Privacy Policy
CYA Engine — cyaengine.com
Effective date: February 24, 2026
CYA Engine ("we," "us," or "our") operates the CYA Engine platform, a data and analytics engine that interconnects marketing, videography, and content management for our clients. This Privacy Policy explains what information we collect, how we use it, with whom we share it, and what choices you have. By accessing or using our platform, you agree to this policy.
1. Information We Collect
Account and Identity Information
When you create an account or log in, we collect your name, email address, and authentication credentials through our identity provider, Clerk. We do not store raw passwords — all credential management is handled by Clerk.
Client and Business Data
As a platform user, you may input business information, client profiles, campaign data, content strategies, questionnaire responses, and media assets. This information is stored in our database and used to power the platform's analytics and content tools.
Usage and Technical Data
We automatically collect technical information including your IP address, browser type, device information, pages visited, and actions taken within the platform. This data helps us maintain service reliability and improve the user experience.
Communications
If you contact us by email or if the platform facilitates SMS communications through our CRM integration, we retain those message records. Phone numbers submitted through intake forms may be used for transactional or service-related SMS messages.
2. How We Use Your Information
- —Providing, operating, and improving the CYA Engine platform and its features
- —Authenticating users and managing account security
- —Generating content strategies, analytics reports, and performance insights
- —Storing and organizing client media files via Google Drive integration
- —Sending transactional notifications, service alerts, or SMS messages where applicable
- —Responding to support requests and inquiries
- —Complying with legal obligations and enforcing our terms
3. How We Share Your Information
We do not sell your personal information. We share data only in the following circumstances:
Service Providers
We work with third-party service providers who process data on our behalf. These include Supabase (database infrastructure), Clerk (authentication), Google (file storage via Google Drive), and GoHighLevel (CRM and SMS delivery). Each provider is bound by their own privacy policies and data processing agreements.
Legal Requirements
We may disclose information when required by law, regulation, or valid legal process, or to protect the rights, property, or safety of CYA Engine, our users, or the public.
Business Transfers
In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred as part of that transaction. We will notify affected users through the platform or by email.
4. Third-Party Services
Our platform integrates with the following third-party services. Each has its own privacy policy that governs their data handling:
Clerk
Handles user authentication and session management. Clerk processes your login credentials and identity verification.
Supabase
Provides the database infrastructure where platform data, client records, and content are stored.
Google (Drive)
Used for storing and organizing media files and documents. Files uploaded through the platform may be stored in Google Drive.
GoHighLevel (GHL)
Powers CRM features and SMS messaging capabilities. Contact information may be synced with GHL for communication purposes.
Instagram / Meta
We use the Instagram API to access comments and user profile information (username, profile ID) on Instagram accounts that have been explicitly connected to CYA Engine. Data retrieved through the Instagram API is used solely to deliver notifications to the account owner and is not shared with third parties for marketing or promotional purposes. We process user data including usernames, profile IDs, device identifiers, and IP addresses only as necessary to provide this functionality. CYA Engine complies with Meta Platform Terms and Meta's Developer Policies. Users can disconnect their Instagram account at any time through Meta's app settings at facebook.com/settings.
5. SMS / Text Messaging
CYA Engine uses GoHighLevel to deliver SMS messages on behalf of connected accounts. By providing your phone number and opting in to text communications, you agree to the following terms:
- —Message frequency varies based on your account activity and notification preferences.
- —Message and data rates may apply. Check with your mobile carrier for details.
- —Carriers are not liable for delayed or undelivered messages.
Opt-Out
You can opt out of SMS messages at any time by replying STOP to any message. After opting out, you will no longer receive SMS messages from CYA Engine unless you re-enroll.
Help
Reply HELP to any message for assistance, or contact us directly at the email address listed in the Contact section below.
Data Sharing — SMS
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.
Text messaging originator opt-in data and consent will not be shared with any third parties, except those aggregators and providers of the Text Message services (such as GoHighLevel and their carrier partners) who are necessary to deliver the messages.
6. Cookies and Tracking Technologies
We use cookies and similar tracking technologies to operate and maintain the platform. These include:
- —Session cookies to keep you signed in between page loads
- —Preference cookies to remember settings such as sidebar state
- —Functional cookies set by Clerk for authentication session management
- —Analytics data collected by our database infrastructure to monitor platform performance
We do not use third-party advertising cookies or behavioral tracking for advertising purposes. You may control cookie behavior through your browser settings, though disabling certain cookies may affect platform functionality.
7. Data Retention
We retain your data for as long as your account is active or as needed to provide services. If you request account deletion, we will remove your personal data from active systems within 30 days, except where retention is required by law or to resolve disputes. Aggregated, anonymized data may be retained indefinitely for analytics purposes.
8. Data Security
We implement industry-standard security measures including encrypted data transmission (HTTPS/TLS), database row-level security enforced by Supabase, and access controls managed through Clerk authentication. However, no method of transmission or storage over the internet is completely secure. We encourage you to use a strong, unique password and to notify us immediately if you suspect unauthorized access to your account.
9. Your Rights and Choices
Depending on your jurisdiction, you may have the following rights regarding your personal data:
- —Access: request a copy of the personal data we hold about you
- —Correction: request that we correct inaccurate or incomplete data
- —Deletion: request that we delete your personal data, subject to legal retention requirements
- —Portability: request your data in a structured, machine-readable format
- —Objection: object to certain processing activities where we rely on legitimate interests
- —Withdrawal of consent: where processing is based on consent, withdraw that consent at any time
To exercise any of these rights, contact us at the email address listed below. We will respond within a reasonable timeframe and in accordance with applicable law.
California Privacy Rights (CCPA)
If you are a California resident, the California Consumer Privacy Act (CCPA) grants you additional rights regarding your personal information. These include the right to know what personal information we collect, disclose, or sell; the right to request deletion of your personal information; the right to opt out of the sale of your personal information (we do not sell personal information); and the right not to receive discriminatory treatment for exercising your CCPA rights. To submit a verifiable consumer request under the CCPA, contact us at the email listed in the Contact section. We do not sell personal information and have not done so in the preceding 12 months.
10. Children's Privacy
CYA Engine is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us and we will promptly delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the effective date at the top of this page. We encourage you to review this policy periodically. Continued use of the platform after changes are posted constitutes your acceptance of the revised policy.
12. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact us:
© 2026 CYA Engine. All rights reserved.