Privacy Policy

Pielyt is operated by circle5design, LLC (“Pielyt,” “we,” “us,” or “our”). Our service lets a site owner connect an AI assistant to a site and act on it within the permissions the owner grants. This Privacy Policy explains what personal information we collect and process, why we use it, who may receive it, and the choices available to you.

1. Scope and Our Role

This policy applies to our website, dashboard, hosted gateway, command-line tool, the connection service that lets an AI assistant work with your site, and related support and communications (collectively, the “Service”).

We act as a controller when we decide why and how to process Account Data — information about your account itself, such as registration, billing, security, analytics, and business-contact information. When a customer uses the Service to process personal information from a connected site on the customer's behalf (“Customer Data”), the customer is the controller and we act as its processor, except where applicable law requires otherwise. These two defined terms, Account Data and Customer Data, are used consistently across this policy and the Terms of Service. The customer is responsible for its instructions to us, its notices and lawful bases, and responding to people whose data appears on its site.

2. Information We Collect and Process

• Account information. Email address, organization and team details, authentication records, and any profile information you provide or an identity provider makes available.
• Site connection data. Credentials or tokens needed to communicate with a connected site, its URL, connection status, capability information, and technical metadata about the site and its extensions.
• Customer Data. Information an authorized assistant reads from, writes to, or otherwise processes on a connected site. Depending on the site and permissions, this may include posts, pages, comments, user names and email addresses, form submissions, commerce customers and orders, media and metadata, configuration, and other personal information stored by the customer.
• Assistant requests, results, and activity records. Requests you make through an AI assistant or our command-line tool may contain tool names, arguments, instructions, site content, and results. We keep operational records such as the acting principal, site, action, resource identifier, outcome, authorization and capability versions, and timestamps.
• Payment data. Stripe processes payment-card and bank details. We retain limited billing information such as the plan, seat count, subscription status, transaction references, and invoice history.
• Communications. Email address, message content, and related records when we send service messages or you contact us. We use Resend for transactional email.
• Device, log, and analytics data. IP address, browser and device type, access times, request and error data, selected product events, and similar technical information used to run, secure, and understand the Service.

3. Data We Process on Your Behalf

We process Customer Data to carry out customer-authorized operations, return results, provide requested history and support, secure the Service, and meet our obligations under the agreement with the customer. The categories and volume of Customer Data depend on the site, the connected assistant, and the permissions and operations the customer selects.

Where data protection law requires a contract governing this processing, Section 13 of our Terms of Service is that contract. It addresses documented instructions, confidentiality of personnel, security, sub-processors and how a customer is notified of and may object to a new one, assistance with individual-rights requests and impact assessments, breach notification, what happens to data at the end of the services, audits, and international transfers. Accepting the Terms of Service accepts those processing terms; no separate document or signature is needed.

4. Sources of Personal Information

We receive information:

• directly from users, customers, and their personnel;
• from connected sites and the people who use those sites;
• from authentication and identity providers;
• from payment and billing providers;
• automatically from browsers, devices, and service logs; and
• from integrations and downstream applications a customer or user authorizes, including AI assistants and the applications that connect them to the Service.

5. How We Use Information

We use information to:

• provide, operate, maintain, and support the Service;
• create and secure accounts and authenticate sign-ins;
• connect a site to the assistant or application you authorize and apply the permissions you configure;
• maintain a record of actions taken on your site for security, troubleshooting, and to improve our services;
• process billing and administer plans and seats;
• send transactional and service-related communications;
• detect, investigate, and prevent fraud, abuse, errors, and security incidents;
• analyze and improve the Service and develop features, subject to the training terms in Section 8; and
• comply with law and establish, exercise, or defend claims.

6. Legal Bases for Processing

Where the EU GDPR or UK GDPR applies and we act as controller, we rely on the following legal bases as appropriate:

• Contract. Processing needed to provide the Service, administer an account, process payments, or take steps you request before entering a contract.
• Legitimate interests. Securing and improving the Service, preventing misuse, understanding product use, supporting customers, and protecting our rights and those of others, balanced against the interests and rights of affected people.
• Legal obligation. Processing needed to comply with tax, accounting, regulatory, court, and other legal duties.
• Consent. Processing for which we ask for consent. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

When we act as a processor, the customer determines the legal basis for processing Customer Data and instructs us through its use of the Service and the processing terms in Section 13 of the Terms of Service.

7. How Assistant Data Moves Through the Service

1. Your AI assistant, or our command-line tool, sends Pielyt an authenticated request, including a tool name and any arguments supplied for the operation.
2. Pielyt validates the request and evaluates it against the connection's scope, role, and current site capabilities.
3. If authorized, Pielyt sends the validated operation and arguments to the connected site. If not authorized, Pielyt refuses the operation without sending it to the site.
4. Pielyt receives the site's result and returns that result or a refusal or error to the requesting assistant or tool. Site content therefore passes through Pielyt when it is part of an operation or result.

You choose and control the AI assistant, model provider, and other downstream applications you connect. The result Pielyt returns may be sent onward by that assistant to OpenAI, Anthropic, another model provider, or a local or self-hosted model. Their processing is governed by your relationship with them and their own terms and privacy practices.

8. Service Improvement, AI Training, and Ownership

We do not make a blanket promise that data submitted to the Service will never be used for AI or machine-learning training. To the extent permitted by applicable law and our contracts, we may use information processed through the Service, including Customer Data, tool requests, results, usage records, and feedback, to operate, analyze, develop, improve, evaluate, and train our services and models. Where we process Customer Data solely as a processor, we will do so only on the customer's documented instructions, including any instruction or authorization governing improvement or training use, and subject to the processing terms in Section 13 of the Terms of Service.

Customers retain ownership of their Customer Data. Pielyt retains ownership of the Service, its models and model parameters, and aggregated or deidentified information and insights that do not identify a customer or individual, subject to applicable law and the Terms. We may use, disclose, license, and sell aggregated or deidentified information — information that does not identify, and cannot reasonably be linked to, a customer or individual — for any lawful purpose. Where we rely on deidentified information under the CCPA, we maintain and use it only in deidentified form, do not attempt to reidentify it except as the law permits (for example, to test that deidentification works), and contractually require recipients to commit to the same. User-selected external AI providers decide for themselves whether and how they use data they receive; review and configure those services before connecting them.

9. How We Disclose Information

We may disclose information to:

• Infrastructure and service providers. Supabase for authentication and database services; Google Cloud for the hosted gateway; Vercel for application hosting and delivery; Stripe for payments; Resend for transactional email; and PostHog for product analytics.
• User-authorized services. AI assistants, the applications that connect them to the Service, model providers, connected sites, and integrations that you select or direct us to interact with.
• Professional advisers and business counterparties. Lawyers, auditors, insurers, lenders, and parties to a financing, acquisition, reorganization, or similar transaction, subject to appropriate confidentiality and use limits.
• Authorities and other parties. When reasonably necessary to comply with law, protect rights or safety, prevent abuse, or establish, exercise, or defend legal claims.

Where a service provider processes information on our behalf, we require contractual restrictions appropriate to its role. We do not currently sell personal information for money or share it for cross-context behavioral advertising, as the CCPA defines those terms, and we do not use personal information to serve targeted advertising. We do reserve the right to sell or license aggregated or deidentified information as described in Section 8; information that is properly deidentified under the CCPA is not personal information. If our practices change so that we sell or share personal information, before doing so we will update this policy and the category disclosures in Section 13, post a “Do Not Sell or Share My Personal Information” link, and honor opt-out requests and recognized opt-out preference signals such as Global Privacy Control.

10. Cookies and Product Analytics

We use cookies and similar local storage needed to authenticate users, keep sessions secure, remember settings, and operate the Service. Disabling required storage may prevent you from signing in or using the Service.

We use a US-hosted PostHog deployment for product analytics. We send selected events rather than automatically recording page elements or interactions, and we do not design those events to carry personal information or Customer Data. We do not use advertising or cross-site tracking cookies.

11. US Processing and International Transfers

Pielyt processes information in the United States. Our Supabase environment, hosted gateway, and PostHog analytics environment run in the United States. Other recipients may also process information in the United States or in countries where they operate.

If personal information from the European Economic Area, United Kingdom, or Switzerland is transferred out of those regions, we will use a transfer mechanism permitted by applicable law, together with any supplementary safeguards that law requires.

12. Retention and Security

We retain each category of information only for as long as needed for the purposes described here, including providing the Service, maintaining security and audit records, resolving disputes, and meeting legal, accounting, and contractual duties. Account and connection information generally remains while an account is active and for a reasonable period afterward. Execution metadata is retained indefinitely as a security and audit record, subject to applicable legal duties. Customer Data used in history or support features follows the configured or applicable retention period.

Closing an organization ends its access straight away: we revoke every connection and disconnect every connected site. Records that remain afterward are kept where retention is permitted or required, including for security, fraud prevention, financial and audit purposes, and where they relate to another active customer account. Where the law gives you a deletion right, contact us and we will respond as it requires. We do not selectively edit backups; a record held in one ages out on its retention schedule and is not returned to service.

We use administrative, technical, and organizational safeguards designed to protect information. No service or permissions system can guarantee absolute security or prevent every unauthorized or unintended operation.

13. Your Privacy Rights

Subject to applicable law and exceptions, you may have the right to access, correct, delete, or receive a portable copy of your personal information; object to or restrict certain processing; withdraw consent; and appeal or complain about our response. You will not be discriminated against for exercising a privacy right. If your information is Customer Data, contact the relevant customer first; we will assist that customer as required by our agreement and applicable law.

EEA and UK residents may lodge a complaint with the supervisory authority where they live, work, or believe an infringement occurred. You may also contact us first so we can try to address the concern.

California residents may request the categories and specific pieces of personal information we collected, the categories of sources, purposes, and recipients; request correction or deletion; and use an authorized agent, subject to verification and legal exceptions.

The categories of personal information in Account Data are the ones described in Section 2 — identifiers, customer and commercial records, network activity, approximate location inferred from an IP address, professional and organization details, log-in and site credentials, and limited product-usage inferences. Their sources are in Section 4, the purposes we use them for in Section 5, the recipients in Section 9, and their retention in Section 12. We do not sell or share any of these categories. Customer Data may contain any category of personal information; we process it as the customer's service provider or processor, for the business purposes in Sections 3 and 5, and do not sell or share it.

To submit a request, contact us at privacy@pielyt.com. We may verify your identity and authority before acting and will respond within the period required by applicable law.

14. Children’s Privacy

Pielyt is a business tool for site owners, administrators, and teams. It is not directed to children, and we do not knowingly collect personal information directly from anyone under 16. Customer Data may contain information about children if a customer directs the Service to process it; the customer is responsible for having a lawful basis and giving any required notice. Contact us if you believe a child provided personal information directly to us without authorization.

15. Changes to This Policy

We may update this Privacy Policy. If a change materially affects how we process personal information, we will provide notice as required by law, such as by email or through the Service. The “Last updated” date shows when this policy was most recently revised.

16. How to Contact Us

Contact circle5design, LLC, 1718 N Sedgwick St, Chicago, IL 60614, at privacy@pielyt.com with questions, requests, or complaints.