Privacy Policy

This Privacy Policy explains how KyroStat ("KyroStat", "we", "us") handles information when you use our website and web application at kyrostat.com (the "Service"). We are the data controller for the personal data described here. If you have questions, contact us at support@kyrostat.com.

Note: the legal entity operating KyroStat and its registered address are being finalised and will be named here. This policy should be reviewed by qualified counsel before you rely on it.

Information we collect

We collect the following categories of information:

• Account data. Your name, email address, and a hashed password when you create an account. If you sign in with Google, we receive your name, email, and Google account identifier.
• Data you upload. The spreadsheets and datasets you upload for analysis, and the results, plots, and reports generated from them. This may contain personal data if your dataset does; you are responsible for having a lawful basis to upload it.
• Site measurement. We record each page view on our own servers: the page, the site that referred you (as a bare domain), and your approximate location — country, region and city, derived from your IP address at that moment and then discarded. We do not store your IP address, set any cookie for this, or use any device fingerprint, and nothing recorded can recognise you on a later visit: views are grouped only by a random value your browser creates per tab and forgets when the tab closes. Records are deleted after 30 days. This is first-party audience measurement, not tracking, which is why it is not behind the cookie banner.
• Usage and device data. With your consent, third-party analytics tools record how you interact with the site (pages viewed, clicks, scrolling, approximate location, browser and device type). See Manage cookies.
• How you found us. When you create an account we record the site that referred you (as a bare domain, e.g. google.com), the first page of your visit (as a path, without any query string), and your approximate location — country, region and city. The location is derived from your IP address at that moment using a database held on our own servers; your IP address is not stored and is never sent to a third party. Search terms are never captured. We use this only to understand which channels and countries our users come from.
• Support and communications. Messages you send us and our replies.

How we use your information

• To provide the Service: run analyses, generate results and reports, and store your projects.
• To authenticate you and keep your account secure.
• To operate billing and subscriptions (when paid plans are active).
• With consent, to measure and improve the Service using analytics.
• To respond to your requests and provide support.
• To comply with legal obligations and enforce our terms.

How AI processes your data

KyroStat uses a third-party AI provider, Alibaba Cloud, through its Model Studio service (the Qwen models), to recommend statistical tests, write and fix analysis code, explain results, and answer questions in the Kyro assistant. Our requests go to Alibaba Cloud's Singapore region. Alibaba Cloud's documentation says request data for that region is stored in Singapore and that the models run on its servers outside mainland China. When Alibaba Cloud is unavailable, the same request goes to the same Qwen model through OpenRouter, a service that passes it to a company hosting the model; we set OpenRouter to use only hosts that do not store the prompts they receive or use them to train models.

No feature sends values from your dataset's rows: not your file, not individual values, and not the names of the categories in your columns. Anything you type yourself, such as your research question, instructions, and messages, is sent as you wrote it. What we send depends on the feature:

• Reading your data after upload: your project name and column names; for each column, its type and its counts of answers and missing values; for each column with up to 30 different answers, every answer and how many people gave it; and for number columns, the minimum, maximum, mean, median, and standard deviation. Columns that look like IDs or long free text are described without their values. We never send individual rows.
• Recommending tests and settings: your research question and description, any message you send while planning, and the description of your columns from the step above, including each answer and its count.
• Writing and fixing analysis code: column names, types, and missing-value counts; for each column we encode as categories, how many categories it has and the numbers we assigned to them (0, 1, 2, and so on), not the categories themselves; any instructions you add; and, when a run fails, the code and a reduced error message: the kind of error and where in the code it happened, with values from your data replaced by placeholders and nothing the code printed.
• Explaining a result: the test name and its summary numbers, such as the test statistic, p-value, and effect size.
• Asking Kyro on your dashboard: the words you type into “What are you working on today?”.
• Following a published paper: the text of the paper you upload, read on our server and not kept, and the names of your project's tables, tests and figures, so Kyro can say where each one goes.
• Kyro and message drafts: your question or message, your name and your teammates' names, your study's title, description, deadline, milestones, and tasks, and up to eight of your saved notes.
• Images and pasted text in Ask Kyro: an image you attach is stored with your project and, when Kyro reads it, sent to the AI provider's vision model (at most 1,600 pixels on its longest side) with your question. Images are sent to the AI to be read; don't upload pictures of your respondents' data. Text you paste into Ask Kyro is sent so Kyro can read and summarise it for that request, and is not kept.

We do not send your uploaded file or any individual row, and the AI provider does not run your code. If a column with up to 30 different answers holds identifying values, such as names, email addresses, or ID codes, those values are sent, so remove or replace such columns before uploading if that is not acceptable for your study. Writing and fixing analysis code needs none of your answers: category names stay on our servers and in your browser, and the code looks them up while it runs, so your charts and results still show them.

Under Alibaba Cloud's product terms, what we send and what the models return is our content, processed for our purposes and on our behalf, and Alibaba Cloud will not use it to develop or improve its models unless we separately consent. Alibaba Cloud states that it keeps prompts and responses for no longer than 30 days by default (longer where the law requires it or where needed to keep its service secure), and keeps content its automated safety filters flag for up to 2 years.

Where your analyses run

Your uploaded file and the processed dataset are stored on our servers (see Data retention below). When you run an analysis, the code runs in your browser where it can, and your browser downloads the dataset from our servers to do so. If it cannot run there quickly, for example because the in-browser engine has not loaded within a few seconds, your connection is slow, or the dataset is too large, it runs on our servers in an isolated sandbox instead. Either way, the result is sent to our servers to be formatted and saved. See Security for how server execution is isolated.

How we share information

We do not sell your personal data. We share it only with service providers that help us run KyroStat, under contracts that limit their use of it:

• AI providers: Alibaba Cloud (Model Studio, Qwen models), and OpenRouter with the hosts it passes our requests to when Alibaba Cloud is unavailable, for reading your data after upload, test recommendations, code generation, result explanations, and the Kyro assistant, with the data listed above.
• Hosting and infrastructure: our cloud server provider, which hosts the application and stores data.
• Analytics: Microsoft Clarity and Google Analytics, only if you consent.
• IP geolocation: performed locally, with no third party involved, using the IP Geolocation by DB-IP database (db-ip.com), licensed under CC BY 4.0.
• Payments: our payment processor (for example Stripe or Paddle) when you subscribe to a paid plan. We do not store full card numbers.
• Legal: authorities where required by law, or to protect rights and safety.

YouTube API Services

KyroStat uses YouTube API Services to publish our own educational videos to the KyroStat YouTube channel and to read that channel's public statistics, such as view counts. By watching or interacting with KyroStat content on YouTube you are also bound by the YouTube Terms of Service, and Google's handling of your information is described in the Google Privacy Policy.

Through the YouTube API Services we access only the KyroStat channel's own uploads and their public statistics. We do not access, collect, store, or share data about any other YouTube user or channel, and no KyroStat user is asked to connect a YouTube account. The statistics we read are kept only to show us how our own videos perform and are refreshed or deleted within 30 days. The channel owner can revoke KyroStat's access at any time from Google security settings. Questions about this use can be sent to the contact address below.

International transfers

Our providers may process data in countries other than yours. Our AI provider, Alibaba Cloud, receives requests in Singapore and may process them in other countries, as may OpenRouter and the model hosts it uses when Alibaba Cloud is unavailable (see How AI processes your data); analytics providers may process data in the United States. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses for transfers out of the EEA and UK.

Data retention

We keep your account data for as long as your account is active. You can delete individual projects and their datasets at any time from within the app, and you can request deletion of your account by contacting us. We may retain limited records where required for legal, security, or accounting purposes.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent.

• EEA and UK (GDPR / UK GDPR): our legal bases are performance of our contract with you (to provide the Service), your consent (for analytics), and our legitimate interests (to secure and improve the Service). You may lodge a complaint with your local data protection authority.
• California (CCPA / CPRA): you have the right to know, delete, and correct your personal information, and to opt out of "sharing" for cross-context behavioural advertising. We do not sell personal information. You will not be discriminated against for exercising these rights.

To exercise any right, email support@kyrostat.com. We will verify your request and respond within the time required by applicable law.

Cookies

We use strictly necessary cookies to run the Service (for example to keep you signed in) and, with your consent, analytics cookies. You can change your choice at any time on Manage cookies.

Children

KyroStat is intended for researchers and students aged 16 and over and is not directed at children. We do not knowingly collect personal data from children under 16.

Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date above and, for material changes, provide additional notice.

Contact

Questions or requests: support@kyrostat.com, or see our Contact page.