Privacy Policy

Zyclo is operated by Diego Petkoff, an individual (not yet a registered company), governed by the laws of Spain. For any privacy question, request, or complaint, contact diego.petkoff@gmail.com.

Account data. Email address and password (handled by our authentication provider, Supabase — we never see or store your password in plain text), to let you sign in and own your cycle history and credit balance.

Payment data. Processed entirely by Stripe. We never receive or store your full card number — only a reference to the completed transaction, used to credit your account.

What you submit to run a machine. Website URLs, competitor URLs, industry/country descriptions, ideal-customer descriptions, and any files you upload (Archive Engine) — stored so you can revisit your cycle history and re-download past reports at any time.

Cloud-storage connections. If you connect Google Drive or Dropbox to import files into Archive Engine, we store an access/refresh token (not your Google/Dropbox password, which we never see) so we can list and download files you explicitly choose to import. We request read-only access — Zyclo cannot modify, delete, or write to your Drive or Dropbox account. You can revoke this access at any time from your Google or Dropbox account settings, which invalidates the stored token.

Third-party personal data (Lead Engine specifically). Lead Engine looks up business contact information — names, job titles, company affiliations, LinkedIn URLs, and (on paid data-source tiers) email addresses — for people who did not sign up for Zyclo and did not give it to us directly. This data comes from People Data Labs, a third-party data provider, based on criteria you supply (industry, company size, role, geography). If you are in the EU/EEA and use this feature, you are responsible for having a lawful basis (typically legitimate interest, properly balanced and documented) for that outreach, and for honoring opt-out/erasure requests from the people you contact. Zyclo provides the sourcing and drafting tool; it does not send anything on your behalf, and it does not conduct the legitimate-interest assessment for you.

We don't sell your data. It passes through the following processors, each only for the purpose of running the service:

• Supabase — authentication, database, and file storage.
• Stripe — payment processing.
• Anthropic — processes your cycle inputs (and uploaded file contents, for Archive Engine) to generate outputs.
• People Data Labs — lead sourcing for Lead Engine (see above).
• Google / Dropbox — only if you explicitly connect them, to list and import files you choose.
• Vercel — application hosting.
• Inngest — orchestrates the multi-step processing behind each cycle; your cycle data passes through it transiently while a cycle runs.

Most of these processors are based in the United States. Where that applies, data leaving the EU/EEA relies on that processor's own standard contractual clauses or equivalent safeguards — we haven't independently audited each one, which is part of why this policy recommends its own legal review before you rely on it for a business handling EU personal data at scale.

Cycle history, uploaded files, and generated reports are kept indefinitely so you can revisit them, unless you ask us to delete your account and its data. There is currently no automatic deletion after a fixed period — if you want that changed for your account, contact us.

If you're in the EU/EEA (or anywhere with similar protections), you can ask us to access, correct, export, or delete your personal data, or object to specific processing. Contact diego.petkoff@gmail.com and we'll act on it directly — there's no automated self-service flow for this yet. If you're not satisfied with our response, you can lodge a complaint with Spain's data protection authority, the Agencia Española de Protección de Datos (AEPD).

If Lead Engine has sourced your contact information as a third party (not a Zyclo user) and you want it removed from a specific cycle's output, contact us with the details and we'll act on it — but note we don't control People Data Labs' own underlying database; a direct request to PDL may also be necessary for broader removal.

Zyclo uses a session cookie (set by Supabase Auth) strictly to keep you signed in. No advertising or cross-site tracking cookies are used.

Zyclo is not directed at, and should not be used by, anyone under 16.

If this policy changes materially, the "Last updated" date above will change. We don't currently send an email notification for policy updates — check back periodically if that matters to you.