Privacy Policy

Account information

When you register, we collect:

• Name, email address, password, company name (if applicable)
• Billing information and payment details
• Information regarding your association with specific projects or teams

Usage information

• Features accessed, AI Agent configurations, performance metrics
• API calls, IP addresses, browser type, operating system, log data
• Team member activities and project interactions

Communication information

Content of communications when you contact us for support via privacy@calypso.day or other channels.

End-User Data (processed on behalf of Users)

When an End-User interacts with an AI Agent or workflow built on our Platform by a User, we receive and process:

• Messages and interactions exchanged through AI Agents
• Conversation content, sender/recipient identifiers, and timestamps
• Workflow execution data and results
• Integration data from connected third-party services

Important: We store this data on our systems to enable AI Agent functionality and provide conversation history access to authorized Users within a project/team.

Third-party information

We may receive information from third-party services when you connect them to our Service:

• Social media profile information (Facebook, Instagram, etc.)
• Authentication data from identity providers
• Integration data from connected applications and APIs
• Webhook data from external services

User as Controller (End-User Data)

For messages and interactions exchanged through AI Agents built by Users on our Platform, the User (or organization/team the User represents) is the Data Controller.

• User determines purposes and means of processing
• User responsible for legal basis (e.g., consent)
• User must provide privacy notices to End-Users

Calypso as Processor (End-User Data)

We act as a Data Processor on behalf of the User for End-User interactions and data.

• Process data based on User's instructions
• Enable AI Agent operation and store conversation history
• Provide data access to authorized team members
• Processing limited to Platform functionality

Within User teams/projects

Information associated with a specific project, including stored messages and data related to AI Agents within that project, is accessible to all authorized User members belonging to that project or team on the Platform, as managed by the project/account administrators.

Authorized external sharing

• Service Providers: Third-party vendors who perform services on our behalf (hosting providers, payment processors, analytics providers, customer support tools)
• Legal Requirements: When required by law, subpoena, court order, or government request
• Business Transfers: In connection with mergers, acquisitions, financing, or asset sales
• Protection: To protect our rights, privacy, safety, or property, or that of users and the public
• Aggregated Data: Anonymized information that does not directly identify individuals

Data storage location

Your information, including User Data and stored End-User interactions, is primarily processed and stored on infrastructure provided by industry-leading cloud providers, which may involve servers located in various regions, including the United States and Europe.

• Hosting: AWS, Google Cloud, Vercel
• Databases: PostgreSQL, MongoDB
• Regions: US, EU, Asia-Pacific

Security measures

We implement appropriate technical and organizational security measures designed to protect the information we process against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

Technical measures

• Encryption of data in transit (HTTPS/TLS)
• Encryption of database data at rest
• Authentication mechanisms for User access control
• Regular software updates and security patching
• Logical separation of data where applicable
• API rate limiting and DDoS protection

Organizational measures

• Employee training and awareness programs
• Robust physical and network security (via hosting partners)
• Access controls and monitoring systems
• Incident response procedures
• Regular security audits and assessments
• Data processing agreements with vendors

Important: No security system is impenetrable, and we cannot guarantee the absolute security of data transmitted to or stored on the Platform.

Data retention policies

• End-User interactions and User project data: We store End-User interactions processed through the Platform and associated User project data indefinitely for as long as the User's account is active, to provide ongoing service and historical context.
• Account termination: If a User terminates their account, we will initiate deletion of their associated User Data and stored End-User interactions linked to their account and projects. Data will be permanently deleted within 30-90 days, unless legally required to retain information longer.

Specific retention periods

• Account information: Duration of account + 30 days
• AI Agent configurations: Duration of account
• End-User interactions: Duration of account
• Usage analytics: 2 years from collection
• Support communications: 3 years
• Financial records: 7 years (legal requirement)
• Security logs: 1 year
• API access logs: 90 days

Access and control

• Access your personal information
• Correct inaccurate data
• Update your preferences
• Request data portability (structured format)

Deletion and restriction

• Delete your personal information
• Restrict processing activities
• Object to processing based on legitimate interests
• Withdraw consent

End-User data rights

For End-Users: If you are an End-User who has interacted with an AI Agent or workflow, and wish to exercise your data subject rights concerning those interactions, please direct your requests to the User (or organization/team) who built and operates that AI Agent, as they are the Data Controller for that data.

We will reasonably assist Users in responding to such requests as required by law and our contractual agreements.

Common third-party integrations

• Social media platforms (Facebook, Instagram, Twitter, WhatsApp)
• Analytics services (Google Analytics, Mixpanel)
• Payment processors (Stripe, PayPal)
• Cloud service providers (AWS, Google Cloud, Vercel)
• Customer support tools (Intercom, Zendesk)
• AI and ML services (OpenAI, Anthropic, Google AI)
• Communication APIs (Twilio, SendGrid)

Safeguards we use

• Standard Contractual Clauses (SCCs) where applicable
• EU-U.S. Data Privacy Framework compliance where required
• Adequacy decisions from relevant authorities
• Binding corporate rules and data processing agreements

• All data obtained from social media platforms will be handled according to their requirements
• Any stored access tokens will be managed securely and invalidated when requested
• Integration with social media services will be terminated upon account deletion
• Cached social media content will be removed according to our retention policies
• End-User interactions via social platforms will be processed according to controller/processor agreements