Last updated: April 19, 2026
Privacy Policy
1. Data controller
The data controller for data collected via klyro-ai.com and app.klyro-ai.com is:
- Klyro AI — David Audiger (Sole proprietorship)
- 13 Impasse de Tananarive, 44800 Saint-Herblain, France
- SIRET: 520 286 337 00040
Privacy / DPO contact: contact@klyro-ai.com
2. Data collected
- Account data: email, name, company, password (hashed)
- Usage data: generated articles, campaigns, technical logs, IP address
- Google data (OAuth): read-only access to Google Search Console and Google Analytics, with explicit authorization
- Payment data: processed exclusively by Stripe — Klyro stores no banking data
- Communications: emails exchanged with support
3. Legal bases and purposes
| Processing | Legal basis |
|---|---|
| Account creation and management | Performance of the contract |
| Billing and payment (Stripe) | Legal obligation (accounting / tax) |
| Product analytics and technical logs | Legitimate interest (service improvement) |
| Marketing emails / newsletter | Consent (opt-in, opt-out at any time) |
| Customer support | Performance of the contract |
4. Processors
Klyro AI never sells your data. We use the following processors, governed by data processing agreements (DPA):
- Our EU-certified host — database and authentication (EU servers)
- Resend — transactional email delivery
- Stripe — payment processing (PCI-DSS Level 1)
- Anthropic and OpenAI — AI content generation (USA)
- Google — OAuth and GSC / GA API reads (with consent)
5. Transfers outside the EU
Some processing (AI generation via Anthropic and OpenAI, Google OAuth) involves data transfers to the United States. These transfers are governed by the Standard Contractual Clauses (SCCs) approved by the European Commission, in accordance with article 46 of the GDPR.
No identifiable customer data is used to train third-party AI models.
6. Retention periods
- Active account: for the entire subscription duration
- Inactive account: deletion after 3 years of inactivity
- Billing data: 10 years (legal accounting obligation)
- Technical logs: 12 months
- Cookies: 13 months maximum
- Deletion on request: within 30 days
7. Your rights (GDPR)
You have the following rights at any time:
- Right of access to your data
- Right of rectification
- Right to erasure (“right to be forgotten”)
- Right to portability
- Right to object to processing
- Right to restriction of processing
- Right to withdraw your consent at any time
Procedure: send your request to contact@klyro-ai.com with proof of identity. We respond within 30 days maximum.
9. Security
Your data is isolated per account — no user can access another user's data, regardless of configuration. TLS 1.3 in transit, AES-256 at rest. Encrypted OAuth tokens. Quarterly security audit.
10. CNIL complaint
If you consider, after contacting us, that your rights are not respected, you can file a complaint with the French data authority CNIL: www.cnil.fr/fr/plaintes