Privacy Policy

Cyntra24 ("we", "us") is a service that helps people check messages, links, documents and calls for scams. This policy explains what data we handle when you use the Cyntra24 website, the installed web app and the Cyntra24 WhatsApp number (together, the "Service"). The data controller is Cyntra24 by ARV Labs, [registered address to be added].

When you check something, we process what you submit: a link, message text, a photo or PDF, a QR code, or audio from a call or voice note. We do not store the text of messages, documents, transcripts or recordings. They are processed to produce your result and then discarded. We store a short record of each check for statistics: the type of check, the verdict and score, the names of the warning signs found, the date, and for links only the website name (for example "example.com"). If you are signed in, the record is linked to your account. Photos and audio are sent to our text-reading and transcription providers (see section 6), which return text to us.

You do not need an account to check things. If you sign in, we hold your mobile number and, if you add it, the name your family knows you by. If you add people to your Family Circle, we hold the names, mobile numbers and email addresses you give us, and a log of alerts we send to them (who, when, by which channel and whether it was delivered). You must have their agreement before adding them. You can remove them at any time, which deletes their details.

If you message the Cyntra24 WhatsApp number, Meta passes us your WhatsApp number and the message, photo, document or voice note you send. We use it to run the check and reply. We keep a one-way scrambled code of your number for a short time to stop the same message being processed twice. If your number matches a Cyntra24 account, we use that account's Family Circle to send alerts.

Reports you post on the Alerts page are public. Do not include your own name, address or account numbers. We store a one-way scrambled code made from your connection details, never the address itself, to limit abuse and to count one helpful vote per person.

We use these providers to run the Service. Each receives only what it needs. Vercel: hosts the website and servers. Supabase: database and phone sign-in. Our database is hosted in Mumbai, India. Google Safe Browsing: receives links to check against Google's list of harmful sites. urlscan.io: receives links to visit safely. Visits are submitted as unlisted. WHOISXML: receives website names to look up their age. OCR.Space: receives photos and PDFs to read their text. OpenAI: receives message text, document text and transcripts for the AI review, and audio for transcription. OpenAI does not use data sent through its API to train its models by default. Twilio: sends sign-in codes (through Twilio Verify) and family alerts by SMS. SendGrid: sends family alerts by email. Meta: operates WhatsApp. Where your data is stored: your account, your Family Circle, alert logs, check records, community reports and the waitlist are stored in our database in Mumbai, India. Some providers process data outside India, for example in the United States or the European Union, while they carry out a check or send a message. Where data leaves India or the UK, we rely on the safeguards each provider offers, such as standard contractual clauses. We do not sell your data or share it with advertisers.

To provide the checks and alerts you ask for (performance of our service to you). To keep the Service secure and prevent abuse, including rate limits (our legitimate interests). To produce anonymous statistics that improve scam detection (our legitimate interests). To meet legal obligations, such as responding to lawful requests.

Content you check: not stored. Check records: up to 24 months, then deleted or made fully anonymous. Account and Family Circle details: until you delete them or ask us to close your account. Alert logs: 12 months. Rate limit records: 2 days. Community reports: until removed by you, us or a moderator.

Depending on where you live, including under UK GDPR and India's Digital Personal Data Protection Act 2023, you can ask to see, correct or delete your data, object to some processing, or withdraw consent. Contact us at support@cyntra24.com. You can also complain to the Information Commissioner's Office in the UK or the Data Protection Board of India.

The Service is not directed at children under 13. Family members may set Cyntra24 up for an older relative with their agreement.

We will post any changes here with a new date. If a change materially affects how we use your data, we will tell signed-in users.

Email: support@cyntra24.com Address: [registered address to be added]