Privacy Policy
Last updated: 2026-08-17 (draft — legal review pending)
1. Who we are
Cyril is a software project in active development. References to "we", "us" and "our" mean the team building it.
Cyril is not yet a registered legal entity; use the contact page for inquiries. The entity name, its registered address and a formal data protection contact will be published on this page before public launch. We have not appointed a Data Protection Officer, and nothing here should be read as claiming otherwise.
Cyril is pre-launch. There are no paying customer organisations yet. Where this Policy describes how customer data is handled, it describes how the platform is built to work — not an existing customer base.
2. Controller and processor
This website (getcyril.com) — we are the controller. Waitlist and contact submissions are our own records. They are stored separately from any organisation's data, in a table that has no organisation identifier, because a prospect has not joined an organisation yet.
The Cyril platform — we are the processor. For an organisation that uses Cyril, that organisation is the controller of the data it enters about its own clients, staff and business, and we process it on that organisation's instructions under a Data Processing Agreement. This role applies once an organisation subscribes. None has.
We remain the controller of our own records about an organisation and its account — billing details, login records, audit logs.
3. What we collect on this website
3.1 What you type
The waitlist form collects your name, email address and, optionally, your company. The contact form collects the same, plus your message, which is required. That is the whole of it. Neither form has any other field.
We do not send a confirmation email. Submitting a form does not add you to a mailing list — it records your details so a person can reply.
3.2 What our servers record alongside it
- Which page the form was on — for example,
marketing-site:/waitlist. - The host the submission came from.
- Your browser's user-agent string, stored in full and truncated at 500 characters.
- A hashed form of your IP address. We take an HMAC-SHA256 of it with a server-side secret and store only that hash. We do not store your IP address in any form, raw or truncated, and it does not appear in our logs. The hash exists so we can apply rate limits and spot duplicate submissions.
- Timestamps for when the submission arrived and was recorded.
Our application logs deliberately carry no personal data. They record the form type, whether a company or message was filled in, and which site the submission came from. Your name, email and message go to the database, not to the logs.
3.3 Anti-spam measures
Every page carrying a form loads Cloudflare Turnstile, a challenge that distinguishes people from automated submitters. It loads whether or not you accept analytics: we treat it as strictly necessary to keep the forms usable. When the challenge is verified, Cloudflare receives your IP address — that is how the check works. We never store it.
We also apply the following. None of them records anything about you beyond what is described above:
- A hidden field that only automated submitters fill in. If it is filled, the submission is silently discarded and no record is written.
- A limit of five submissions per ten minutes, counted against the hashed IP.
- A 24-hour window in which the same email address submitting the same form again is treated as a duplicate and not written a second time.
- A size limit on the submission, and a shared secret between our website and our API.
3.4 Analytics
Two measurement tools run on this website, and they are not the same in what they collect or in whether you get a choice about them. We would rather set that out plainly than list them together.
Cloudflare Web Analytics — always on. Our hosting provider measures page views at the network edge. It sets no cookies, stores nothing on your device, assigns you no identifier, and cannot follow you to any other website. It records the page URL, the referring page, and coarse device and browser information, aggregated. Because it collects nothing that identifies you and nothing is stored on your device, it runs without a consent prompt. If you would prefer it did not run at all, tell us and we will turn it off for the site.
Google Analytics 4 — off until you allow it. It went live on 17 August 2026.
If you decline the banner, or ignore it, nothing is requested from Google and no Google cookie is set. We do not use the "consent mode" approach where a tag loads anyway and sends anonymous pings. Your answer is stored in your browser's localStorage under cyril-analytics-consent. It is not a cookie and it is never sent to a server.
If you allow it, Google receives:
- the path of the page you viewed — never the query string, which we do not send at all;
- the referrer that brought you here;
- coarse device and browser information;
- a truncated IP address — we enable Google's IP anonymisation.
Google sets its own _ga and _ga_* cookies to recognise returning visits. Google's automatic "enhanced measurement" is left on for this site, so interaction events such as scroll depth, outbound link clicks, file downloads and site search may be recorded in addition to page views. Google Signals, advertising personalisation, remarketing and data sharing with other Google products are switched off.
Changing your mind. The banner appears only while no choice is recorded, so once you have answered there is no in-page way to revisit it. Clear this site's data in your browser settings and the banner will ask again. We have not built a preferences link, and we are not going to describe one that does not exist.
Where analytics is not used. The client portal and the platform administration site carry no analytics at all. The staff application uses a separate, cookieless property that reports a module name from a fixed allowlist and nothing else — no full paths, query strings, page titles, referrers, user IDs, organisation IDs or record identifiers. The two properties cannot be joined. Development, staging and CI builds ship no analytics tag.
Cookie-level detail is in the Cookie Policy.
4. What the platform processes
For an organisation using Cyril, we process whatever that organisation enters: its clients and contacts, projects, invoices, tickets, files, messages and automation records. The organisation decides what goes in and why. We process it to provide the service, on that organisation's instructions.
5. Lawful basis (UK GDPR / EU GDPR Article 6)
- Waitlist and contact submissions — consent. Submitting the form is the consent. There is no separate opt-in box, because there is no separate mailing list to opt in to. You withdraw consent by asking us to delete your submission (see section 9).
- Anti-spam and abuse controls — legitimate interests. Keeping the forms usable and the site secure. These run regardless of your analytics choice.
- Analytics — consent, given through the banner and withdrawn by clearing this site's data.
- Platform use by an organisation — performance of a contract, together with legitimate interests for security and fraud prevention. Personal data an organisation enters about its own clients is processed on that organisation's instructions under the Data Processing Agreement.
- Financial and legal records — legal obligation.
6. Sharing and sub-processors
We do not sell personal data, and we do not share it for advertising.
We share it with the providers we use to run the service. Each one is listed — what it does, what it receives, and where — on the sub-processors page. Each is bound by GDPR Article 28-compliant terms.
Three of them are relevant to this website specifically:
- Cloudflare — DNS, CDN and firewall in front of the site. It also runs the endpoint that receives form submissions, and provides the Turnstile challenge described in section 3.3.
- Google LLC — Google Analytics 4, and only after you opt in.
- Hostinger — the EU-hosted server where the database holding your submission lives.
We disclose personal data to authorities only where we are legally required to.
7. International transfers
Some of our sub-processors are based in the United States. Where personal data is transferred outside the UK or EEA, transfers are made under Standard Contractual Clauses or another safeguard permitted by GDPR Chapter V. Each provider's location is listed on the sub-processors page.
8. Retention
8.1 Waitlist and contact submissions
24 months from the day you submitted the form. After that a nightly job deletes the record.
The period runs from your submission, not from your last contact with us, because the submission is the only interaction that record holds — we do not add to it afterwards. You can ask us to delete it sooner at any point and we will.
This is enforced by a scheduled deletion, not a policy someone has to remember. If you want to check the claim, the window is a single constant in the codebase and the same number appears in our internal retention register.
8.2 Backups
Deleting something from the live database does not immediately remove it from backups. We keep 30 daily, 13 weekly and 12 monthly backups, so a deleted record can persist in a backup copy for up to 12 months before it ages out. Backups made under a legal hold are kept until the hold is lifted.
Website submissions are included in that backup set. If you need your data removed from backups as well as from the live database, tell us — it is handled as a special request involving a manual restore, and we will confirm when it is done.
8.3 Platform and account records
These periods apply to our own records about an organisation and its use of Cyril:
- Organisation account data — for the duration of the subscription plus a 30-day grace period, then permanently deleted.
- Billing records — 7 years, as a financial-records obligation, anonymised once the subscription ends.
- Staff login records (email, IP, timestamp) — 12 months.
- Error and crash reports — 90 days, subject to what our error-tracking provider retains on our current plan, which may be shorter.
- Audit and activity logs — for the duration of the subscription; deleted with the organisation's data.
- Data an organisation enters about its own clients — retained while the organisation is active. The organisation controls it, and it is deleted when the organisation is deleted or when the organisation processes an erasure request.
- Soft-deleted records — 30 days in that state, then permanently deleted.
Two of these are targets rather than mechanisms we have finished automating: the purge of staff login records and the retention of error reports both depend on infrastructure we are still confirming. We will not describe them as guaranteed until they are.
When an organisation cancels: access ends immediately; data is retained for 30 days in case it resubscribes; after that it is scheduled for permanent deletion, with anonymised billing records kept for the 7 years noted above. The organisation's owner receives confirmation once deletion is complete.
8.4 Analytics data
Google retains event data for a limited period set at the property level in Google Analytics, and deletion requests for data already held by Google are made through Google. The staff-application property is set to the two-month minimum by design.
9. Your rights
Under UK GDPR and EU GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to processing;
- receive your data in a portable format;
- withdraw consent at any time, without affecting processing already carried out.
How to exercise them. Use the contact page, or the data protection address once it is published. We will respond within one month. If a request is complex and we need longer, we will tell you within that month, and why. We may ask for enough information to find your record — for a waitlist entry, that is normally just the email address you used.
What we are not going to imply. There is no self-service privacy dashboard for visitors to this website. A request about a waitlist or contact submission is read and actioned by a person. The platform does have administrative tooling for consent records, erasure requests, anonymisation and export, but it is keyed to an organisation's own contacts and does not cover submissions made here.
Withdrawing consent. For the forms, ask us to delete your submission. There is no unsubscribe link because there is no mailing list. For analytics, clear this site's data and answer the banner differently.
Erasure within a customer organisation. Where an organisation processes an erasure request for one of its contacts, name, email addresses, phone numbers, address, date of birth and custom fields are overwritten with placeholders, and files relating to that person are deleted from storage. The record structure is kept so invoices and history stay intact, and the action is written to the audit trail. Invoice records are retained for financial and legal reasons with the name replaced.
Complaints. You may lodge a complaint with the data protection supervisory authority in your country of residence or work. We are not naming a lead authority: no legal entity is registered yet, so which authority would lead is genuinely unresolved.
10. Cookies
This site uses no advertising, social media or fingerprinting cookies. It uses Cloudflare's technical security cookies, and — only if you allow analytics — Google's _ga cookies. Your analytics answer is stored in localStorage, not a cookie.
The full detail, including how to refuse or clear each one, is in the Cookie Policy.
11. Security and breaches
Data is encrypted in transit, access to production systems is restricted, and personal data is deliberately kept out of application logs.
Cyril is not certified against SOC 2 or ISO 27001. SOC 2 Type 1 is a target we are working towards, not something we hold, and we will say so on this page until that changes.
If a personal data breach occurs, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, notify affected organisations without undue delay, and notify affected individuals directly where the breach is likely to result in a high risk to them.
To report a suspected security problem, email security@getcyril.com.
12. Children
Cyril is a business tool. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has submitted their details through this site, contact us and we will delete the record.
13. Changes
We will update this Policy as Cyril changes. The "Last updated" date at the top always reflects the most recent change.
We have no mailing list to announce changes on, so the commitment we can actually keep is this one: material changes will be summarised at the top of this page when they are made.
14. Contact
<!-- TODO(legal): Publish formal data protection contact and registered address. -->For privacy queries, including any of the rights in section 9, contact us via the contact form. The data protection contact and registered address will be published here before public launch. For suspected security issues, email security@getcyril.com.