Privacy policy.

The data controller is Content & Emotion S.L. (hereinafter “cyrqle”, “we”, “us”), a Spanish limited company with registered office in Madrid, Spain. For privacy questions, contact privacy@cyrqle.app.

Our Data Protection Officer (DPO) can be reached at the same address. Where required, we maintain a Data Processing Agreement (DPA) with brand and agency customers and with technical sub-processors.

We collect the following categories of personal data:

• Account data — name, email, role (Brand / Creator / Agency), authentication identifiers from Google, Instagram, LinkedIn, or TikTok when you sign in.
• Profile data — handles, links, audience demographics, content metadata, performance signals associated with creator profiles.
• Campaign data — briefs, drafts, approvals, deliverables, attribution events, payouts.
• Payment data — handled by Stripe Connect; we receive limited metadata (last 4 digits, country, status) but never full card numbers.
• Usage data — pages visited, device, browser, IP, referer, session duration. Collected via first-party analytics; no third-party cookies.

We rely on the following GDPR lawful bases:

• Contract — to provide the cyrqle platform you signed up for.
• Legitimate interests — to operate, secure, improve and market cyrqle, balanced against your fundamental rights.
• Consent — for non-essential cookies and direct marketing.
• Legal obligation — accounting, tax, fraud prevention.

We share data only with:

• Sub-processors — Stripe (payments), Vercel (hosting), Cloudflare R2 EU (object storage), PlanetScale (database), Sentry (errors), OpenRouter / Anthropic / OpenAI (AI inference). Each is bound by a DPA.
• Brands & agencies — when a creator applies to or is matched with a campaign, the brand/agency sees the relevant profile data.
• Legal authorities — when required by law.

We never sell personal data. We never use it to train third-party models.

Cyrqle is built EU-first. Our primary data residency is in the EU (Cloudflare R2 EU, EU PlanetScale region). Where transfers leave the EEA — for example to AI inference providers — we rely on EU Standard Contractual Clauses (SCCs) and supplementary measures including encryption in transit and at rest.

We retain personal data only as long as necessary:

• Account data — for the life of your account, plus 6 months after deletion.
• Campaign records — 6 years (required for tax/accounting in Spain).
• Marketing list — until you unsubscribe.
• Server logs — 90 days.

Under GDPR you can request:

• Access to your data and a copy in portable form.
• Rectification of inaccurate data.
• Erasure (“right to be forgotten”) where applicable.
• Restriction of processing or objection to it.
• Withdrawal of consent at any time.
• Lodging a complaint with the Spanish data protection authority (AEPD).

Reach us at privacy@cyrqle.app — we respond within 30 days.

cyrqle.app uses only first-party cookies for authentication, language preference, and aggregate analytics. We do not use third-party advertising cookies. You can disable cookies in your browser without breaking the site.

When we materially change this policy, we’ll post the update on this page and, if the change affects you, notify you by email at least 14 days before it takes effect.