Privacy Policy

1.1 Four kinds of person appear in this policy, and the answers differ for each. You may be more than one.

aYou contacted us. You booked a meeting, asked for support, or wrote to us. Section 02.

bWe contacted you. You received an email, a message or a connection request from us without having asked for one. Section 03 explains where your details came from and how to make it stop.

cYour employer is a Cycle customer. You appear in a workspace, and possibly on a device running our agent. Sections 04 and 05.

dYou sign in to Cycle. You hold an account. Section 04.

1.2 Controller or processor. The distinction decides whose privacy notice governs, so we state it plainly rather than leaving it implied:

aFor sections 02 and 03 — people who contact us, and people we contact — we are the controller. We decided to hold the information and we are accountable for it.

bFor sections 04 and 05 — workspace data and device telemetry — your employer is the controller and we are their processor. We act on their instructions, and their privacy notice, not this one, governs that processing. This policy describes it anyway, because you are entitled to know what the software does.

2.1 The meeting form. It asks for your name, work email address and company, and gives you an optional free-text box. We use those to reply to you and to prepare for the conversation. There is no marketing list to be added to, because we do not run one.

2.2 Preventing abuse of the form. A public form attracts bots. With each submission we store a salted, irreversible hash of your IP address and your browser’s user-agent string, used only to count recent submissions from the same source and refuse a flood. We do not store the address itself, and the hash is not used to identify or profile anyone.

2.3 Writing to us. If you email us — for support, for early access, or to exercise a privacy right — we receive your address and whatever you put in the message. We use it to answer you, and for nothing else.

2.4 Lawful bases. Our legitimate interest in responding to enquiries and in keeping our own systems from being abused, and the steps necessary to enter a contract where you are asking us to do business with you.

3.1 We approach organisations we believe Cycle can help, and the people in them whose job the product concerns. If you received a message from us and did not ask for it, this section is the one that applies, and it is written to answer the question you actually have: where did you get this.

3.2 What we hold about you. Business contact and role information — your name, job title, employer, work email address, business phone number and professional profile URL — together with publicly filed facts about the organisation you work for. We also keep the correspondence itself, and a working summary assembled from it so that a colleague picking up the thread is not starting from nothing.

3.3 Where it came from. Not from you. We obtain it from the following categories of source, which is the disclosure Article 14 of the UK and EU GDPR requires of us:

aprofessional networking platforms, where you published a profile in a business capacity;

bcommercial data enrichment providers, who compile business contact details;

cpublic government registries and licensing databases, which publish facts about regulated organisations and the people who hold licences;

dpublicly accessible web sources, including your employer’s own website and public news; and

eemail verification services, which tell us whether an address we already hold is deliverable.

3.4 What we do with it. We assess whether your organisation is a plausible fit, and if so we contact you by email, messaging or a professional network. Our software drafts and sends those messages, and decides on timing and follow-up. A person can review any of it, and no message is sent to anyone who has objected.

3.5 Lawful basis, and the balance we struck. Our legitimate interest in offering a business product to the businesses it is built for. We think that interest is legitimate because we contact you in your professional capacity, about your work, at a business address, with information a person in your role would expect to be public. Against that we weigh the fact that you did not ask to hear from us. Which is why the next clause is short and unconditional. Where local law requires consent for a particular channel, we rely on consent for that channel instead.

3.6 How to make it stop. Reply to the message and say so, or write to our privacy address in the final section. You do not need a reason and you do not need to explain — objecting to direct marketing is an absolute right, not one we get to weigh. We record the objection and stop, and the record of it is what prevents us contacting you again by another route later.

3.7 How long we keep it. Each fact carries its own retention period, set by how quickly it stops being true — from a week for a piece of recent news to ten years for a permanent registry identifier. Correspondence is kept while the conversation is live and for as long as we need it afterwards to honour an objection you have made.

4.1 Where your organisation is a Cycle customer, we process workspace data under our agreement with that organisation. Your employer is the controller and we are the processor: their privacy notice governs that processing, not this one, and a request about it is one we will pass to them.

4.2 What a workspace holds about you. Your name, work email address and the team or department you belong to. Where your employer connects their corporate directory, we also receive your job title, office location, manager and whether your account is active. We do not collect any of this from you directly; your employer supplies it.

4.3 If you hold an account. We store your name, email address, profile image where your identity provider supplies one, and the tokens that keep you signed in. We record administrative actions taken in a workspace — who changed what, when, and the IP address the request came from — because a workspace administrator needs to be able to answer that question.

4.4 What we do not do with it. We do not use workspace data to market to you, and we do not use it to train general-purpose models.

4.5 Deletion. Workspace data is retained under the customer agreement and deleted on termination in line with it.

5.1 Some customers install Cycle’s agent on employees’ laptops to measure how AI tooling is being used. It reads the logs that AI coding tools already write to disk. If it is running on your machine, this is what it does — and your employer, not Cycle, decided to install it.

5.2 What never leaves your laptop. Your prompts and the model’s replies. The arguments you pass to tools. File paths, file contents, your working directory and your branch names. The agent reads some of these locally in order to count and classify, and then discards them.

5.3 This is enforced, not promised. An automated test freezes the list of fields the agent is permitted to transmit and asserts that a set of forbidden names — including prompt, content, arguments, path and branch — cannot appear in any of them. A change that added one would fail the build. We mention the mechanism because a privacy commitment you can verify is worth more than one you have to believe.

5.4 What it does send. Counts and measurements: how many prompts and tool calls, how long a session ran, how many tokens and what they cost, which model was used, how often a tool returned an error, and the names of the tools, skills and extensions you have installed. Sessions are labelled with a category — debugging, refactoring, research and so on — worked out on the device from your activity; only the label travels. Projects are identified by an irreversible hash, never by their folder name.

5.5 Two exceptions, which we would rather state than have you find. When the agent inventories the AI tools configured on the machine, it sends the file location of each configuration file, the command used to launch a local tool, and the address of a remote one. When it inventories installed tools, it sends their install location. Those are real file paths, and a file path can contain the name of a project or a client. Nothing else the agent sends contains a path.

5.6 What does not exist. There is no screen capture, no keystroke logging, no window-title recording and no browser history collection in the agent. Not disabled — absent. No code to do any of it has been written.

5.7 What is sent, and when. The agent checks in periodically. It sends per-session measurements for sessions active in the previous fourteen days, and per-prompt measurements from the previous forty-eight hours. Older activity is not re-sent.

6.1 We apply technical and organisational measures appropriate to the risk, including encryption in transit and at rest, least-privilege access and audit logging. No transmission or storage system is perfectly secure, and we do not claim otherwise.

6.2 Retention. Real periods, rather than an assurance that they are short:

aApplication and server event logs are deleted after 90 days by a scheduled job.

bWorkspace measurement records are kept for 400 days, so that a year-on-year comparison is possible, and then deleted.

cInformation about people we contact is kept per fact, from a week to ten years, as described in section 03.

dCorrespondence is kept while it is needed to answer you and to meet legal, tax and accounting obligations, then deleted.

eWorkspace data is retained under the customer agreement and deleted on termination in line with it.

7.1 Sub-processors. Where your employer is the controller and we are their processor, the providers we engage are sub-processors: each is bound by written terms that pass down the obligations we owe under that agreement, may process personal information only on our documented instructions, and may not appoint anyone further without the same terms applying. They fall into these categories:

aCloud hosting and databases. Personal information is encrypted in transit and encrypted at rest. These providers store it and run the infrastructure it sits on; they do not use it, and they hold no rights over it.

bAI model providers. Content sent for processing is never used to train their models. We contract on commercial API terms that prohibit it outright — this is not a setting we have chosen and could change, it is a term of the agreement.

cEmail and messaging delivery. Used to send and receive the messages described in sections 02 and 03.

dData enrichment and email verification. Used only for the outreach described in section 03, never on workspace data.

eObservability and error monitoring. Operational telemetry. Values known to carry secrets or sensitive identifiers are stripped before a log line is written, not before it is shipped.

fOrdinary business tools. Documents, correspondence and the like.

7.2 Never sold, never brokered. We do not sell personal information, and we do not share it for cross-context behavioural advertising. There is no advertising business here to sell it to.

7.3 Legal and safety. We may disclose information where required by law, to enforce our terms, or to investigate fraud or a threat to someone’s safety. Where we are permitted to tell you, we will.

7.4 Corporate transactions. If the business is sold or merges, personal information may transfer with it, subject to this policy or one no less protective.

8.1 Subject to the law that applies to you, you may:

awithdraw consent, where processing rests on it;

baccess the personal information we hold about you;

chave inaccurate information corrected;

dobject to processing based on our legitimate interests — and, where the processing is direct marketing, object absolutely;

erequest erasure;

frequest that processing be restricted; and

greceive your information in a portable, machine-readable form.

8.2 Write to the address in the final section. We verify identity before acting on a request, and we answer within the period the applicable law sets. We do not charge a fee except where a request is manifestly unfounded or excessive. Where your employer is the controller — sections 04 and 05 — we will pass your request to them and help them answer it.

8.3 Automated decisions. We make no decisions producing legal or similarly significant effects by automated means alone about visitors to this site or people we contact. Inside a customer workspace the position is different and we would rather set it out than imply otherwise: Cycle produces automated assessments of how AI tooling is used, per person, and can recommend policy on the strength of them. Those assessments are made available to the customer, who decides what if anything to do with them. Responsibility for human review, and for telling you about it, rests with your employer under their agreement with us.

8.4 You may complain to your local supervisory authority. We would rather you told us first, but that is your right and not a precondition.

8.5 EU and UK representative. We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

aEuropean Union (EU)

bUnited Kingdom (UK)

8.6 Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following https://app.prighter.com/portal/13994919935

9.1 We and our providers process personal information primarily in the United States, and in the European Union where a provider operates there. That may be outside the country where you live.

9.2 Where it is, we rely on an adequacy decision covering the destination, or on standard contractual clauses together with any supplementary measures the transfer requires. A copy of the safeguards relied on for a given transfer is available on request.

10.1 This website sets no cookies and runs no analytics, tag manager or advertising pixel. There is nothing to consent to and nothing to opt out of, which is why you have not been shown a banner. The meeting form posts to our own servers; no third party sees it.

10.2 The Cycle product, behind sign-in, sets a session cookie that is strictly necessary to keep you signed in. It carries no tracking identifier and is not shared.

10.3 If we ever add analytics we will say so here first, and we will ask before setting anything that requires consent.

11.1 Use by children. The service is for organisations and is not directed at anyone under 18. We do not knowingly collect their personal information, and we delete it if we learn we have.

11.2 Third-party products. Pages we link to are governed by their own privacy policies, not this one. We are not responsible for their content or their practices, and a link is not an endorsement of either.

11.3 Changes to this policy. We may revise this policy. The date at the top changes with it, and a revision takes effect when it is posted. Where a change materially affects how we handle information we already hold, we will say so rather than rely on you noticing the date.