Privacy Policy

Account Data (Persistent)

We collect and store the following information to manage your account and provide billing services:

• Email address (for authentication and communication)
• Payment information (processed securely via Stripe - we do not store full credit card numbers)
• Account preferences and subscription tier selections
• Billing history and usage logs for invoicing purposes

Legal Basis: Contractual Necessity - This data is required to fulfill our contract with you to provide the Cyqle service.

Session Data (Ephemeral)

Data generated during your use of virtual desktop sessions. This category is inherently ephemeral due to our jailed environment architecture:

• Files, documents, and code created within your session's isolated filesystem
• Installed software packages and system configuration changes
• Process metadata (running applications, resource consumption)
• Network activity originating from your session (for security monitoring only)

Legal Basis: Contractual Necessity - Processing session data is essential to provide you with an isolated, functional virtual desktop environment.

Technical & Diagnostic Data

We collect limited technical data to maintain platform stability and security:

• IP addresses (hashed after 24 hours for fraud prevention)
• Browser type and operating system (for compatibility diagnostics)
• Session start/end timestamps and resource usage metrics (for capacity planning)

Legal Basis: Legitimate Interest - We have a legitimate interest in maintaining platform security, preventing fraud, and optimizing service performance.

How the AI Operator Works

The AI Operator uses the following logic to assist you:

• Pattern Recognition: It analyzes recorded browser interactions to identify actionable patterns (clicks, form fills, navigation sequences)
• Task Execution: Based on your instructions, it replicates these patterns to automate repetitive tasks
• Contextual Adaptation: It uses computer vision and DOM analysis to adapt to minor UI changes in web applications
• Feedback Loop: You can review, approve, or modify automated actions before they execute

Human Oversight & Limitations

The AI Operator operates under your direct supervision. It does not make autonomous decisions that affect your account, billing, or access rights. All critical operations require explicit user confirmation. The AI does not access or process your session data for training purposes without explicit opt-in consent.

Automated Systems in Use

• Fraud Detection:

  Our system analyzes account creation patterns, payment behaviors, and IP reputation scores to detect and prevent fraudulent sign-ups. False positives are reviewed by human operators within 24 hours.

• Session Allocation:

  An automated load balancer allocates your session to available infrastructure nodes based on current capacity, geographic proximity, and subscription tier priority.

• Abuse Detection:

  We monitor resource consumption patterns (CPU, memory, network) to detect violations of our Acceptable Use Policy (e.g., cryptocurrency mining, DDoS attacks).

P2P Mesh Network & Data Routing

When you collaborate with other users in real-time, your session data is transmitted directly between peers using libp2p. This means:

• Data may be routed through intermediate relay nodes located in different countries
• The exact path of data transmission depends on network topology and peer availability
• All P2P connections are end-to-end encrypted using TLS 1.3 and WebRTC encryption

Cross-Border Transfer Safeguards

To protect your data during international transfers, we implement the following safeguards:

• Standard Contractual Clauses (SCCs): All data transfers to countries outside the EEA are governed by EU-approved Standard Contractual Clauses (2021/914)
• Encryption in Transit: All data is encrypted during transmission using industry-standard encryption protocols
• Data Minimization: Only the minimum necessary session data is transmitted through the P2P network (screen frames, input events, authentication tokens)

Your Control Over Data Location

While we cannot guarantee the exact geographic path of P2P-routed data, you can control where your persistent session data is stored by selecting your preferred data center region in your account settings (available for Pro and Power tier users).

Persistent Sessions (Optional, Paid Tiers Only)

If you enable persistence (available on Lite, Pro, and Power tiers), your session data is retained as follows:

• Storage Duration: Persistent data is retained for the duration specified by your subscription tier (e.g., 30 days for Lite, 90 days for Pro)
• Encrypted Storage: Persistent data is stored in encrypted block storage with unique per-user encryption keys managed via AWS KMS
• Manual Deletion: You can manually delete persistent sessions at any time through your dashboard

Account Data Retention

Account data (email, billing information, usage logs) is retained for as long as your account is active, plus an additional 90 days after account closure to comply with financial record-keeping requirements. After this period, all personal identifiers are permanently deleted.

Your Right to Deletion

You may request deletion of all your personal data at any time by contacting privacy@cyqle.in. We will complete your deletion request within 30 days, except where retention is required by law (e.g., tax records, fraud prevention).

Security Controls

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Isolation: Each session runs in a jailed environment with strict process and filesystem isolation (see SESSION_ENVIRONMENT.md)
• Access Controls: Role-based access controls (RBAC) limit employee access to production data
• Security Audits: We conduct annual third-party security audits and penetration testing
• Incident Response: We maintain a 24/7 incident response team for security events

Data Breach Notification

In the unlikely event of a data breach affecting your personal information, we will notify you within 72 hours via email and provide details about the nature of the breach, affected data categories, and remediation steps.

Essential Cookies (Required)

Session authentication token (httpOnly, secure, sameSite=strict) - expires after 30 days or logout

Analytics Cookies (Optional)

We use privacy-respecting analytics (Plausible Analytics) that does not track individual users or use cookies. You can opt out via your browser's Do Not Track (DNT) header.