Kyber — Privacy Policy

Section 1

Who we are

[Company name — to be confirmed], trading as Kyber ("Kyber", "we", "us"), is the data controller for personal data collected through our platform. We are [registration details — to be confirmed] and our registered office is [registered office — to be confirmed].

We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you've bought "Own it" and host your instance yourself: this policy describes how we handle data on our own infrastructure. Where you run your instance independently of us, you are the data controller for the data it processes, not us — your own data protection obligations to your customers and drivers are yours to meet. Adding our support retainer doesn't change who hosts your data, only who helps you run it.

For any privacy-related questions, contact our Data Protection Officer at privacy@kyber.software.

Section 2

What data we collect

Category	What we collect	Why
Account data	Name, email, phone, company details	To create and manage your account
Fleet data	Vehicle registrations, driver details, job records	To provide fleet management features
Financial data	Invoice records, payment history	To provide invoicing and billing features
Usage data	Pages visited, features used, session duration	To improve our platform
Integration data	Google Maps API usage for job routing	To provide route distances and directions
Communications	AI-drafted emails you approve and send (chases, quotes, digests)	To power the AI drafting features

Section 3

How we use your data

We use your personal data to:

Provide, operate and improve our platform and services
Process your subscription and manage your billing
Power our AI agents — your job data is used to generate dispatch analysis, compliance digests and invoice/quote drafts
Send you important service notifications and updates
Respond to your support requests
Comply with our legal obligations
Detect and prevent fraud or security incidents

We do not use your data for advertising and we never sell your data to third parties.

Section 4

AI and data processing

Our AI agents (Dispatch, Compliance and Admin) process your operational data to generate recommendations and draft communications. This involves sending relevant data to our AI model provider, Anthropic (Claude).

Data sent to our AI provider for processing is subject to their privacy policy. We only send the minimum data required to complete each task and we do not use your data to train AI models.

Specifically:

The Dispatch Agent sends job, driver and vehicle data to our AI provider to draft allocation and clash analysis
The Compliance Agent sends vehicle/trailer compliance records to our AI provider to draft digests and audit packs
The Admin Agent sends job and invoice history to our AI provider to draft quotes and payment chases

Section 5

Data storage and security

All data is stored on servers located within the European Economic Area (EEA). We use Supabase (PostgreSQL) for our primary database, hosted in EU data centres.

Security measures we use

256-bit SSL/TLS encryption for all data in transit
AES-256 encryption for sensitive data at rest
Multi-factor authentication available on all accounts
Regular security audits and penetration testing
Role-based access controls — staff only access data they need
Automatic backups with 30-day retention

Section 6

Your rights under UK GDPR

As a data subject you have the following rights:

Right of access — request a copy of the personal data we hold about you
Right to rectification — ask us to correct inaccurate data
Right to erasure — ask us to delete your personal data ("right to be forgotten")
Right to restriction — ask us to limit how we use your data
Right to portability — receive your data in a structured, machine-readable format
Right to object — object to our processing of your data
Right to withdraw consent — where we process data based on consent, you can withdraw it at any time

To exercise any of these rights, email privacy@kyber.software. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Section 7

Cookies

We use cookies to keep you signed in, remember your preferences and understand how you use our platform. We use only essential and analytical cookies — no advertising or tracking cookies.

Essential cookies — required for the platform to function. Cannot be disabled.
Analytics cookies — help us understand usage patterns so we can improve the platform. Can be disabled in your account settings.

Section 8

Data retention

We retain your data for as long as your account is active. When you close your account:

Your personal account data is deleted within 30 days
Job records and invoices are retained for 7 years to comply with UK tax law
Anonymised analytics data may be retained indefinitely
Backups containing your data are purged within 90 days

You can request immediate deletion of your data at any time by contacting privacy@kyber.software, subject to our legal retention obligations.

Section 9

Contact & complaints

For any privacy-related questions or to exercise your rights:

Email: privacy@kyber.software
Post: [Company name — to be confirmed], [registered office — to be confirmed]
Response time: within 30 days

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk or 0303 123 1113.

Section 10

Sub-processors and international transfers

We use the following service providers to run Kyber. Where they handle personal data on your behalf they act as our sub-processors, under written contracts that require them to protect it. Data is only shared to the extent each provider needs to do its job.

Provider	What they do for us	Data involved	Location
Supabase	Primary database, sign-in and server functions	All platform data	EU data centres
Anthropic (Claude)	AI model that drafts analyses, quotes, invoices and replies	Only the job, vehicle, compliance, invoice or email data needed for each request. Not used to train models	United States
Netlify	Website hosting and the contact-form function	Website visitor data and contact-form messages	Global network; United States
Resend	Sends emails you approve (invoices, updates, chases) and platform notifications	Recipient email addresses and email content	United States
Postmark	Receives customer emails for the Support Agent	Inbound emails sent to your Kyber address	United States
Google Maps Platform	Route distances and journey times	Job origin and destination addresses	United States / global
Stripe	Takes payment of Kyber fees by payment link	Payer and payment details for Kyber's own fees only; no fleet data	Ireland / United States

Where a provider is outside the UK, we rely on an approved safeguard for the transfer, such as an adequacy decision, the UK-US data bridge, or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. We will tell business customers before adding or replacing a sub-processor, as set out in our data processing agreement. To ask about a specific provider or safeguard, email privacy@kyber.software.

Privacy Policy