Privacy Policy
This Privacy Policy describes how Ciphyrs Technologies Private Limited ("Ciphyrs," "we," "us," or "our") collects, uses, and protects personal information about you when you use our services, website, and products. By using Ciphyrs, you agree to the terms of this Privacy Policy.
1. Identity of the Data Controller
Ciphyrs Technologies Private Limited
Electronic City, Bangalore, Karnataka 560100
Email: info@ciphyrs.com
Legal: info@ciphyrs.com
For users in the European Union, Ciphyrs acts as the Data Controller under the General Data Protection Regulation (GDPR) Regulation (EU) 2016/679. For users in India, Ciphyrs acts as a Data Fiduciary under the Digital Personal Data Protection Act 2023.
2. Information We Collect
2.1 Account and Registration Information
When you create a Ciphyrs account, we collect: name, email address, organization name, job title, billing address, payment method details (processed by our payment processor; we do not store card numbers), and IP address at registration.
2.2 Usage and Technical Information
We automatically collect: API request logs (endpoint, timestamp, response code, latency), browser type and version, operating system, referring URL, session duration, feature usage patterns, and error logs. These are used to operate, improve, and secure our services.
2.3 Customer Data (PII Processed on Your Behalf)
When you use Ciphyrs to scan text for PII, you submit text that may contain personal data about third parties ("Customer Data"). We do not read, log, or retain the original PII values in your Customer Data. The original PII values are encrypted immediately upon detection and stored in our vault with your configured TTL. Our operational logs contain only token IDs, entity types, and metadata — never the original PII.
We process Customer Data solely on your instruction and in accordance with our Data Processing Agreement. We are a data processor for Customer Data; you are the data controller/data fiduciary.
2.4 Communications
If you contact us via email or support ticket, we retain records of the communication including any personal information you provide.
3. How We Use Your Information
We use personal information for the following purposes:
- Service Provision: To create and manage your account, process payments, deliver API services, and provide technical support.
- Security and Fraud Prevention: To detect, investigate, and prevent unauthorized access, abuse, and fraudulent activity.
- Product Improvement: To analyze aggregate usage patterns and improve Ciphyrs features and performance.
- Communications: To send service notifications, security alerts, compliance updates, and (with consent) product announcements.
- Legal Compliance: To comply with applicable laws, respond to legal process, and enforce our Terms of Service.
- Billing: To process subscription payments, issue invoices, and manage plan changes.
4. Legal Bases for Processing (GDPR)
For users in the European Economic Area (EEA), our legal bases for processing personal data are:
- Contract Performance (Art. 6(1)(b)): Processing your account data to provide the services you've contracted for.
- Legitimate Interests (Art. 6(1)(f)): Security monitoring, fraud prevention, and product analytics (balanced against your rights).
- Legal Obligation (Art. 6(1)(c)): Compliance with applicable laws including tax, accounting, and data protection regulations.
- Consent (Art. 6(1)(a)): Marketing communications and non-essential cookies (you may withdraw consent at any time).
5. Data Retention
We retain your personal information for as long as your account is active, or as long as necessary to provide services, comply with legal obligations, resolve disputes, and enforce agreements.
- Account Data: Retained for the duration of your account plus 3 years after termination (for legal and billing purposes).
- Vault Data (Customer PII): Deleted automatically when TTL expires. Immediately deleted upon plan termination or API request.
- Audit Logs: Retained for 1 year (Team/Enterprise). 30 days (Pro). 7 days (Free).
- Payment Records: 7 years (per Indian accounting law and GST requirements).
- Support Communications: 3 years after last contact.
6. Data Sharing and Disclosure
We do not sell your personal information. We share it only in the following circumstances:
6.1 Service Providers
We use third-party vendors who process data on our behalf under binding data processing agreements: Google Cloud Platform (infrastructure, hosting), Stripe (payment processing), Sendgrid (transactional email), PagerDuty (incident alerting), and Datadog (observability). Each vendor is contractually restricted to using data only for the services they provide to us.
6.2 Legal Requirements
We may disclose your information if required by law, court order, or government regulation, or if we believe disclosure is necessary to protect the rights, property, or safety of Ciphyrs, our users, or the public.
6.3 Business Transfers
In the event of a merger, acquisition, or sale of all or part of our assets, personal information may be transferred. We will notify you via email and prominent website notice before your data is transferred and becomes subject to a different privacy policy.
7. International Data Transfers
Your data is stored in the region you select at onboarding (India: asia-south1, EU: europe-west4, US: us-central1). We do not transfer data between regions without your explicit consent or a legal basis under applicable law.
For EU residents, any transfer outside the EEA is governed by Standard Contractual Clauses (SCCs) approved by the European Commission. For Indian residents, we comply with the cross-border transfer restrictions under Section 16 of the DPDP Act 2023.
8. Your Rights
Depending on your jurisdiction, you may have the following rights:
8.1 Rights Under GDPR (EU Residents)
- Right of Access (Art. 15): Obtain a copy of your personal data.
- Right to Rectification (Art. 16): Correct inaccurate data.
- Right to Erasure (Art. 17): Delete your personal data ("right to be forgotten").
- Right to Restriction (Art. 18): Restrict how we process your data.
- Right to Portability (Art. 20): Receive your data in a machine-readable format.
- Right to Object (Art. 21): Object to processing based on legitimate interests.
- Right not to be subject to automated decision-making (Art. 22).
8.2 Rights Under DPDP Act 2023 (Indian Residents)
- Right to information about processing (Sec. 11).
- Right to correction and erasure (Sec. 12).
- Right to grievance redressal (Sec. 13).
- Right to nominate (Sec. 14).
To exercise any of these rights, email info@ciphyrs.com. We will respond within 30 days (or 72 hours for urgent erasure requests).
9. Security
We implement industry-standard technical and organizational measures to protect your personal information:
- AES-256-GCM encryption at rest for all PII vault data.
- TLS 1.3 for all data in transit.
- API keys stored as SHA-256 hashes — never in plaintext.
- Role-based access control (RBAC) and multi-tenant row-level security.
- Regular security assessments and penetration testing.
- ISO 27001-aligned information security management program.
Despite these measures, no internet transmission or electronic storage is 100% secure. If you discover a security vulnerability, please report it to info@ciphyrs.com.
10. Cookies
We use cookies and similar tracking technologies as described in our Cookie Policy. You can manage your cookie preferences through our cookie consent manager.
11. Children's Privacy
Ciphyrs services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 18, we will delete that information immediately. If you believe a child has provided us with personal information, contact info@ciphyrs.com.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email (to the address associated with your account) and by posting a prominent notice on our website at least 30 days before the change takes effect. Your continued use of Ciphyrs after the effective date constitutes acceptance of the updated policy.
13. Grievance Officer (India)
In compliance with the DPDP Act 2023 and the Information Technology Act 2000, the name and contact details of the Grievance Officer are:
Name: Data Protection Officer, Ciphyrs Technologies Private Limited
Address: Electronic City, Bangalore, Karnataka 560100
Email: info@ciphyrs.com
Response time: Within 30 days of receiving a grievance.
14. Contact Us
For privacy-related questions, data subject requests, or to exercise your rights under GDPR or DPDP Act: