Privacy policy

Account information includes your email, display name, account identifiers, authentication information and optional authenticator enrollment. Google or Lovable sign-in supplies account information through the selected identity provider. We also handle support correspondence.

Investigation information includes saved conversations, prompts, searches, findings, mind-map relationships, case notes, sources and location pins. Investigations can contain personal information about people who do not have a Cylect account. Public availability does not eliminate privacy rights.

Billing information includes Stripe customer and subscription identifiers, plan status, purchase records and usage allowances. Stripe handles payment-method entry in its payment form; our application does not provide its own card-entry fields.

Service providers may process IP addresses, browser/device information, access times, session identifiers and operational diagnostics when delivering, securing and troubleshooting the service. Remote-browser session identifiers and resource usage are associated with your account.

We use information to authenticate accounts, deliver and autosave investigations, answer AI requests, connect authorized agents, show map findings, provide remote browsing, process billing, enforce usage allowances, respond to support, prevent abuse and comply with legal obligations.

Where applicable law requires a legal basis, processing may rely on performing our agreement, legitimate interests in operating and securing the service, legal obligations, or consent where required. This notice is not a claim that every investigation you conduct is lawful; you must have a lawful basis for information you submit.

When you use the analyst, your conversation and relevant tool inputs or results are sent through Lovable’s AI gateway to the configured AI provider, which may include OpenAI. Requests may include investigation subjects, findings and place names. Do not submit information you are not authorized to disclose to these providers.

Provider processing is governed by the applicable service arrangements and provider terms. We do not make a blanket promise that all upstream providers retain no data or never use it for training. AI answers can be incorrect or reveal unintended information; independently verify them before use.

Lovable Cloud and associated infrastructure process account information and saved workspace content to host and operate the application. Stripe processes payments, billing information and account-linked customer identifiers. Identity providers process sign-in requests. Hyperbeam processes remote-browser sessions and the websites opened within them.

Public feed providers supply map data. The geocoding provider, currently Open-Meteo, receives city names and geographic qualifiers when an approximate pin is resolved. A city-center pin is not proof of a person’s exact location.

We may disclose information to service providers for the purposes described here, where legally required, to address security or unlawful activity, or in a business transfer subject to applicable safeguards. This replaces the legacy notice’s statement that personal information is never shared with third parties.

An external agent you authorize through MCP can retrieve investigation information and invoke supported tools that change findings or add locations under your account. Information returned to that agent is also subject to its operator’s privacy practices. Only authorize clients you trust and use the authorization provider’s available controls to revoke access.

Personal feed connections send requests directly from your browser to the provider you choose, including a bearer token if you supply one. The provider sees the request and may see your IP address. The application keeps these supplied credentials in the current page session rather than intentionally saving them to workspace storage. Provider logging and browser extensions are outside this control.

Visited websites in the remote browser have their own notices and may collect browsing information. Browser isolation does not guarantee anonymity, absence of logs, or deletion of all provider-held information at session end.

The application uses browser storage and, where required by authentication or payment providers, cookies or similar technologies for sessions, preferences and payment functionality. Blocking them may prevent sign-in or checkout.

This platform notice does not import the legacy site’s Google Analytics, AdSense or Plerdy disclosures as claims that those tools are installed here. Third-party websites you visit may use advertising and analytics technologies independently. Any future nonessential tracking must be disclosed and consent obtained where required.

Saved investigations remain available until deleted or otherwise removed under our service processes. We retain account, billing and operational records as needed for service delivery, security, disputes and legal obligations. Backups and provider-held records may remain after active records are removed. We do not promise immediate erasure from every system or a fixed retention period that has not been established.

Account-scoped access controls and other technical safeguards aim to protect information, but no system is completely secure. Information may be processed outside your state or country, including in the United States. Additional safeguards or agreements may be required for regulated or cross-border data; contact us before uploading such information.

You can update supported account settings, manage your billing, delete investigations using available controls, and choose whether to use AI, remote browsing or external agents. Account deletion is not the same as canceling billing, and cancellation alone does not request data erasure.

Contact support@cylect.io to request access, correction, export or deletion of your information, or to raise a privacy concern about information concerning you in an investigation. Depending on your jurisdiction, you may also have rights to restrict or object to processing, withdraw consent, or complain to a regulator. We will assess requests under applicable law, verify identity where necessary and consider legal retention duties and the rights of others.

Do not send passwords, payment-card details or confidential investigation files with an initial request. We may need a secure follow-up channel. This notice does not assert a verified blanket GDPR, CCPA or other regulatory certification.

Cylect AI is intended for professional and responsible investigation use, not for services directed to children. Do not create a child’s account or upload children’s information without the authorization and safeguards required by law. Contact us if you believe we have improperly received such information.

We will update the effective date when this notice changes and provide additional notice or seek consent where applicable law requires it. Changes do not waive existing statutory privacy rights.