Privacy Policy

1. Data we collect

• Account data — name, email, organization, role, and authentication identifiers (including via Google, GitHub, or Microsoft when you sign in with them).
• Billing data — plan, subscription status, and billing contact. Card details are collected and stored by our payment processor (Stripe), not by us.
• Usage & device data — log data, IP address, browser/device info, and product analytics about how you use the dashboard.
• Customer Data (as processor) — the agent traces, metrics, and evaluation data your organization sends to the Service. This may incidentally contain personal data that you control; you decide what to send. Do not send special-category or highly sensitive data unless expressly permitted.
• Cookies — strictly-necessary cookies for authentication/session, and minimal analytics. We do not sell your data or use third-party advertising cookies.

2. How we use data

• provide, secure, and maintain the Service (including tenant isolation and abuse prevention);
• authenticate you and manage your organization, plan, and billing;
• respond to support requests and send service and security notices;
• improve reliability and features using aggregated, de-identified usage;
• comply with law and enforce our Terms.

3. Legal bases (EEA/UK)

Where GDPR/UK GDPR applies, we rely on: contract (to provide the Service), legitimate interests (to secure and improve it), consent(where required, e.g. certain cookies), and legal obligation. For Customer Data we process, your organization is the controller and we act under its instructions.

4. How we share data

We share personal data only as needed:

We require sub-processors to protect data under written terms. We may also disclose data to comply with law or protect rights, and in a merger or acquisition (with notice). We do not sell personal data.

5. Data retention

Account and billing records are kept for the life of the account and as required by law. Customer telemetry is retained per your plan’s retention window (e.g. 7–365 days), after which it is deleted from analytical storage. On account closure we delete or de-identify personal data within a reasonable period, subject to legal holds.

6. Security

We use encryption in transit, strict tenant isolation, hashed API keys, least-privilege access, and audit logging. No system is perfectly secure; report concerns to security@splyntra.com.

7. International transfers

We may process data in the United States and other countries. Where required, we use appropriate safeguards (e.g. Standard Contractual Clauses) for cross-border transfers. Data-residency options are available on Enterprise plans.

8. Your rights

Depending on your location, you may have rights to access, correct, delete, port, or restrict your personal data, and to object to certain processing (GDPR/UK GDPR), or to know/delete/opt out of “sale” or “sharing” (CCPA/CPRA — we do neither). Exercise them at privacy@splyntra.com; we will verify and respond within the timeframes the law requires. For Customer Data, please contact the organization that controls it; we will assist them as processor.

9. Children

The Service is not directed to children under 16, and we do not knowingly collect their data.

10. Data Processing Addendum

Business customers subject to GDPR/UK GDPR may request our DPA (including SCCs and the sub-processor list) at privacy@splyntra.com. The DPA supplements these terms for Customer Data we process on your behalf.

11. Changes

We will post updates here and, for material changes, notify you by email or in-app.

12. Contact

Splyntra, Inc. — Privacy: privacy@splyntra.com.