Privacy policy

Effective 7 October 2026

The short version

We collect what it takes to run your account and the dashboards you build. We don't sell it, share it for advertising, or use it to train AI models.
Klyrova only ever reads your databases, and only when you or a dashboard you set up asks it to. Passwords, keys and tokens are encrypted and never sent back to your browser.
When you chat with the agent, your messages, the query results it works with, and any files or images you attach or ask it to read from a bucket go to an AI provider: the one you picked on your own API key, or, when you chat on Klyrova credit, OpenAI, Anthropic or Google through Klyrova's account with them.
If you buy credit, Stripe takes the payment on its own page and keeps a customer record for you. We never see your card details.
You can ask us to show you, correct or delete your data at any time: support@klyrova.app.

Who we are

Klyrova (klyrova.app) is operated by Rohith Muddaraboina in the United Kingdom ("Klyrova", "we", "us"). We are the controller of the personal data described here. For anything about your data, write to support@klyrova.app.

What we collect

When you create an account or request access

Your name and email address; we email that address a confirmation link, which proves it is yours before the account opens. If you use the request form instead, anything else you choose to tell us there: company, role, what you'd connect and what you'd use Klyrova for. We use it to answer you and to set up your account.

Your account

Name, email address and a salted hash of your password (never the password itself).
If you sign in with Google: your Google account identifier, name and verified email address.
Your plan, when you joined, and when you were last active.
Where you came from when you created the account, if the link you arrived on says so: its campaign tags (such as utm_source=reddit), the ad network an ad's click identifier names, or the name of the website that linked to us. Nothing about which pages you looked at.
If you asked for access: the note an administrator made when deciding on your request, and a log of administrative actions on your account (approval, plan changes, suspension) with the reason given.

What you connect

Databases: the host, database name and username you enter, and the password, encrypted with a key held in Azure Key Vault.
Microsoft Fabric (if you use "Connect Microsoft"): your Microsoft account's name, email, tenant and object identifiers, and a refresh token, encrypted, that lets Klyrova read the items you picked on your behalf.
Files you upload to a bucket: the files themselves, the tables built from spreadsheets, and text extracted from documents.
AI provider keys (OpenAI, Anthropic, Google Gemini), encrypted.

The databases and files you connect may hold personal data about other people: your customers, your staff. For that data you are the controller and Klyrova is your processor: we handle it only on your instructions, by running the read-only queries the agent writes for you, keeping each widget's latest results (encrypted) so your dashboard opens, and sending the results the agent needs to the AI provider you chose. You're responsible for having the right to use it this way, and this policy stands as our processing terms for it: we process it only for those purposes, keep it as described below, delete it when you do, and tell you without undue delay if we learn of a breach affecting it.

Klyrova credit and payments

A record of your credit: the starter credit, each top-up, any adjustment we make, and each chat charged to it (when, which model, how many tokens, and what it cost).
If you top up, Stripe processes the payment on its own page. We pass Stripe your email address and account identifier so the payment can be matched to you; Stripe collects your billing address, your country and a VAT number if you give one, and keeps a customer record under its own privacy policy. We receive the amount, the country, any VAT number and Stripe's reference for the payment. Your card details go to Stripe only; we never see or store them.

What you create

Dashboards and widgets, including the query each widget replays and a copy of its latest results (encrypted) so a dashboard opens without re-running every query.
Chat messages, the agent's replies, the tool calls it made, and the text of files you attach to a message.
Who you share dashboards with, and a history of changes to dashboards you can access (who changed what, and when). Everyone who can open a dashboard sees that history with the names of the people who made the changes; the entries that record who was invited are shown to the owner and editors only.

When you email us

Your address, your message and our reply. Mail sent to support@klyrova.app or hello@klyrova.app is forwarded to, and answered from, a Gmail inbox.

Technical data

Server logs and error reports (the request made, when, how long it took, and what went wrong), used to keep Klyrova running and secure. Your browser keeps your sign-in token and whether you've hidden the setup guide in local storage, and a one-time sign-in nonce in session storage. The campaign tags above are read from the address you arrive on and held only by the open page until you create an account; nothing is stored on your device for them. A short-lived cookie (about 10 minutes) protects the Google and Microsoft sign-in flows. We don't use advertising or analytics cookies or third-party trackers.

How your database and file data is used

Klyrova runs read-only queries (a single SELECT, checked before it runs) against the sources you connect, when you ask the agent a question, open or refresh a dashboard, or when a dashboard you scheduled refreshes itself. Results are shown to you and to the people you share a dashboard with, and the latest results of each widget are stored, encrypted, as described above.

During a chat, the agent sends your messages, your database's schema and the query results it needs to an AI provider:

On your own API key: the provider you chose processes them under its own terms and privacy policy, and you are its customer for that traffic.
On Klyrova credit: OpenAI, Anthropic or Google (Gemini) — whichever model you picked — processes them for us, through Klyrova's account, under their API terms. None of them uses this traffic to train its models; each may keep it for a limited time to detect abuse. On a dashboard shared with you as an editor, your chats run on your own key or your own credit, never the owner's.

Replaying a widget on refresh runs the stored query only; no AI model is involved.

Why we use it (legal bases)

To provide Klyrova to you (contract): your account, sources, dashboards, chats, sharing, Klyrova credit and its payments, and the emails the service sends: email confirmations, invitations, password resets and share notices.
To keep Klyrova secure and working (legitimate interests): rate limits, fraud and abuse prevention, logs and error reports, plan limits.
To review access requests (legitimate interests, and steps you ask us to take before an account exists).
To see which of our announcements and adverts bring people to Klyrova (legitimate interests): where you came from when you signed up. No advertising network receives anything about you from us.
To meet legal obligations, such as keeping payment records for tax.

We don't use your data for advertising, sell it, or use your data or chats to train AI models.

Who processes it for us

Service	What for	Where
Microsoft Azure	Hosting the app and API, the database, file storage, key storage, logs, and sending email	United States (West US 2)
Google	"Continue with Google" sign-in, only if you use it; and Gmail, where we read and answer mail sent to `support@` and `hello@klyrova.app`	Google's infrastructure
Microsoft Entra ID	"Connect Microsoft" for Fabric sources, only if you use it	Microsoft's infrastructure
Forward Email	Delivering mail sent to `@klyrova.app` addresses to our inbox	Forward Email's infrastructure
Stripe	Taking payment when you buy Klyrova credits or a paid plan, and holding the plan's subscription, only if you do	Stripe's infrastructure
OpenAI, Anthropic and Google (Gemini)	Your chats with the agent when you chat on Klyrova credit	Their infrastructure
Your AI provider	Your chats with the agent on your own key: OpenAI, Anthropic or Google, whichever you choose	That provider's infrastructure

Your data is stored in the United States. Where it moves out of the UK or EEA, we rely on our providers' transfer safeguards: the UK International Data Transfer Addendum and the EU Standard Contractual Clauses that Microsoft, Google, OpenAI, Anthropic and Stripe each include in their data processing terms, which we have accepted as their customer.

How we protect it

Connections are encrypted in transit (HTTPS only; .app addresses can't be reached any other way).
Database passwords, provider keys, Microsoft tokens and stored widget results are encrypted with keys protected by Azure Key Vault, bound to your account, and never returned by any part of the API.
Every query is checked to be read-only before it runs. We still recommend connecting with a database login that can only read.
Access to production systems is limited to the people who operate Klyrova.

How long we keep it

Your account data, sources, dashboards and chats: for as long as you have an account. Deleting a source, dashboard, bucket or file removes it straight away.
Access requests: once you have an account the request is marked as used and kept with it; if we decline, it is kept so that a repeat request is recognised. Ask and we'll delete yours.
Emails you send us: as long as we need them to help you and keep a record of what was agreed.
Payment records and the credit history behind them: six years, as UK tax law requires, even after you close your account.
Logs and error reports: 30 days.
Database backups: 7 days. After you delete something, it can remain in backups for up to that long before it is gone for good.

To delete your account and everything in it, email support@klyrova.app from the address you signed up with.

Your rights

Under UK and EU data protection law you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or hand it over in a portable format. Email support@klyrova.app; we'll reply within one month. If you're unhappy with how we've handled your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

Children

Klyrova is a work tool and isn't meant for anyone under 16. We don't knowingly accept requests or accounts from them.

Changes to this policy

If we change this policy we'll update the date at the top, and for anything significant we'll email account holders before it takes effect.