Privacy Policy

• Account data: name, email, organization, role.
• Environment data: the structured profile you submit through the intake wizard, document uploads, and the structured output our engine produces.
• Integration data: CyberTwin is upload-based today. Should we later offer read-only API integrations, we would pull only the minimum-scope data described on our Trust & security page.
• Operational data: sign-in events, audit-log entries, billing events from our payment processor (Polar).
• Marketing-site data: conversion events on the marketing site (which call-to-action was used) sent to our own server with no identity attached. Only if you click Accept in the cookie banner: PostHog product analytics (EU Cloud) on marketing pages, counting page views under a first-party analytics cookie and browser storage (no click tracking, no session recording), and the LinkedIn Insight Tag on marketing pages for advertising attribution, which sets a third-party cookie. Both tags are described under Cookies below. The signed-in app loads neither: no advertising or analytics tags inside the product.

• To deliver the recommendation engine you are paying for (legitimate interest, contractual necessity).
• To bill you (contractual necessity).
• To meet our security and audit obligations (legal obligation).
• To send transactional email related to your account (contractual necessity).
• To send marketing email only if you opt in (consent).

Data is encrypted at rest by the cloud provider and in transit via TLS 1.2 or higher. Any integration credential we hold (CyberTwin is upload-based today; read-only integrations are not live) is encrypted at rest with a server-side key (AES-256-GCM). Region-pinned data residency is available on Enterprise — contact us to scope it for your organisation.

Only our subprocessors, listed with what each receives and where it processes data at cybertwin.io/subprocessors, and summarised on our Trust & security page. We notify customers in writing before adding a subprocessor.

• Active account data: while your account is active.
• Environment data: while your account is active; after cancellation, the account is read-only for 90 days so you can export, data is retained a further 90 days for re-activation, then deleted — 180 days total. (See the cancellation terms for the full timeline.)
• Audit logs: 12 months.
• Billing records: 7 years (tax retention requirements).

These deletions are handled manually today: we run them by hand, not by an automatic job. To have your data removed sooner, email privacy@cybertwin.io.

What we send our AI subprocessor: Anthropic’s published policy is to delete API inputs and outputs within 30 days of receipt or generation, keeping them longer only if a request is flagged under its Usage Policy (up to 2 years) or the law requires it. Shorter retention, down to none, needs a separate agreement with Anthropic; we do not have one today.

If you are in the EU/UK, GCC, California, or any jurisdiction whose privacy law gives you specific rights, you can request access, correction, deletion, or portability. Email privacy@cybertwin.io; we respond within 30 days.

Strictly necessary cookies for authentication and session in the app. On marketing pages, and only there, we can load two tags, and only after you click Accept in the cookie banner. Nothing loads before you choose, Decline is one click like Accept, and a browser that sends Global Privacy Control is treated as a Decline and never asked. PostHog (EU Cloud) product analytics sets a first-party analytics cookie and uses browser storage to recognise a returning browser across marketing pages and to count page views; click tracking and session recording are off. The LinkedIn Insight Tag sets a LinkedIn cookie used to measure whether a LinkedIn ad led to a visit; LinkedIn's opt-out is at linkedin.com/psettings/guest-controls/retargeting-opt-out, and browsers that block third-party cookies block it entirely. Neither tag loads inside the signed-in app, which sets session cookies only, and both are switched off if you move from a marketing page into the app. Your choice is kept in this browser's local storage, not in a cookie. If you arrive from a LinkedIn ad, a first-party cookie (li_fat_id, 30 days) keeps the ad's click id so a later signup can be credited to that ad by our server, with a SHA-256 hash of your email; no LinkedIn script is involved. We set no other analytics or advertising cookies.

You have not chosen yet.

Not directed at children under 16. We do not knowingly collect data from them.

We update this policy when our practices change. Material changes are emailed to org Owners with at least 14 days notice. Earlier versions are available on request from privacy@cybertwin.io.

Privacy team: privacy@cybertwin.io
Security disclosure: security@cybertwin.io