Privacy Policy
Last updated: October 2026
Data we hold
Account details, organization content, contact records your organization collects, and payment metadata. Card processing is handled by our payment partners; we never store card numbers.
Data security
Sensitive data, including passwords and connected-account credentials such as Google OAuth tokens, is encrypted at rest. All data in transit between your browser, our servers, and any connected service is encrypted via HTTPS/TLS. Passwords are hashed and never stored in plain text. Access to your data is restricted to Klyrae's own servers and enforced per tenant, so no organization, and no unauthorized party, can read another organization's data.
Google user data
If your organization connects Google Drive and Calendar, Klyrae accesses only the files and folders it creates itself in your Drive (never your existing files), and the calendar events it creates to generate and manage Google Meet links for your classes and events. If you sign in or register with Google, we access your name, email address and profile photo to create and authenticate your account. This data is used solely to provide these features to your organization and is never shared, sold or transferred to any third party. Access and refresh tokens are encrypted before they're stored, and, like all data on Klyrae, isolated per tenant so no other organization can read or use them. Tokens are kept only while a connection stays active; disconnecting Google Drive immediately revokes Klyrae's access with Google and permanently deletes the stored tokens from our database. You can review or revoke Klyrae's access at any time from your Google Account's security settings, in addition to disconnecting it from within Klyrae.
YouTube user data
If your organization connects a YouTube channel to stream a live event, Klyrae accesses only your channel's name and thumbnail, and uses that connection solely to create, manage and check the status of the live broadcasts and streams it creates for your own events, nothing else on your channel. Klyrae never reads, modifies or has any awareness of your existing videos, playlists, subscriptions or channel settings. The stream key generated for each broadcast is encrypted at rest, never included in any email, log, or shown to anyone other than your organization's owners and admins within Klyrae. This data is used solely to provide the live-streaming feature to your organization and is never shared, sold or transferred to any third party. Access and refresh tokens are encrypted before they're stored and isolated per tenant, the same as every other connected-account credential on Klyrae. Tokens are kept only while a connection stays active; disconnecting YouTube immediately revokes Klyrae's access with Google and permanently deletes the stored tokens from our database. You can review or revoke Klyrae's access at any time from your Google Account's security settings, in addition to disconnecting it from within Klyrae.
AI features
Klyrae uses OpenAI's API to help generate suggested website copy, marketing email drafts, ticket descriptions and course syllabi, based only on text you type into those specific features. No Google user data, including data from Google Drive, Google Calendar, YouTube, or your Google sign-in profile, is ever sent to OpenAI or any other AI provider, and Google user data is never used to train, improve or fine-tune any AI or machine learning model. The use of raw or derived user data received from Google APIs adheres to the Google User Data Policy, including the Limited Use requirements.
Tenant isolation
Every record is scoped to a tenant. No organization can access another organization’s data.
Email data
We process delivery, open and click events to power your analytics. Unsubscribes are enforced platform-wide per sender.
Your rights
Organizations can export or delete their data at any time. Contacts can request removal via any email footer link.
Contact
[email protected] for any privacy request.