Privacy Policy

1. Who We Are

Kyrospect ("Kyrospect", "we", "us", or "our") is a workplace productivity service operated by Brishiv Tech Lab LLP, a company registered in India with its registered office at C-505, Titanium Business Park, Ahmedabad, Gujarat, India - 380051. It is accessible at kyrospect.com and via our desktop agent software. Kyrospect is currently offered on a limited beta basis, so its functionality, defaults, and capture features may change as the product evolves.

For the purposes of applicable data protection law (including the GDPR and the Information Technology Act 2000 and the Digital Personal Data Protection Act 2023):

• Kyrospect is the data controller for the account, billing, and product-usage data it collects directly.
• The employer (Customer) is the data controller for employee activity data, and Kyrospect acts as a processorof that activity data on the employer's documented instructions.

Kyrospect is a neutral technology tool.The Customer (employer) alone determines whether to deploy Kyrospect, which capture features to enable, how intensively to monitor, and how long to retain data, subject to its plan. Kyrospect does not decide, recommend, or control any Customer's monitoring practices, and is not responsible for a Customer's monitoring decisions or for its compliance with applicable notice, consent, and employment laws. The Customer is solely responsible for ensuring its use of Kyrospect is lawful in each applicable jurisdiction.

2. Data We Collect

2.1 Account and Business Data

• Workspace owner: Name, business email, company name, billing details.
• Manager accounts: Name, work email, role within the workspace.
• Payment information: Processed by our PCI-DSS-compliant payment processor. We do not store raw card numbers.
• Communications: Emails and support tickets you send to us.

2.2 Employee Activity Data (Processed as Processor)

When an employer deploys the Kyrospect desktop agent, the agent may capture the following — subject to workspace administrator policies:

• Active application names and window titles
• Website domains visited during tracked sessions
• Keyboard activity (aggregate counts — not verbatim keystrokes)
• Mouse activity metrics (movement and click aggregates)
• Screenshots at configurable intervals, with optional privacy blur applied on-device
• Session start/end timestamps and idle periods

What is captured, and how often, is chosen and configured by the employer, subject to its plan — Kyrospect provides the controls, and the employer decides which features to enable.

Privacy blur: When enabled, privacy blur reduces the legibility of screen content before a capture is stored. It applies uniformly to the full image; it does not detect or selectively redact fields.

2.3 Technical and Usage Data

• IP addresses, browser type, operating system (web dashboard only)
• Feature usage patterns and interaction events (for product improvement)
• Error logs and crash reports (anonymised before processing)

2.4 Data We Do Not Collect

The Service is designed not to collect the following, except to the extent a workspace administrator enables a feature that changes this:

• Verbatim keystrokes or typed content
• Personal communications content (emails, messages)
• Data from applications outside the monitored session window
• Biometric data of any kind
• Data from employee devices outside active tracking sessions

3. Legal Basis for Processing

• Contract performance: Processing necessary to deliver the subscribed services.
• Legitimate interests: Product improvement, fraud prevention, and platform security.
• Legal obligation: Compliance with applicable laws, regulatory requests, or court orders.
• Consent: Where relied upon (e.g. marketing), you may withdraw at any time.

For employee activity data, the employer is the data controller and is responsible for its own legal basis and employee notification. Kyrospect acts as processor under a Data Processing Agreement available upon request.

4. How We Store and Protect Your Data

4.1 Security Safeguards

• Storage: Workspace data is protected with layered safeguards and access controls.
• Transmission: Connections use secure transport protections appropriate for business software.
• Capture: Privacy controls can reduce sensitive screen exposure before screenshots become review records.

4.2 Workspace Isolation

Each customer workspace is logically separated. Kyrospect staff access is restricted in normal operations. Support access requires explicit customer authorisation and is logged in full.

4.3 Infrastructure

We use industry-standard infrastructure with physical security controls, redundant storage, and regular security review. Deeper infrastructure details are available to qualified customers during procurement.

5. Data Retention

Current enforced windows during beta are up to 12 months for activity, URL, and location data, and up to 90 days for screenshots. Workspace-specific shorter retention is not available today.

• Account data: Retained for the subscription term plus a reasonable period.
• Billing records: Retained as required by law.
• Backups: Backup copies follow the applicable backup-retention schedule and are not restored into active use after an approved deletion, unless retention is required by law.

6. Data Sharing and Disclosure

We do not sell personal data. We do not share data for advertising purposes. Limited sharing occurs with:

• Service providers: Infrastructure, payments, and analytics vendors operating under data processing agreements. Sub-processor list available on request.
• Legal authorities: Where required by valid legal process. We notify affected customers where legally permitted.
• Business transfers: In a merger or acquisition, subject to the acquirer maintaining equivalent data protections.

7. Your Rights

If you are an employee or other monitored user, your employer is the data controller for your activity data. Please direct any request to access, correct, delete, export, restrict, or object to the processing of that data to your employer, who controls the purpose and enabled collection categories. Kyrospect applies the fixed retention windows stated above and processes this data only on the employer's documented instructions and will provide reasonable assistance to the employer in responding to such requests. Where Kyrospect receives a request directly from a monitored user, it will refer the request to the relevant employer and will not act on it except as required by law. For account data that Kyrospect controls directly, you may contact Kyrospect and we will respond within a reasonable time.

Depending on your jurisdiction, the rights available include:

• Access: Obtain a copy of your personal data.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Request deletion of personal data.
• Restriction: Limit how the data is processed.
• Portability: Receive the data in a structured format.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: At any time, where processing is consent-based.

For activity data, these rights are exercised through your employer as the controller. Where enabled by their employer, employees can also view their own activity data through the dashboard — transparency is built into the product, not just this policy.

8. Data Residency and International Transfers

Customer data is hosted with leading cloud infrastructure providers. Data for customers in India is hosted in an India (Mumbai) region. As Kyrospect expands, data for customers in the United States and United Kingdom will be hosted in their respective regions. Where data is accessed or transferred across borders (for example, operational or support access from India), Kyrospect relies on appropriate safeguards, including Standard Contractual Clauses where applicable.

9. Cookies

• Strictly necessary: Authentication sessions and security tokens. Cannot be disabled.
• Analytics:Google Analytics 4 with IP anonymisation, and only with your consent. On your first visit we ask; until you choose “Accept” no analytics script is fetched and no analytics cookie is set, so declining or ignoring the prompt leaves this site untracked. Your choice is stored in your browser's local storage, never in a cookie, and you can change it at any time via “Cookie settings” in the footer.

The desktop agent does not use cookies.

10. Children's Privacy

Kyrospect is intended for adults in professional environments. We do not knowingly collect data from individuals under 16. If you believe a minor's data has been processed, contact privacy@kyrospect.com immediately.

11. Policy Changes

We will notify workspace administrators by email at least 30 days before material changes take effect. The current version is always at kyrospect.com/privacy.

12. Contact and Grievance Redressal

For any question about this Policy, to exercise your rights, or to raise a grievance about how your personal data has been handled, write to our Grievance Officer:

We acknowledge grievances within seven (7) days of receipt and aim to resolve them within thirty (30) days, in line with the Information Technology Act 2000 and the Digital Personal Data Protection Act 2023.

EU/EEA residents may also lodge a complaint with their local Data Protection Authority. Data Principals in India may escalate an unresolved grievance to the Data Protection Board of India.