Privacy Policy

This Privacy Policy explains how KyroStat ("KyroStat", "we", "us") handles information when you use our website and web application at kyrostat.com (the "Service"). We are the data controller for the personal data described here. If you have questions, contact us at support@kyrostat.com.

Note: the legal entity operating KyroStat and its registered address are being finalised and will be named here. This policy should be reviewed by qualified counsel before you rely on it.

Information we collect

We collect the following categories of information:

• Account data. Your name, email address, and a hashed password when you create an account. If you sign in with Google, we receive your name, email, and Google account identifier.
• Data you upload. The spreadsheets and datasets you upload for analysis, and the results, plots, and reports generated from them. This may contain personal data if your dataset does; you are responsible for having a lawful basis to upload it.
• Usage and device data. With your consent, analytics tools record how you interact with the site (pages viewed, clicks, scrolling, approximate location, browser and device type). See Manage cookies.
• Support and communications. Messages you send us and our replies.

How we use your information

• To provide the Service: run analyses, generate results and reports, and store your projects.
• To authenticate you and keep your account secure.
• To operate billing and subscriptions (when paid plans are active).
• With consent, to measure and improve the Service using analytics.
• To respond to your requests and provide support.
• To comply with legal obligations and enforce our terms.

How AI processes your data

KyroStat uses a third-party AI provider, Anthropic (the Claude models), to recommend statistical tests and generate analysis code. We send the AI only column summaries and descriptive statistics (such as variable names, data types, and aggregate values), never your raw data rows. Generated code is then executed on our own servers in an isolated sandbox; the AI provider does not run your data. Anthropic processes these inputs to return a response and, under our arrangement, does not use them to train its models. See Security for how execution is isolated.

How we share information

We do not sell your personal data. We share it only with service providers that help us run KyroStat, under contracts that limit their use of it:

• AI provider: Anthropic, for test recommendations and code generation (summaries only, as above).
• Hosting and infrastructure: our cloud server provider, which hosts the application and stores data.
• Analytics: Microsoft Clarity and Google Analytics, only if you consent.
• Payments: our payment processor (for example Stripe or Paddle) when you subscribe to a paid plan. We do not store full card numbers.
• Legal: authorities where required by law, or to protect rights and safety.

International transfers

Our providers may process data in countries other than yours, including the United States. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses for transfers out of the EEA and UK.

Data retention

We keep your account data for as long as your account is active. You can delete individual projects and their datasets at any time from within the app, and you can request deletion of your account by contacting us. We may retain limited records where required for legal, security, or accounting purposes.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent.

• EEA and UK (GDPR / UK GDPR): our legal bases are performance of our contract with you (to provide the Service), your consent (for analytics), and our legitimate interests (to secure and improve the Service). You may lodge a complaint with your local data protection authority.
• California (CCPA / CPRA): you have the right to know, delete, and correct your personal information, and to opt out of "sharing" for cross-context behavioural advertising. We do not sell personal information. You will not be discriminated against for exercising these rights.

To exercise any right, email support@kyrostat.com. We will verify your request and respond within the time required by applicable law.

Cookies

We use strictly necessary cookies to run the Service (for example to keep you signed in) and, with your consent, analytics cookies. You can change your choice at any time on Manage cookies.

Children

KyroStat is intended for researchers and students aged 16 and over and is not directed at children. We do not knowingly collect personal data from children under 16.

Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date above and, for material changes, provide additional notice.

Contact

Questions or requests: support@kyrostat.com, or see our Contact page.