Privacy Policy

1. Who we are

Caybl.ai ("Caybl.ai," "we," "us") is the data controller for the personal data described in this policy - the account data, connection metadata, and (where you've consented) site-analytics data collected through caybl.ai and the Caybl.ai service. You can reach us at support@caybl.ai for any privacy question or request, including exercising the rights in Section 10.

2. Scope of this policy

This policy covers personal data Caybl.ai processes as a controller: your account, your use of caybl.ai, and metadata about how you use the service. It doesn't cover the Google Analytics data itself that Caybl.ai fetches on your behalf and passes to your AI agent - for that data, Caybl.ai generally acts as your processor, and our obligations are set out in our Data Processing Agreement instead. It also doesn't cover how a third-party AI agent (Claude, ChatGPT, or another MCP client) or Google itself handles data once it reaches them - review their own privacy policies separately.

3. Personal data we collect

We collect the following categories of personal data:

• Account data - your email address, and your name if you sign in with Google or provide one;
• Connection data - an encrypted OAuth credential for each Google Analytics property and, if you connect one, each Google Ads account you connect, plus which property or account is your default target and whether write access is turned on for a given Ads account;
• Usage metadata - which tool ran, when, how many rows it returned, whether it succeeded, and latency, for every question your AI agent asks. We do not store the analytics data returned by a query, or the content of your questions;
• Support communications - anything you send to support@caybl.ai;
• Site-analytics data - device, browser, approximate location, and page-interaction data collected via Google Tag Manager for every visitor, regardless of the choice made on our cookie banner. See Section 5.

4. How we use your data & our legal basis

5. Cookies & tracking

caybl.ai loads Google Tag Manager on every visit, which may set cookies to measure site usage - this happens whether or not you interact with the cookie banner. The banner is a notice describing this rather than a control: the Accept and Decline buttons both just dismiss it. We don't use cookies for advertising or to track you across other sites.

6. Who we share your data with

We share personal data only where it's needed to run the service:

• Amazon Web Services (eu-west-1) - our hosting provider. AWS stores and processes data on our behalf and doesn't use it for its own purposes;
• Google - we call Google's Analytics and, if connected, Ads APIs using your connected credential to fetch the data you ask for or make a change you've authorized, and Google Tag Manager, which loads for every visitor;
• Your AI agent (Claude, ChatGPT, or another MCP-compatible client) - receives the Google Analytics data needed to answer your question, processed under your own account with that provider;
• Amazon SES - delivers transactional email (verification, support replies) on our behalf.

We do not sell personal data, and we do not share it with advertisers.

7. International data transfers

Caybl.ai's infrastructure runs in AWS eu-west-1 (Ireland) - your account and connection data stays in the EU. Where a sub-processor transfers data outside the EEA (for example, as part of Google's global infrastructure), that transfer is covered by that provider's own Standard Contractual Clauses or an equivalent adequacy mechanism.

8. How long we keep your data

Your encrypted Google Analytics or Google Ads credential is kept until you disconnect it, at which point it and Google's grant are deleted immediately. Usage metadata is kept for as long as your account is active, and deleted with your account. Support emails are kept as long as needed to resolve your request and for a reasonable period after, for continuity if you write in again. You can request earlier deletion at any time - see Section 10.

9. Data security

Connection credentials are encrypted at rest (AES-256-GCM, moving to KMS envelope encryption in production), all traffic runs over TLS, and access to production systems follows least-privilege IAM. No method of transmission or storage is 100% secure, but we design the system so there's as little to lose as possible: we don't store the analytics data itself, only metadata and an encrypted credential.

10. Your rights

Under GDPR (and equivalent laws elsewhere), you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate data;
• Erase your data ("right to be forgotten");
• Restrict or object to certain processing;
• Port your data to another service in a structured format;
• Withdraw consent at any time, for anything based on consent;

To exercise any of these, email support@caybl.ai. We'll respond within one month. If you're in the EU and unsatisfied with our response, you can lodge a complaint with the Irish Data Protection Commission, our lead supervisory authority, or your own country's equivalent regulator.

11. Children's privacy

Caybl.ai isn't directed at children, and we don't knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we'll delete it.

12. Automated decision-making

We don't use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.

13. Changes to this policy

We may update this policy as the service evolves. Material changes will update the "Last updated" date above and, where appropriate, be notified to you directly.

14. Contact & related documents

Privacy questions or rights requests: support@caybl.ai. See also our Terms of Service, Security & data handling, and - if you process personal data through Caybl.ai on behalf of a client or employer - our Data Processing Agreement.