CyrForge and the general data protection regulation (GDPR)

The General Data Protection Regulation (GDPR) is a privacy regulation enacted by the European Union (EU) to strengthen the protection of individuals' data. It became enforceable on May 25, 2018, and applies to any company that handles the data of EU citizens, no matter where the company is based.

This page explains how CyrForge implements GDPR principles and ensures that your data is handled transparently, securely, and respectfully.

• Who we are
• Who controls the data you store in CyrForge
• What types of data do we collect?
• Why do we collect data?
• How long do we retain your data?
• Third-party services we use
• Your rights over your data
• How you can manage, update, or delete your information
• How to contact us about your data

What is GDPR?

In simple terms, GDPR gives you greater control over your personal information. Service providers (like CyrForge) must be transparent about what data they collect, how they use it, and how they share it — and users must have full rights to access, modify, or delete their data.

Although GDPR is an EU regulation, it affects any business that collects or processes the data of EU residents, including CyrForge.

How CyrForge Implements GDPR

CyrForge is built so that the privacy-respecting option is the default one: your data is isolated to your own account, mailbox content is never stored, we run no advertising or analytics trackers, and both data export and account deletion are self-service rather than something you have to ask us for.

• You are the controller for the contact, customer, and member records you enter into CyrForge. You decide whose data to collect, what to record, and why — and you are responsible for having a lawful basis for it.

• Elemental Genius LLC is the processor for that data. We store and process it on your behalf, on your instructions, solely to provide the Service. If someone contacts us directly about data you hold, we refer them to you rather than acting on our own initiative.

• We are the controller for your own account and billing data — the information you give us to have a CyrForge account at all.

If you are subject to GDPR or UK GDPR, you will generally need a Data Processing Agreement with us. Ours is published at /dpa/ and includes the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.

Data we collect

• Account information: Your email address. If you sign in with Google, also your display name and profile picture. Passwords are handled by Google Identity Platform and are never visible to us.

• The CRM data you enter: Contacts and members (names, email addresses, phone numbers, companies, professions, addresses, tags, notes), referrals, events, and attendance. Most of this is personal data about other people, which is why the controller and processor roles above matter.

• Gmail data, only if you connect it: Message content is read live from your mailbox when you ask the assistant to work with it, used for that request, and then discarded. It is never stored in CyrForge, and there is no background sync of your mailbox.

• Billing data: Your subscription status and the identifiers linking your account to Stripe. Payment card details are collected directly by Stripe and never reach our servers.

• Technical data: IP address and browser information recorded in ordinary server logs, used for security and to keep the Service running.

We do not use advertising cookies, analytics cookies, or cross-site trackers. The cyrforge.com website loads no third-party scripts at all. The CyrForge application loads exactly one — Google reCAPTCHA — used solely to tell real people apart from automated attacks on the sign-in and signup forms; it sets its own browser storage to do that. Apart from reCAPTCHA, the only storage we rely on keeps you signed in and remembers your display preferences.

Why we collect your data

• To create and manage your CyrForge account
• To provide the CRM itself — storing and organizing the records you enter
• To run the AI features you invoke, such as summaries, suggestions, and draft replies
• To process subscription payments through Stripe
• To keep the Service secure and to detect and prevent abuse
• To comply with our legal obligations

How long we retain your data

We keep your data for as long as your account is open. When you close your account, your records are deleted immediately as part of that process — including any connected Google authorization, which we revoke at Google rather than merely forgetting on our side. Gmail message content is never retained at all. We may keep billing records where law requires it, and we keep exit-survey answers under a randomly generated identifier that is not linked to you.

• Google Cloud Platform and Firebase: Application hosting, database, and authentication. United States.

• Google Cloud Vertex AI (Gemini): The AI features. Processes your CRM records, and Gmail content where you use those features, under Google Cloud terms that prohibit using customer content to train foundation models. United States.

• Stripe, Inc.: Subscription billing and payment processing. Payment details are collected directly by Stripe. United States.

• Cloudflare, Inc.: DNS, TLS termination, and content delivery for cyrforge.com. United States and global edge.

• Google reCAPTCHA Enterprise: Detects automated abuse of sign-in and account creation. Examines device and browser characteristics and interaction signals; never receives your password or your CRM records. Our legal basis is legitimate interest — protecting accounts, and the personal data they hold about other people, from automated attack. United States.

• Anthropic, PBC: AI features, only if you choose to supply your own Anthropic API key. Receives CRM records sent to the features you use, never Gmail content. If you never enter a key, no data reaches Anthropic. United States.

• OpenAI, L.P.: AI features, only if you choose to supply your own OpenAI API key. Receives CRM records sent to the features you use, never Gmail content. If you never enter a key, no data reaches OpenAI. United States.

Your data rights

• Access a copy of your personal data

• Correct inaccurate or incomplete data

• Erase your personal data

• Export your data in a portable format

• Restrict or object to how we process your data

• Withdraw consent where processing is based on it

• Complain to your supervisory authority

How to manage or delete your data

• You can add, correct, and delete the records you store in CyrForge at any time from within the app.
• Settings holds a one-click export of everything we hold about you, and a self-service account closure that deletes it. Both remain available even if your subscription has lapsed.
• If you connected Gmail, you can disconnect it at any time — from CyrForge, or from your Google account permissions page — without closing your CyrForge account.
• To request a data export or deletion by email, or to ask for a Data Processing Agreement, contact: [email protected]