Privacy Policy

This policy applies to the KYBR platform at kybrmarketing.ai, its API, and the pages KYBR publishes for its clients (landing pages, blogs, booking pages and sponsor pages). The service is operated by Beard Growth Partners (“KYBR”, “we”, “us”).

It does not cover our clients' own websites or their own use of the data they hold. When you give your details to a business that uses KYBR, that business decides how your information is used, and this policy describes what we do on their instructions.

For client account data, we are the controller. If you sign up for KYBR, we decide how your account information is handled and you can exercise the rights in Section 09 directly with us.

For the people in a client's workspace, we are a processor. That covers contacts, leads, prospects found for outreach, people who fill in a form or book a meeting on a client's page, and people who comment on or message a client's social accounts. Our client is the controller. We hold and process that data to provide the service and on their instructions. We do not sell it, rent it, use it to build our own marketing lists, or use it to train AI models. If your details sit in a client's workspace and you want them accessed, corrected or deleted, the fastest route is the business you dealt with. Contact us and we will help identify and assist them.

Connected email accounts. When you connect an email account for outreach, KYBR sends through that account's own outgoing server, so the email comes from you. It opens only mail that belongs to outreach: answers to messages KYBR sent, delivery notices, and mail from people outreach has written to, including any of these that your provider filed as spam. Nothing else in the mailbox is opened.

We do not intentionally collect special category data (health, biometrics, political or religious views, and so on). Please do not place it in free-text fields.

KYBR uses third-party AI models (OpenAI) to plan and write marketing, to qualify leads and prospects, and to help answer the people who reply. This is the part of the platform most likely to surprise people, so we describe exactly what each use sends.

• Content and planning sends your business profile, the brief, and passages from your Brain. It does not send your contact lists.
• Lead scoring sends, for each lead: the first and last name where present; the email address; whether a phone number exists (never the number itself); tags and pipeline stage; and your business profile to score against.
• Outreach sends, for each prospect: name, job title, company (with its industry, size and place), and what was found about the company on public websites, so the prospect can be scored for fit and the emails written. The AI looks the company up on the web for this.
• Replies, comments and messages sends the text someone wrote to you, with their name, so it can be sorted and an answer drafted for you.
• The Brain sends your website text and files to be indexed, so the AI can find what is relevant when it writes.

Drafts wait for a person's approval unless you have chosen to let a kind of work go out without asking. We do not use your data, or the data of the people in your workspace, to train or fine-tune any model, and our AI provider is engaged under terms that do not allow it to train on data we send through its API.

Scores influence automation: a high score can tag a contact and start a workflow. Scores are advisory inputs to your own marketing decisions, not automated decisions producing legal effects, and you can inspect and override any score in the platform.

We use the sub-processors below. We do not sell personal data, and we do not share it for advertising.

Accounts you connect (your email account, a CRM, your social networks, your calendar) are your own accounts with those providers, governed by your agreements with them. KYBR reads from and writes to them on your instruction.

We may also disclose data where the law requires it, to protect our rights or someone's safety, or to a buyer or successor in a merger or acquisition, in which case this policy continues to apply until you are told otherwise.

This section describes how KYBR accesses, uses, stores, shares, protects, keeps and deletes Google user data: the information KYBR receives through Google APIs. KYBR receives Google user data only when you choose to sign in with Google or to connect your Google Calendar.

Google user data that KYBR accesses

How KYBR uses Google user data

• Sign-in data is used only to sign you in to KYBR and to tell your account apart from others.
• Busy times are used only to leave those times out of the free times your KYBR booking pages offer, at the moment a page is opened.
• Calendar event access is used only to create an event when someone books a meeting with you through your KYBR booking page, with a Google Meet link and the guest invited, and to change or delete that same event if the meeting is moved or cancelled. KYBR does not read, change or delete any other event on your calendar.
• KYBR uses Google user data only to provide these features to you. It does not use Google user data for advertising, does not sell it, does not use it to build profiles, does not send it to AI models, and does not use it to train or improve AI or machine-learning models.

How KYBR shares Google user data

• KYBR does not sell Google user data and does not share or transfer it to advertisers, data brokers or any other third party.
• It is stored for KYBR by the hosting providers that run the service (Amazon Web Services, Neon and Cloudflare, listed in Section 05), who may use it only to host KYBR.
• When a meeting is booked, the guest receives the calendar invitation for that meeting, which is the purpose of the booking.
• We would disclose Google user data only if the law requires it, to protect the security of the service or someone’s safety, or as part of a merger or acquisition with notice to you.

How KYBR stores and protects Google user data

• The access and refresh tokens Google issues for your calendar are encrypted at rest with AES-256-GCM, are never sent back to the browser, and can be used only by the workspace that connected the calendar.
• Data is held in our database in the United States (Neon, US East). All traffic between your browser, KYBR and Google runs over TLS.
• Busy times are read when a booking page is opened and are not stored.
• Nobody at KYBR reads Google user data, unless you ask us to in order to fix a problem, the law requires it, or it is needed to keep the service secure. Access to production data is limited to the people who operate the service.

Retention and deletion of Google user data

• Calendar tokens are kept until you disconnect the calendar. Disconnecting deletes them at once and asks Google to revoke KYBR’s access. To disconnect: Outreach, Email accounts, Change beside the calendar, then Remove.
• For each meeting booked, KYBR keeps its time, the guest’s name and email address, and Google’s identifier for the event, while your workspace holds that meeting.
• Sign-in data is kept while your KYBR account is active.
• To have your Google user data deleted, write to dev@musichabitat.com. We delete it within 30 days of the request. You can also remove KYBR’s access at any time at myaccount.google.com/permissions.

Limited Use

KYBR’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

KYBR is hosted in the United States: the application with Amazon Web Services and the database with Neon, both in US East, and files with Cloudflare. If you use KYBR from outside the United States, your data is transferred to and processed in the United States.

• Client account data is kept while your account is active.
• Contacts, leads, prospects and their history are kept while your workspace holds them. Deleting one in the platform removes our copy; it does not delete the record in a CRM you connect, which you control.
• Error records are kept for 30 days and scheduling records for 90 days. Audit and usage history is kept while your account is active, so we can investigate incidents and bill accurately.
• Access to a connected account is deleted when you disconnect it.
• When a client closes their account, we delete their workspace and its data within 30 days of their request, except records we must keep for legal or accounting reasons.

• All traffic runs over TLS.
• Passwords and access tokens for connected accounts are encrypted at rest with AES-256-GCM, and are never sent back to the browser once saved.
• Account passwords are stored only as a hash.
• Each client workspace is logically separated, and every request is scoped to the workspace that made it.
• Staff who sign in to operate the service with a password must also enter a code sent to their email, and staff actions are written to an audit log.
• Access to production data is limited to personnel who need it to operate and support the service.
• Inbound webhooks are cryptographically verified before we act on them.

No system is perfectly secure. If a breach affects your personal data we will notify you and any regulator as required by law and without undue delay.

Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, restrict or object to processing, withdraw consent, receive it in a portable format, and not be discriminated against for exercising any of these.

Write to dev@musichabitat.com and we will respond within the period the applicable law requires: one month under UK and EU GDPR, 45 days under the CCPA. As Section 02 explains, if your details are in a client's workspace we will direct you to that client and help them respond.

Anyone who receives an email sent through KYBR can stop further emails with the unsubscribe link it carries.

You may also complain to your data protection authority. In the UK that is the Information Commissioner's Office.

We use only what is necessary to run the service: a sign-in token kept in your browser's storage while you are signed in, and our infrastructure providers' security cookies. We do not run advertising or cross-site tracking cookies, in the application or on the pages we publish for clients.

KYBR is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16; if you believe we have, contact us and we will delete it.

We will update this page when our processing changes, and revise the date at the top. For changes that materially affect your rights we will give notice in the platform or by email before they take effect.

Questions: dev@musichabitat.com. See also our Terms of Service.