile, Google Calendar, Meta, WhatsApp or Zoom), we store the access tokens encrypted and use them only to do what the customer set up, such as posting a reply or creating a meeting link.
• Usage records: how much each customer uses the AI (for example the number of requests and tokens), to run the service, plan capacity and bill.
• Billing: the business's name, billing contact, address, tax registration number and payment records, to invoice and meet our tax obligations.

We rely on the contract with our customer, on consent where it is required (for example for the website forms), on our legitimate interest in running and securing the service, and on legal obligations such as keeping tax records.

How we use AI

Our products use AI models from established AI providers to read reviews and messages and draft replies. The text of a review or message and the business's own settings are sent to the model for that purpose, under terms that do not allow the provider to use this data to train its models. Each business decides which replies are sent automatically and which wait for a person to approve them, and is responsible for telling the people it talks to that replies may be written with AI.

Google user data

If a business connects its Google account, we access only what the features it uses need: its Business Profile reviews (to read them and post the replies it approves or allows to post automatically) and its Google Calendar (to create the video calls it books, with a Meet link). We do not sell this data, use it for advertising, or use it to train general-purpose AI models, and people at KLYRO read it only with the business's permission, for security, or where the law requires.

KLYRO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Meta and WhatsApp data

If a business connects Meta, we receive the leads from its Facebook and Instagram lead forms, its ad campaigns' spend and results, and the WhatsApp messages sent to its business number. We use them only to answer those enquiries for that business and show it its own results, and we do not share them with anyone else or use them for advertising.

Who we share data with

We never sell personal data. We share it only with the service providers that run our products for us (hosting, database, AI models, email delivery and support tools), each bound by data protection terms; with the services a customer connects itself (such as Google or Meta); and with authorities when the law requires it. Customers can ask us for the current list of service providers, which we share under confidentiality.

Where data is stored

Our providers store and process data outside India, in Australia, the United States and the European Union. Where data moves across borders, we rely on our providers' contractual safeguards and keep to any restrictions the law of the person's country sets.

How long we keep it

• Website enquiries: as long as needed to reply and follow up, and no longer than two years.
• Customer content and account data: for as long as the customer's account is active. When an account ends, we delete it within 30 days unless the customer asks for a copy first or the law requires us to keep it.
• Content from Google Business Profile: no longer than Google's policies allow.
• Invoices and tax records: as long as Indian tax law requires.
• Security and audit logs: as long as needed to protect the service and investigate problems.

Security

Data is encrypted in transit. Access tokens and other secrets are encrypted at rest with AES-256-GCM, and our database provider encrypts its storage. Access within each customer's account is limited by role, and actions are recorded in an activity log. No system is perfectly secure; if a breach affects your data, we will tell the affected customer, and you where the law requires, without undue delay.

Your rights

Depending on where you live, including under India's Digital Personal Data Protection Act 2023, the UAE's Personal Data Protection Law, Australia's Privacy Act 1988 and the EU and UK GDPR, you can ask to:

• see the personal data we hold about you and how we use it;
• have it corrected or completed;
• have it deleted;
• withdraw a consent you gave, or object to a use;
• receive a copy in a portable format, where the law gives that right;
• nominate someone to act for you, where the law gives that right; and
• complain to us, and to the data protection authority in your country.

Email privacy@klyro.tech and we will reply within 30 days. If your request is about data a business holds about you in our products, we will pass it to that business and help it respond.

Grievance officer

For questions or complaints about how we handle personal data, contact KLYRO's grievance officer at privacy@klyro.tech.

Children

Our website and products are for businesses and are not meant for anyone under 18. We do not knowingly collect children's data.

Cookies

This website sets no advertising or analytics cookies. Our products use a cookie to keep you signed in. The booking scheduler may set its own cookies when you open it.

Changes

We will update this policy when our products or the law change, and show the date at the top. For significant changes affecting customers, we will also tell them by email.