Privacy Policy

Virtual mailing address: 30 N Gould St, STE R Sheridan, WY 82801, USA

Work address: Ulpiane, Dëshmorët e Kombit Prishtina, 10000 Kosovo

Email: hello@usetyton.com

We decide how to use personal data about visitors to usetyton.com, account holders, and people who contact us.

For tracking events a customer chooses to collect from its own website, that customer decides the purposes and the lawful basis. We process those events on the customer's instructions under our data processing agreement. The customer's own privacy notice also applies to its visitors.

Where GDPR applies, we process personal data under these bases:

• Contract, or steps you ask us to take before a contract, to provide the account, audit, and paid setup you request
• Consent, where we ask for it, including optional marketing. You can withdraw consent without affecting earlier lawful use
• Legitimate interests, for security, abuse prevention, and keeping the service reliable, balanced against your rights
• Legal obligation, for tax, accounting, and other legal duties

For customer-directed tracking, the customer is responsible for the legal basis, including any consent required for advertising technologies. We do not make that decision for the customer.

You do not have to give us account data. If you do not, we cannot create the account or run a paid setup. An audit of a public page can still start without an account.

We do not make a decision about you that is based only on automated processing and that produces a legal effect or a similar significant effect. Sending a conversion to Meta does not do that inside Tyton. What Meta does with an event after it receives it is Meta's processing, under the customer's instructions.

4.1 Account information

• Name, email address, and profile photo
• Login records
• Sites you connect to Tyton, and the settings for those sites
• Support messages
• Billing status

If you sign up with email and a password, the password is hashed and stored by our authentication provider, Supabase. We do not store or see your plaintext password.

If you sign up or sign in with Google, we do not receive or store your Google password. We receive the Google account email, name, and profile photo described in section 5.

4.2 Billing information

• Payments are processed by Stripe
• We do not store your full card number
• We receive what we need to manage the subscription and keep a record of payment

If you request a refund through Billing or by emailing hello@usetyton.com, we process your request, payment reference, and related support communications to review and handle it. See section 5 of the Terms for the refund guarantee and its conditions.

4.3 Audit data

A free audit can look at a public page and store the findings: what was detected, what was missing, and the report. Do not put passwords, secrets, or sensitive personal data into an audit or a support message.

4.4 Tracking events a customer turns on

If a customer enables tracking, event data can include:

• Event name, event ID, and time
• Page address
• Purchase value and currency
• Browser or Meta identifiers, such as _fbp and _fbc
• Matching information such as a hashed email or hashed phone number
• IP address and user agent, which may pass through the delivery path and are not kept as plaintext profile fields

Hashed identifiers can still be personal data. Hashing does not make an event anonymous.

The service is not meant for special-category data, passwords, or confidential files. Do not send them.

4.5 Usage data

• Technical logs and error reports needed to run and protect the service
• Device and browser information related to those logs

If you sign up or sign in with Google, Tyton requests limited access to your Google account. We request only these scopes:

• openid
• userinfo.email, your email address, used to identify your Tyton account
• userinfo.profile, your name and profile photo, used to display your account

We do not request Google Calendar, Gmail, Drive, or any other Google product.

5.1 How we use Google data

• Email: to create the account, sign you in, and contact you about the service
• Name and photo: to show your profile in Tyton

5.2 Limited Use

Tyton's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We do not:

• Sell Google user data
• Use Google user data for advertising
• Use Google user data for anything other than providing and securing your Tyton account
• Allow people to read that Google data unless you ask us to, it is needed for security, it is needed to comply with law, or the data is aggregated and cannot identify you
• Transfer Google user data except to providers needed to run and secure your account, including authentication, hosting, service email, and billing, or where required by law

5.3 Revoking Google access

You can remove Tyton's access at any time:

1. Open Google Account permissions
2. Find Tyton
3. Remove access

Removing access revokes the existing Google authorization. A later Google sign-in may ask you to authorize Tyton again. It does not by itself delete your Tyton account. To delete the account, email hello@usetyton.com.

When a customer connects a site, Tyton can:

• Place the browser container that sends the Meta Pixel event
• Receive the matching server event on Tyton's gateway
• Send the Conversions API event to Meta
• Use one shared event_id so Meta can count the conversion once

The customer chooses the site, the Pixel, and which events to send. The customer must have the right to collect that data and must give its visitors whatever notice or consent the law requires.

Email addresses and phone numbers are hashed with SHA-256 on arrival. We do not send plaintext email or phone numbers to Meta.

A click, a form attempt, and a confirmed purchase are different things. Tyton sends a conversion when the customer's approved setup says the action succeeded.

We use cookies and similar storage that are needed to sign you in, keep the session secure, and remember a choice you make on our site.

If we use optional marketing cookies on usetyton.com, we will ask where the law requires a choice. A customer's pixel on the customer's own website is controlled by that customer, not by this cookie notice.

We use providers to run Tyton. They receive only what they need for their work:

• Supabase, for the database and authentication. The primary database is in Frankfurt, Germany
• Cloudflare, for the site, the gateway, and network services
• Resend, for service email
• Stripe, for payments
• Meta, for customer-approved conversion events

An AI agent you choose, such as the editor where you connect Tyton MCP, is a separate service with its own terms. We do not send your Google password or your Meta token to that agent. A Meta token is stored encrypted and is not shown again.

We do not sell account information.

We may disclose information if the law requires it, to protect the service or its users, or as part of a business transfer with appropriate protection. Email hello@usetyton.com if you want to know which providers apply to your data.

The primary database is in Frankfurt, Germany. That does not mean every process stays in the European Union. Kitra LLC operates from the United States and Kosovo. Cloudflare and other providers may process information in other countries. Delivery to Meta may also leave the EU.

Where a transfer from the European Economic Area, the United Kingdom, or Switzerland needs a legal mechanism, we use one and any extra protection the law requires. This policy is not itself a set of standard contractual clauses. Ask us if you need the mechanism that applies to a particular transfer.

We keep information only as long as we need it for the service, security, and legal duties.

• Detailed tracking event rows: deleted on a schedule. The shorter plan keeps them for 7 days. The longer plan keeps them for 30 days. Daily totals that do not identify a person can be kept longer
• Audit reports and account records: kept while the account is active and as needed to support it, then deleted or de-identified unless the law requires us to keep them
• Billing records: kept as long as tax and accounting law requires
• Security logs and backups: kept for a limited time, then deleted as the backup cycle turns over

Closing an account does not erase a record the law tells us to keep. Hashed event data is still personal data until it is deleted.

If the GDPR or the UK GDPR applies to you, you can ask us to:

• Access the personal data we hold about you
• Correct data that is wrong or incomplete
• Erase data, when a ground for erasure applies
• Restrict how we use it
• Receive the data you gave us, in a portable format, when the processing is based on contract or consent and is carried out by automated means
• Object to processing based on legitimate interests. We stop unless we show compelling grounds that override your rights, or the processing is for a legal claim
• Object to direct marketing at any time. We stop marketing if you object
• Withdraw consent, where consent is the basis. Withdrawal does not affect processing that was lawful before you withdrew it
• Not be subject to a decision based solely on automated processing that produces a legal or similarly significant effect. Tyton does not make that kind of decision

Email hello@usetyton.com. We may need to confirm it is you before we act. We respond within one month. That month can be extended by two further months for a complex or numerous request, and we will tell you if that happens.

You can complain to a supervisory authority where you live, where you work, or where you believe a problem occurred. In the United Kingdom, that authority is the Information Commissioner's Office.

If your request is about tracking on a Tyton customer's website, contact that customer first. They are the controller for that use. We will help them meet their duty to respond.

Our data processing agreement, published at https://usetyton.com/dpa, is the Article 28 contract for customer-directed tracking. It covers instructions, confidentiality, security, subprocessors, assistance with requests, deletion or return, and audits.

11.1 California

If you are a California resident, you may ask what personal information we collect, ask us to delete it, and opt out of sale. We do not sell personal information. We will not discriminate against you for asking. Email hello@usetyton.com.

We send email that the service needs: confirming your account, resetting a password, and notices about billing or a security issue.

Marketing email is sent only where we are allowed to send it. Every marketing email has an unsubscribe link.

Tyton is not for anyone under 16. We do not knowingly collect personal data from children under 16. If we learn that we have, we will delete it.

We use access controls, encryption in transit, and encryption for stored Meta tokens, appropriate to the risk. No online service is free of risk.

If we are the controller and we become aware of a personal data breach, we notify the supervisory authority without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to risk people's rights. If the breach is likely to result in a high risk to you, we also tell you without undue delay.

If the breach concerns tracking a customer controls, we tell that customer without undue delay so the customer can meet its own notification duty. The customer notifies its visitors and its authority.

We will update the date at the top when this policy changes. If a change is significant, we will also notify you by email or in the product when the law requires it.

Email: hello@usetyton.com

Kitra LLC 30 N Gould St, STE R Sheridan, WY 82801, USA