Privacy Policy

Effective date: September 8, 2026 · Last updated: September 8, 2026

This Privacy Policy explains how CYRION AI LTD, a company registered in England and Wales (company number 17432699), with its registered office at 124 City Road, London, United Kingdom, EC1V 2NX ("Cyrion," "we," "us") collects, uses, discloses, and protects information in connection with cyrion.ai and related applications and APIs (the "Service"). It applies to visitors, registered users, and organizations that use the Service ("you").

This policy should be read alongside our Terms of Service.

1. Information We Collect

1.1 Information You Provide

Account data: name, email, organization, password (hashed), billing contact.
Payment data: processed by our payment processor (to be confirmed); we do not store full card numbers on our own systems.
Communications: support requests, feedback, and correspondence with us.

1.2 Information Generated by the Service

Usage and telemetry data: token consumption, scan duration, feature usage, API calls, IP address, device/browser information, and log data.
Credit and billing history: scans run, credits consumed, invoices.

1.3 Information From Third Parties

Data from your identity provider if you use SSO/SAML (Enterprise tier).
Data from payment or fraud-prevention processors.

We do not knowingly collect information from the targets you scan beyond what the scan itself retrieves in the course of executing the testing you requested (e.g., a target's exposed headers, endpoints, or configuration) — that data is Scan Output, governed by Section 6 of the Terms and Section 4 below.

2. How We Use Information

We use the information above to:

1. Provide, operate, and maintain the Service, including executing scans and generating reports;

2. Process payments and manage subscriptions, credits, and tiers;

3. Monitor for abuse, unauthorized scanning, and violations of the Terms of Service (see Section 2 of the Terms);

4. Provide customer support;

5. Improve the Service, including analyzing aggregated, de-identified usage patterns (e.g., token consumption by scan type) to refine pricing, routing, and reliability;

6. Send service-related communications (billing, security notices, product updates) and, where you've opted in, marketing communications;

7. Comply with legal obligations and enforce our Terms.

We do not sell your personal information. We do not use your Scan Output or scan targets to train third-party foundation models, and we contractually restrict our model providers from doing so with your data (see Section 3).

3. AI Model Providers and Sub-Processors

Executing a scan requires sending scan-related data — target details, tool output, and portions of the agent's working context — to third-party large language model providers. Depending on your subscription tier and scan configuration, this may include:

Provider	Used for	Data retention / training use
Google (Gemini models)	Free and default-tier scan execution	[Confirm current DPA terms — typically not used for training on API traffic; state actual retention window]
DeepSeek	Hacker-tier scan execution	[Confirm current DPA terms; DeepSeek's data handling and jurisdiction should be reviewed and disclosed explicitly here]
Anthropic (Claude models), OpenAI (Openai models)	Red Team-tier scan execution	[Confirm current DPA terms]
Payment processor (to be confirmed)	Billing	Per processor's own privacy policy
Supabase and Vercel	Hosting, storage	Per provider's own privacy policy

We select model and infrastructure providers based on their security posture and data-handling commitments, and we enter data processing agreements with them where applicable. You should know that scan target data is, by design, transmitted outside Cyrion's own infrastructure to run a scan. If you are testing a target subject to contractual or regulatory data-residency restrictions, confirm those third-party providers meet your requirements before scanning.

We will update this table as our model routing changes; material changes to which providers process your data will be reflected here and, for material changes, notified per Section 10.

4. Scan Output and Data From Your Targets

Because scans may actively probe systems you specify, Scan Output can incidentally include personal data that exists on the target (e.g., data exposed by a misconfigured endpoint, or personal data embedded in a repository). You are the controller of that data under applicable data protection law with respect to your target systems; Cyrion processes it on your behalf as a processor/service provider strictly to deliver scan results to you. You are responsible for ensuring you have a lawful basis to have that data processed by Cyrion in the course of testing, and for handling any personal data surfaced in Scan Output in compliance with applicable law.

5. Legal Bases for Processing (EEA/UK Users)

Where the GDPR or UK GDPR applies, we rely on:

Contract necessity — to provide the Service and fulfill our agreement with you;
Legitimate interests — for security monitoring, abuse prevention, and product improvement, balanced against your rights;
Consent — for optional marketing communications, which you can withdraw at any time;
Legal obligation — where processing is required to comply with law.

6. Data Retention

Account data: retained for the life of your account and for 90 days after closure for legal/billing purposes.
Scan Output and reports: retained for 12 months or until you delete them, whichever is earlier, unless a longer period is required to investigate suspected unauthorized-scan violations under Section 2 of the Terms.
Billing records: retained as required by tax and accounting law (typically 6–7 years depending on jurisdiction).
Telemetry/logs: retained for 90 days, then aggregated or deleted.

7. Your Rights

Depending on your location, you may have the right to:

Access the personal data we hold about you;
Correct inaccurate data;
Delete your data ("right to erasure"), subject to legal retention obligations and our need to retain records of suspected Terms violations;
Export your data in a portable format;
Object to or restrict certain processing;
Withdraw consent for marketing at any time;
(California residents) Know what categories of personal information we collect and disclose, and not be discriminated against for exercising these rights, per the CCPA/CPRA.

To exercise these rights, contact us at privacy@cyrion.ai. We may need to verify your identity before acting on a request. If you are in the EEA/UK and believe we have not adequately addressed your request, you have the right to lodge a complaint with your local data protection authority.

8. International Data Transfers

We and our sub-processors may transfer and process data in countries other than your own, including the United States. Where required, we rely on appropriate safeguards for such transfers (e.g., Standard Contractual Clauses for transfers from the EEA/UK). [Confirm actual transfer mechanisms per current sub-processor list before publishing.]

9. Security

We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit and at rest for stored data, access controls, and monitoring. No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you as required by applicable law.

10. Children's Privacy

The Service is not directed to individuals under 18, and we do not knowingly collect personal data from them. If we learn we have collected data from a minor, we will delete it.

11. Cookies and Tracking

We use cookies and similar technologies for authentication, session management, analytics, and (where you consent) marketing measurement. You can control cookies through your browser settings; disabling essential cookies may prevent the Service from functioning.

12. Changes to This Policy

We may update this policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, provide additional notice (e.g., email or in-app banner) at least 30 days before the change takes effect.

13. Contact Us

CYRION AI LTD

124 City Road, London, United Kingdom, EC1V 2NX

contact@cyrion.ai

This document is a template and does not constitute legal advice. Before publishing, confirm the actual sub-processor list and their current DPA/retention terms (Section 3), set real retention periods (Section 6), confirm your transfer mechanism (Section 8), and have counsel review for GDPR/CCPA/sector-specific obligations relevant to your customer base.