Privacy Policy

1. Who we are

Caybl.ai ("Caybl.ai," "we," "us") is the data controller for the personal data described in this policy - the account data, connection metadata, and (where you've consented) site-analytics data collected through caybl.ai and the Caybl.ai service. You can reach us at support@caybl.ai for any privacy question or request, including exercising the rights in Section 10.

2. Scope of this policy

This policy covers personal data Caybl.ai processes as a controller: your account, your use of caybl.ai, and metadata about how you use the service. It doesn't cover the Google Analytics data itself that Caybl.ai fetches on your behalf and passes to your AI agent - for that data, Caybl.ai generally acts as your processor, and our obligations are set out in our Data Processing Agreement instead. It also doesn't cover how a third-party AI agent (Claude, ChatGPT, or another MCP client) or Google itself handles data once it reaches them - review their own privacy policies separately.

3. Personal data we collect

We collect the following categories of personal data:

• Account data - your email address, and your name if you sign in with Google or provide one;
• Connection data - an encrypted OAuth credential for each Google Analytics property and, if you connect one, each Google Ads account you connect, plus which property or account is your default target and whether write access is turned on for a given Ads account;
• Usage metadata - which tool ran, when, how many rows it returned, whether it succeeded, and latency, for every question your AI agent asks. We do not write the analytics data returned by a query, or the content of your questions, to our logs, and outside the in-app assistant (below) we do not store them;
• Chat transcripts - if you use the in-app assistant (Ask), the questions you ask, the answers, and the data Caybl.ai's tools returned for them. Transcripts are deleted automatically 30 days after a chat's last message, and you can delete a chat, or all your chats, at any time, which removes them immediately;
• Credit records - credits granted with your plan, credit top-ups you buy, and the credits each question used. Credit history keeps the date and amount only, not the question;
• Support communications - anything you send to support@caybl.ai;
• Site-analytics data - device, browser, approximate location, and page-interaction data collected via Google Tag Manager for every visitor, regardless of the choice made on our cookie banner. See Section 5.

4. How we use your data & our legal basis

5. Cookies & tracking

caybl.ai loads Google Tag Manager on every visit, which may set cookies to measure site usage - this happens whether or not you interact with the cookie banner. The banner is a notice describing this rather than a control: the Accept and Decline buttons both just dismiss it. We don't use cookies for advertising or to track you across other sites.

6. Who we share your data with

We share personal data only where it's needed to run the service:

• Amazon Web Services (eu-west-1) - our hosting provider. AWS stores and processes data on our behalf and doesn't use it for its own purposes;
• Google - we call Google's Analytics and, if connected, Ads APIs using your connected credential to fetch the data you ask for or make a change you've authorized, and Google Tag Manager, which loads for every visitor;
• Your AI agent (Claude, ChatGPT, or another MCP-compatible client) - receives the Google Analytics data needed to answer your question, processed under your own account with that provider;
• Anthropic, PBC - if you use the in-app assistant, receives your question and the data Caybl.ai's tools return for it, through the Claude API, to generate the answer; a Claude model also screens each question for topic and titles new chats. Anthropic doesn't use API data to train its models by default, and keeps API inputs and outputs only under its standard API data retention;
• Amazon SES - delivers transactional email (verification, support replies) on our behalf.

We do not sell personal data, and we do not share it with advertisers.

YouTube API Services

If you connect a YouTube channel, Caybl.ai uses YouTube API Services to read that channel's data: channel and video details (titles, publish dates, view counts) and YouTube Analytics reports (for example views, watch time, traffic sources, search terms, audience and retention, and estimated revenue for monetized channels). Access is read-only; Caybl.ai can't upload, change or delete anything on your channel.

We store an encrypted OAuth credential for the channel and its ID and name, so we know which channel you connected. We don't store the YouTube data itself: it's fetched when you ask a question and passed to your AI agent, except that answers in the in-app assistant (Ask) are kept in your chat history and deleted after 30 days, as described in Section 3.

Google's handling of this data is covered by the Google Privacy Policy. You can revoke Caybl.ai's access at any time by disconnecting YouTube in your Caybl.ai dashboard, or from your Google Account at myaccount.google.com/permissions. Disconnecting deletes the stored credential.

7. International data transfers

Caybl.ai's infrastructure runs in AWS eu-west-1 (Ireland) - your account and connection data stays in the EU. Where a sub-processor transfers data outside the EEA (for example, as part of Google's global infrastructure, or Anthropic processing in-app assistant questions in the United States), that transfer is covered by that provider's own Standard Contractual Clauses or an equivalent adequacy mechanism.

8. How long we keep your data

Your encrypted Google Analytics or Google Ads credential is kept until you disconnect it, at which point it and Google's grant are deleted immediately. Usage metadata is kept for as long as your account is active, and deleted with your account. Chat transcripts are deleted 30 days after a chat's last message, or immediately when you delete the chat or your account. Credit records are kept for as long as your account is active and for as long as we need them for billing, tax and accounting. Support emails are kept as long as needed to resolve your request and for a reasonable period after, for continuity if you write in again. You can request earlier deletion at any time - see Section 10.

9. Data security

Connection credentials are encrypted at rest (AES-256-GCM, moving to KMS envelope encryption in production), all traffic runs over TLS, and access to production systems follows least-privilege IAM. No method of transmission or storage is 100% secure, but we design the system so there's as little to lose as possible: we don't warehouse the analytics data itself, only metadata, an encrypted credential, and - if you use the in-app assistant - chat transcripts that expire after 30 days.

10. Your rights

Under GDPR (and equivalent laws elsewhere), you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate data;
• Erase your data ("right to be forgotten");
• Restrict or object to certain processing;
• Port your data to another service in a structured format;
• Withdraw consent at any time, for anything based on consent;

To exercise any of these, email support@caybl.ai. We'll respond within one month. If you're in the EU and unsatisfied with our response, you can lodge a complaint with the Irish Data Protection Commission, our lead supervisory authority, or your own country's equivalent regulator.

11. Children's privacy

Caybl.ai isn't directed at children, and we don't knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we'll delete it.

12. Automated decision-making

We don't use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.

13. Changes to this policy

We may update this policy as the service evolves. Material changes will update the "Last updated" date above and, where appropriate, be notified to you directly.

14. Contact & related documents

Privacy questions or rights requests: support@caybl.ai. See also our Terms of Service, Security & data handling, and - if you process personal data through Caybl.ai on behalf of a client or employer - our Data Processing Agreement.