Privacy Policy

"Personal Data" means any information relating to an identified or identifiable natural person, including under the GDPR, UK GDPR, and India's DPDP Act.

"Processing" means any operation performed on Personal Data, such as collection, storage, use, disclosure, or deletion.

"Data Subject" or "Principal" means the individual to whom Personal Data relates — for example, you as our customer's authorized user, or a prospect/lead your organization uploads to Stynar.

"Sub-processor" means a third party engaged by us to process Personal Data on your behalf, as listed in Section 6.

Account & billing data: your name, email address, hashed password, organization details, tax identifiers, subscription plan, and payment records. We do not store full card numbers — payments are handled by our payment processor.

Connected mailbox data: when you connect Gmail or Outlook via OAuth, or a mailbox via SMTP/IMAP, we store the access/refresh tokens or credentials needed to send on your behalf and to sync replies. Credentials and tokens are encrypted at rest.

Leads & campaign content: prospect records you import (name, email, company, role, and custom fields), the email sequences and templates you create, and the AI prompts and generated copy associated with your campaigns.

Replies & inbox data: messages your prospects send in reply, which we sync into your unified inbox, classify, and analyze for meeting intent so the platform can help you book meetings.

Deliverability & usage data: sending logs, bounce and complaint signals, open/click tracking events, plus standard diagnostic data such as IP address, browser, device identifiers, and audit logs used to secure and operate your workspace.

Consent & preference data: when you create an account, we record your explicit acceptance of the Terms of Use and Privacy Policy, including a timestamp of acceptance. We also store your Cookie Preferences (including any choices made through our Cookie Preferences system) and, where provided, your consent to receive marketing communications. This data is used to honour your preferences and to demonstrate compliance with applicable privacy law.

We do not knowingly or intentionally collect special categories of Personal Data (such as health, biometric, or religious data) about our users, and we ask that you do not upload such data about your leads unless strictly necessary and lawful for your outreach purpose.

To provide the Services: send your sequences, run automated follow-ups, sync replies into your unified inbox, detect meeting intent and book meetings, and manage your leads and campaigns.

AI personalization: we pass relevant prompt context to our AI providers (OpenAI, Anthropic, and Google) to generate personalized email content, using each provider's own built-in web search to gather public context. We use the model you select for each generation.

Deliverability: we use sending and reputation signals to support SPF/DKIM/DMARC setup, gradual volume ramp-up, and inbox-placement health, and to pause sending when we detect problems.

Billing, security & improvement: to process subscriptions and credits, detect and prevent abuse and fraud, secure the Services, comply with legal obligations, and improve the Services using aggregated, de-identified data that does not identify you or your prospects.

Automated processing: our meeting-intent detection uses automated classification of reply content to suggest or trigger meeting-booking actions. This assists your workflow rather than making any decision that produces a legal or similarly significant effect about a data subject; you always remain in control of whether a meeting is actually booked or a message actually sent.

Where the GDPR or UK GDPR applies (prospects or users in the EEA/UK), we process personal data under one or more of: performance of a contract (to deliver the Services), legitimate interests (to secure and improve the platform and prevent abuse), legal obligation (tax and compliance), and consent (where required, e.g. optional features). Optional browser storage and preference data (such as your selected interface theme) are processed on the basis of consent, managed through our Cookie Preferences system. You can review and update your Cookie Preferences at any time from within the application.

We also operate in line with India's Digital Personal Data Protection Act, 2023 (DPDP Act). As the processor of your uploaded prospect data, you (the customer/data fiduciary) are responsible for ensuring you have a valid legal basis (such as consent or a certified deemed-consent purpose) to collect and contact those individuals, and for providing them any required notice under the DPDP Act. Where you or your prospects exercise DPDP Act rights against us directly, we will refer the request to you, as fiduciary for that data, and provide reasonable assistance.

Stynar's use and transfer of information received from Google APIs (including the Gmail API and Google Calendar API) to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google Workspace user data accessed through these APIs — including email content, reply threads, and calendar/meeting data — is used solely to provide and improve the specific Stynar features you have requested: sending and scheduling your campaigns, syncing and classifying replies into your unified inbox, detecting meeting intent, and generating AI-assisted email drafts. This data is never sold, and is never used, transferred, or disclosed for advertising or credit-scoring purposes.

Stynar and its AI sub-processors (OpenAI and Anthropic) do not use raw or derived Google Workspace user data to develop, improve, or train generalized or foundational machine-learning or AI models. Any AI processing of this data is limited to generating the specific output you requested within your active session (e.g. a personalized email draft or a reply classification) and is not repurposed for model training.

Human access to Google Workspace user data is restricted to what is necessary for security, legal compliance, or with your explicit consent for support purposes, consistent with the policy referenced above.

We do not sell, rent, or trade your leads, campaign content, replies, or mailbox tokens, and we do not "sell" or "share" Personal Data as those terms are defined under U.S. state privacy laws such as the CCPA. We never share your prospect lists with other customers. We only share data with vetted sub-processors needed to run the Services, under appropriate data-processing terms consistent with our Data Processing Agreement:

• Amazon Web Services (AWS) — cloud hosting, database storage, and authentication.

• Paddle — payment processing and subscription billing (PCI-DSS compliant, acts as merchant of record).

• OpenAI, Anthropic, and Google — AI models used to generate email content, detect meeting intent, and (via each model's own built-in web search) gather public context for AI personalization.

• Google (Gmail / Google Workspace) and Microsoft (Outlook / Microsoft 365) — OAuth mailbox access for sending and reply sync.

We may also disclose Personal Data where required to comply with a valid legal process (such as a court order or governmental request), to enforce our Terms of Use, to protect the rights, property, or safety of Webeeyo, our customers, or the public, or in connection with a merger, acquisition, or sale of assets, subject to this Policy continuing to apply to previously collected data.

We maintain an up-to-date list of sub-processors and will provide reasonable advance notice of any new sub-processor via our Data Processing Agreement process, giving customers with a legitimate objection the opportunity to raise it as described there.

We protect data with industry-standard measures. Connected mailbox credentials and OAuth tokens are encrypted at rest, secrets are held in a managed secrets store rather than in source code, and all data in transit is protected with TLS.

Access to production systems is restricted on a least-privilege basis. Access to customer data follows the same principle — it is restricted to authorized personnel only when necessary to operate, debug, or support the Services. We do not claim any formal certification (such as SOC 2 or ISO 27001) at this stage; we follow recognized security best practices and continue to strengthen our controls as we grow. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data we process, we will investigate promptly and, where required by applicable law, notify affected customers without undue delay so they can meet their own regulatory notification obligations (including, where applicable, notification to India's CERT-In within the timeframe required by Indian law, and to supervisory authorities and affected individuals within the timeframes required by the GDPR/UK GDPR).

Notification will include, to the extent known at the time, the nature of the incident, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed to address it.

Our infrastructure runs on AWS and certain sub-processors operate outside India. Where personal data of EEA/UK individuals is transferred internationally, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (and, for UK transfers, the UK International Data Transfer Addendum). By using the Services, you understand that your data may be processed in countries other than your own, including the United States, and that such countries may have data-protection laws different from those of your jurisdiction.

We retain your data for as long as your account is active and as needed to provide the Services. When you delete leads or content, they are removed from active systems within a reasonable period, and thereafter may persist for a limited time in encrypted backups before being purged in the ordinary course of our backup rotation.

On account termination, we delete or anonymize your workspace data within 30 days, except where we must retain limited records to meet legal, tax, or accounting obligations (which are generally retained for the periods required under Indian law, typically up to 8 years for financial records). OAuth tokens are revoked when you disconnect a mailbox or close your account.

You can permanently delete your account directly from the Settings page within the application. Upon deletion, your data will be deleted or anonymized in accordance with the 30-day timeline described above, subject to any records we are legally required to retain.

Stynar is committed to responsible data governance throughout the data lifecycle. Our data practices are guided by the following principles:

• Data minimisation: we collect only the data necessary to deliver the Services and no more.

• Purpose limitation: we use Personal Data only for the purposes described in this Policy or otherwise disclosed to you.

• Secure processing: data is handled with appropriate technical and organisational safeguards, including encryption in transit and at rest.

• Retention policies: data is held only for as long as necessary, as described in Section 11, after which it is deleted or anonymized.

• Responsible deletion: when data is no longer needed — whether because a campaign was removed, an account was closed, or a retention period has expired — it is securely deleted or anonymized according to our internal procedures.

Subject to applicable law, you may request to access, correct, export, or delete your personal data, and to restrict, object to, or withdraw consent for certain processing. Much of this is available directly in your account settings (for example, exporting or deleting leads, or permanently deleting your account from the Settings page).

If the GDPR/UK GDPR applies to you, you also have the right to data portability and the right to lodge a complaint with your local supervisory authority. If you are a resident of a U.S. state with a comprehensive privacy law (e.g. California, Colorado, Virginia), you have the right to know, delete, and correct your Personal Data, and the right to non-discrimination for exercising these rights; we do not sell or share Personal Data as described in Section 7.

To exercise any right, email privacy@stynar.email from your registered email address. Identity verification may be required before we fulfil your request. We respond within the timelines required by applicable law (generally within 30 days, or 45 days where extensions are permitted).

Stynar uses essential first-party cookies and browser storage technologies (including localStorage) required for authentication, session management, application security, and core functionality. These are strictly necessary for the Services to operate and do not require consent.

Optional Preferences storage is used only when you grant consent through our Cookie Preferences system. For example, your selected interface theme may be stored in browser storage so it persists across sessions. You can review and change your Cookie Preferences at any time from within the application.

Stynar currently does not use Analytics or Marketing cookies. We do not place advertising trackers, third-party analytics pixels, or cross-site tracking technologies, and we do not respond differently to browser "Do Not Track" signals because we do not track you across third-party sites in the first place.

When you enable open or click tracking on a campaign, Stynar adds a tracking pixel or rewrites links so we can report opens and clicks to you. You can turn tracking off per campaign in your sending settings.

The Services are intended for business use by individuals who are at least 18 years old and are not directed to children. We do not knowingly collect Personal Data from anyone under 18. If you believe a child has provided us with Personal Data, contact privacy@stynar.email and we will take steps to delete it.

We may send you product updates, tips, and marketing communications about Stynar where you have consented or where permitted by applicable law. You can opt out at any time using the unsubscribe link in any marketing email or by emailing privacy@stynar.email. Transactional and account-related emails (such as billing receipts or security alerts) are not marketing and will continue regardless of your marketing preference.

The Services may contain links to third-party websites or services that are not owned or controlled by us, including the mailbox, payment, and AI providers referenced in Section 7. We are not responsible for the privacy practices of any third party, and we encourage you to review their privacy policies before providing them with information.

We may update this Policy from time to time to reflect changes to the Services or applicable law. For material changes, we will provide at least 14 days' advance notice by email or in-app notice before the change takes effect, and update the "Last updated" date below. Continued use of the Services after a change takes effect constitutes acceptance of the updated Policy.

If you have questions or requests about this Privacy Policy or your data, contact us:

• Company: Webeeyo Softwers Pvt. Ltd. (operating Stynar)

• Location: Pune, Maharashtra, India

• Privacy: privacy@stynar.email

• Security: security@stynar.email

• General: hello@stynar.email