Privacy Policy

This Privacy Policy explains how CYA (“we”, “us”, “our”) collects, uses, and protects the personal data you provide when you visit cya.app or submit an early access application. We are committed to handling your data in accordance with the General Data Protection Regulation (GDPR) and applicable Irish data protection law.

1. Who we are

CYA is a software product operated from Ireland. If you have any questions about this policy or wish to exercise your data rights, you can contact us at hello@getcya.app.

2. What data we collect

When you submit an early access application through our website, we collect the following information:

• Full name
• Company or organisation name
• Industry vertical
• Team size
• Business email address
• Phone number (optional)
• Submission timestamp (recorded automatically)

We do not collect payment information, government-issued identifiers, or any special categories of personal data.

3. Why we collect it and our legal basis

We collect this data to evaluate and respond to early access applications, and to contact you regarding your application and the CYA product. Our legal basis for processing is legitimate interests (Article 6(1)(f) GDPR) — specifically, our interest in assessing applicants for the founding cohort — as well as your consent given at the point of submission.

4. How we store your data

Submissions are stored securely in Supabase, a cloud database platform. Your data is stored on servers within the European Union. Access is restricted to authorised members of the CYA team only. Supabase acts as a data processor on our behalf and is bound by a Data Processing Agreement.

Submissions are write-only from the public form — they cannot be read, edited, or deleted by anonymous visitors.

5. How long we keep your data

We retain early access application data for up to 24 months from the date of submission, or until you request its deletion, whichever comes first. After this period, data is permanently deleted.

6. Who we share your data with

We do not sell, rent, or share your personal data with third parties for marketing purposes. We may share data with:

• Supabase — as our data storage provider (processor)
• Email service providers — if we send you a response to your application
• Law enforcement or regulators — where required by applicable law

7. Your rights under GDPR

As a data subject under GDPR, you have the following rights:

• Right of access — to request a copy of the personal data we hold about you
• Right to rectification — to have inaccurate data corrected
• Right to erasure — to request deletion of your data ("right to be forgotten")
• Right to restrict processing — to ask us to limit how we use your data
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to object to processing based on legitimate interests
• Right to withdraw consent — at any time, without affecting the lawfulness of prior processing

To exercise any of these rights, email us at hello@getcya.app. We will respond within 30 days. You also have the right to lodge a complaint with the Data Protection Commission (Ireland).

8. Cookies and analytics

This website does not currently use tracking cookies, advertising cookies, or third-party analytics. We may use essential cookies to support basic website function. If we introduce analytics in future, this policy will be updated and you will be notified via a cookie consent notice.

9. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will reflect any changes. Continued use of the website after an update constitutes acceptance of the revised policy.

10. Contact

For any privacy-related questions or requests, contact us at: hello@getcya.app.