Privacy Policy

Last updated: July 3, 2026

This Privacy Policy describes how Cifral Solutions LLC ("we", "us", or "our"), operating as Cifral at cifral.io, collects, uses, protects, and shares your personal information.

For most of the processing described in this policy, Cifral Solutions LLC acts as the data controller. Section 13 below describes a specific service where Cifral instead acts as a data processor on behalf of real estate agency partners — the roles are different and are explained where relevant.

1. Information We Collect

1.1 Information You Provide

We collect personal information that you voluntarily provide when you:

• Contact us: Name, email address, company name, role/title, message content
• Join our waitlist: Name, email address, company name
• Use our services: Business information, project requirements, technical specifications
• Create an account or use our chat widget: Email, name, session/message content
• Purchase a service: Billing details processed by our payment processor (Stripe) — see Section 6

We generally do not seek to collect special categories of data (e.g., health, biometric, or religious data). If you choose to include such information in a message to us, we will only use it to respond to your inquiry and will not use it for any other purpose.

1.2 Information We Collect Automatically

When you visit our website, we automatically collect:

• Technical data: IP address, browser type, device information, operating system
• Usage data: Pages visited, time spent, referral source, click patterns
• Cookies: See our Cookie Policy for details

2. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds under the EU/UK General Data Protection Regulation:

• Consent (Art. 6(1)(a)): When you submit forms, subscribe to communications, or accept non-essential cookies. You may withdraw consent at any time without affecting processing already carried out.
• Contract performance (Art. 6(1)(b)): To provide services you've engaged us for, including processing your purchase and delivering the automation package.
• Legitimate interests (Art. 6(1)(f)): Website security, fraud prevention, direct-marketing to existing business contacts, and improving our services — balanced against your rights and interests.
• Legal obligations (Art. 6(1)(c)): Tax, accounting, and other statutory record-keeping requirements.

Where Cifral processes personal data as a processor on behalf of a customer or partner (see Section 13), the legal basis for that processing is determined by the customer/partner as controller, not by Cifral.

3. How We Use Your Information

We use your personal information for the following purposes:

• Service delivery: Provide sales/process automation services, customer support, project management
• Communication: Respond to inquiries, send updates about our services, send transactional emails, operate our website chat widget
• Payment processing: Process purchases and manage billing through Stripe
• Product development: Improve our services, develop new features, understand user needs
• Marketing: Send promotional materials (only with your consent or as a legitimate interest to existing business contacts; you can opt out anytime)
• Legal compliance: Meet tax, accounting, and legal requirements
• Security: Protect against fraud, abuse, and security threats

4. Automated Decision-Making and Profiling

Our website chat widget and certain workflow automations use AI language models to draft responses and support internal triage. These tools assist our team; they do not make decisions that produce legal effects or similarly significant effects concerning you without human involvement, and you may always request to speak with a human by contacting info@cifral.io.

As described in Section 13, one specific service we provide to real estate agency partners uses AI to generate an informational fit assessment about rental/purchase applicants. Cifral does not make the underlying decision (e.g., whether to approve, reject, or shortlist an applicant) — that decision is made by the partner agency, which reviews the assessment and applies its own judgment. If you believe a decision about you was based solely on automated processing without meaningful human review, you may exercise your rights under Section 8 and, where Cifral acted as a processor, we will route your request to the relevant controller.

5. Data Retention

We retain your personal data only as long as necessary for the purposes set out in this policy:

• Contact form submissions: 2 years from submission
• Waitlist signups: Until product launch or 2 years, whichever comes first
• Chat widget conversations: 1 year from the last message
• Service contracts and billing records: Duration of contract + 7 years for legal/tax purposes
• Marketing data: Until you unsubscribe or withdraw consent
• Website analytics: 26 months maximum
• Real estate applicant data processed on behalf of partners: See Section 13

When a retention period expires, we securely delete or anonymize the data unless a longer period is required by law.

6. Data Sharing and Recipients

We do not sell your personal information. We do not sell or share your personal information for cross-context behavioral advertising. We share personal data only with the following categories of recipients, each bound by a data processing agreement or equivalent contractual safeguards:

• Stripe — payment processing for service purchases
• Resend — transactional email delivery (contact form notifications)
• Notion — internal CRM/database storage of contact and lead information
• n8n (self-hosted) — workflow automation infrastructure we operate ourselves to route chat, contact, and service data
• Vercel — website hosting infrastructure
• Cal.com — scheduling for booking calls
• Professional advisors: Lawyers, accountants, auditors, under confidentiality obligations
• Legal authorities: When required by law, court order, or to protect our rights, users, or the public
• Successors: In connection with a merger, acquisition, or asset sale, subject to equivalent protections

Additional sub-processors used specifically for the real estate lead-screening service (Anthropic and Google Workspace) are described in Section 13.

7. International Data Transfers

Cifral Solutions LLC is based in the United States. Your personal data may be transferred to, stored, and processed in the United States and other countries outside your country of residence, including outside the European Economic Area (EEA) and United Kingdom.

Where we transfer personal data of individuals in the EEA/UK to the United States or another country not subject to an adequacy decision, we rely on appropriate safeguards recognized under GDPR, in particular the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the UK International Data Transfer Addendum, together with supplementary technical and organizational measures. You may request a copy of the relevant safeguards by contacting info@cifral.io.

8. Your Rights (GDPR & Other Privacy Laws)

Depending on your location, you have rights regarding your personal data under GDPR and similar laws, including the right to:

• Access — obtain confirmation of and a copy of the personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data ("right to be forgotten"), subject to legal exceptions
• Restriction — limit how we use your data in certain circumstances
• Data portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests or direct marketing
• Withdraw consent — at any time, where processing is based on consent
• Lodge a complaint — with your local data protection supervisory authority (in the EU/EEA, the authority of your country of habitual residence, place of work, or place of the alleged infringement)

To exercise your rights, email us at info@cifral.io. We will respond within 30 days (or as required by applicable law). We may need to verify your identity before fulfilling a request. If you applied through a real estate agency partner using our lead-screening service, please see Section 13 for how to exercise your rights in that specific context.

9. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), gives you additional rights over the personal information we collect about you:

• Right to know what personal information we collect, use, disclose, and the categories of sources and recipients
• Right to delete personal information we have collected from you, subject to certain exceptions
• Right to correct inaccurate personal information
• Right to opt out of the "sale" or "sharing" of personal information — Cifral does not sell or share personal information as those terms are defined under CCPA/CPRA, so there is no sale/share to opt out of
• Right to limit use of sensitive personal information — we do not use sensitive personal information for purposes requiring this right beyond what is necessary to provide our services
• Right to non-discrimination for exercising any of these rights

You may exercise these rights by emailing info@cifral.io or having an authorized agent submit a request on your behalf. We will verify your request using the information reasonably available to us and respond within the time required by law.

10. Cookies and Tracking Technologies

We use cookies and similar technologies to improve your experience on our website. For detailed information, please see our Cookie Policy.

11. Data Security

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction, including encryption in transit, access controls on a least-privilege basis, and regular review of our vendors' security practices. No method of transmission or storage is completely secure; if we become aware of a data breach affecting your personal data, we will notify affected individuals and relevant authorities as required by applicable law.

12. Children's Privacy

Our services are not directed to individuals under 16 years of age (or under 13 in the United States). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Automated Lead-Screening Service for Real Estate Partners

Cifral provides an automated lead-screening service to real estate agency partners. Under this service, Cifral processes personal data of rental/purchase applicants (such as name, contact details, income information, and household composition) that our partner agencies forward to us, on their behalf and per their instructions.

In this context, the real estate agency is the data controller, and Cifral acts as data processor under a signed Data Processing Agreement (DPA) executed with each partner before the service begins. Cifral processes this data only on the documented instructions of the partner agency and does not use it for its own purposes (such as marketing) or combine it with data from other partners. The DPA sets out the authorized sub-processors, retention period, security commitments, and international transfer safeguards for that specific partner, and gives the partner the right to object to any change in sub-processors before it takes effect; a copy is available to the partner agency on request.

Applicant data is processed using AI models provided by Anthropic (Claude API) to generate an informational fit assessment, and is stored temporarily using Google Workspace (Gmail, Sheets) and our self-hosted n8n workflow automation infrastructure (hosted on DigitalOcean). Anthropic and Google act as sub-processors engaged by Cifral for this purpose, under their own data processing terms; applicant data is not used to train third-party AI models. Where Cifral or a sub-processor handles data outside the European Economic Area — including Cifral itself, a United States company — that transfer is covered by the Standard Contractual Clauses or another valid transfer mechanism identified in the applicable DPA.

Applicant data related to this service is retained for 30 days after processing and then deleted, unless the partner agency requests a different retention period in writing or instructs earlier deletion.

As explained in Section 4, the fit assessment generated by this service is informational and advisory. The decision to approve, reject, or otherwise act on an application is made by the partner agency, not by Cifral or by the AI model.

If you are an applicant whose data was processed through this service, please contact the real estate agency you applied to directly to exercise your rights (access, correction, deletion, etc.), as they are the data controller for this processing. If you are unable to reach the controller, you may contact Cifral at info@cifral.io and we will forward your request to the relevant partner agency.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated date, and where required by law we will provide additional notice.

15. Contact Us