Privacy Policy

Sylus Labs Limited (“Sylus”, “we”, “us” or “our”) is a company registered in Abu Dhabi Global Market (ADGM), Abu Dhabi, United Arab Emirates. This Privacy Policy explains how we collect, use, share and protect personal data when you visit sylus.ai, use the Sylus platform, or use Sylus inside ChatGPT or Claude through our plugin and connector (together, the “Services”).

Summary

• Sylus connects to the business systems your organization chooses and lets your team ask questions about that data in plain English.

• We never sell personal data, never use it for advertising, and never use customer data or data received from ChatGPT or Claude to train AI models.

• The Sylus plugin for ChatGPT and the Sylus connector for Claude are read-only. They receive only what is needed to answer your request, never your full chat history.

• You can access, correct, export or delete your personal data by emailing privacy@sylus.ai.

1. Who we are and how to contact us

Sylus Labs Limited is the controller of the personal data described in this policy, except for Customer Data, which we process on behalf of our customers (see section 2). For any privacy question or request, email privacy@sylus.ai or use the form at the bottom of this page.

2. Customer Data and our role

When an organization (a “Customer”) connects its data sources to Sylus, we process the data in those sources, and the questions, answers, dashboards and reports created from it (“Customer Data”), on the Customer’s behalf and according to its instructions under our customer agreement. For Customer Data, the Customer is the controller and Sylus is the processor.

If your personal data appears in a Customer’s systems (for example, you are one of their clients or employees) and you want to exercise your privacy rights, please contact that organization. If you contact us instead, we will pass your request to them and help them respond.

3. Information we collect

Information you give us.

• Contact, demo and callback requests: your name, work email, phone number, company name and message when you fill in a form on our website, book a demo through our scheduling tool, or message us on WhatsApp.

• Account information: your name, work email, organization, role and login details when you or your organization create a Sylus account.

• Support and communications: the content of emails and other messages you send us.

Customer Data. Data from the business systems your organization connects to Sylus, such as CRM, ERP, accounting, advertising and data warehouse tools, together with the questions you ask and the answers, queries, dashboards and reports Sylus creates. Depending on what your organization connects, Customer Data can include personal data about its customers, employees or business contacts, such as names, email addresses or transaction records.

Information collected automatically. When you use the Services, we collect technical data such as IP address, browser and device type, pages and features used, timestamps and error logs. We use it to run, secure and improve the Services.

Cookies and third-party content. Our website is hosted by Framer, which provides us with website analytics such as pages visited, referring site, device type and approximate location. Some pages embed third-party content, such as YouTube videos and a Cal.com booking calendar, and link to WhatsApp chat. These providers may collect data or set cookies when you interact with them, under their own privacy policies. We don’t place advertising cookies ourselves, and you can block or delete cookies in your browser settings.

4. Sylus in ChatGPT and Claude

Sylus offers a plugin for ChatGPT, made by OpenAI, and a connector for Claude, made by Anthropic (together, the “AI assistant integrations”). They let you ask questions about your organization’s data in Sylus without leaving ChatGPT or Claude. This section explains exactly what data moves between these services and Sylus.

How you connect. You add Sylus from ChatGPT or Claude and sign in to your Sylus account on a secure authorization screen (OAuth). Access is granted only when you approve it. We never see your OpenAI or Anthropic password, and OpenAI and Anthropic never see your Sylus password.

Permissions we request. Only your basic Sylus profile (name, email address and workspace), so we can identify you, and read-only access to the Sylus data you are already allowed to see. The integrations cannot create, change or delete anything in Sylus or in your connected systems.

What Sylus receives.

• An access token linked to your Sylus account, and your Sylus user and workspace identifiers.

• The request ChatGPT or Claude sends to answer your question, for example “What was revenue by region last quarter?”, and any details needed to answer it, such as a date range or data source.

• Technical data about each request: timestamps, request identifiers, errors and the network address of the calling service.

What Sylus does not collect.

• Your ChatGPT or Claude conversation history, earlier messages, memory, conversation summaries or uploaded files. We only see the content ChatGPT or Claude includes in a request to Sylus.

• Your precise location.

• Payment card details, health information, government ID numbers, or passwords, API keys or other credentials. The integrations never ask for these. Data source credentials are set up only in the Sylus web app, never through ChatGPT or Claude.

What Sylus sends back. Answers drawn from the data your organization has connected, limited to what your Sylus role and permissions allow you to see. An answer can include tables, charts, the SQL query used, and business records that contain personal data, such as customer names or sales figures. We return only the data needed to answer the request.

How we use it. Only to answer your request, keep the integrations secure and working (for example, preventing abuse and fixing errors), and meet legal obligations. We do not use data received through the AI assistant integrations to train AI models or for advertising or profiling, and we never sell it.

How long we keep it. Request logs, including the request text and technical data, are deleted after 30 days. Access tokens are kept until you disconnect or they expire. Answers are generated from Customer Data, which is kept as described in section 8.

Disconnecting. You can disconnect Sylus at any time in your ChatGPT or Claude settings, or ask us to revoke access at privacy@sylus.ai. After you disconnect, we revoke the access token and receive no further requests. Your workspace admin controls who can use Sylus and what data each person can see, and these permissions apply in ChatGPT and Claude too.

OpenAI and Anthropic. OpenAI and Anthropic are independent from Sylus. How they handle your conversations, including the answers Sylus returns to them, is governed by the OpenAI Privacy Policy and the Anthropic Privacy Policy.

Sensitive data. Please don’t connect data sources that contain payment card data or protected health information for use through the AI assistant integrations.

5. How we use personal data

We use personal data for the following purposes, relying on the legal bases shown:

• To provide the Services, including answering questions, building dashboards and reports, and delivering scheduled reports by email or Slack (to perform our contract with you or your organization).

• To keep the Services secure, prevent fraud and abuse, and fix problems (our legitimate interests).

• To respond to enquiries, run demos and send relevant product and sales communications, which you can opt out of at any time (our legitimate interests, or your consent where required).

• To understand how the Services are used and improve them, using technical and usage data. We do not use Customer Data, or data from the AI assistant integrations, to train AI models (our legitimate interests).

• To comply with laws and respond to lawful requests from authorities (legal obligation).

6. How Sylus uses AI

To answer a question, Sylus sends the question, the context needed to interpret it (such as table and field descriptions from your data model) and relevant query results to AI model providers, currently OpenAI and Anthropic, through their business APIs. Under our agreements with them, these providers process this data only to provide their services to us and do not use it to train their models. They may keep it for a limited time for abuse monitoring, as their terms allow.

Every answer shows the SQL query behind it, so you can check how it was produced. Sylus does not make decisions that have legal or similarly significant effects on individuals based solely on automated processing.

7. How we share personal data

• Service providers that help us run Sylus, such as cloud hosting and infrastructure, AI model providers (OpenAI and Anthropic), website hosting and forms (Framer), scheduling (Cal.com), and email and customer support tools. They may use personal data only to provide services to us and must protect it. Our current list of subprocessors is available on request.

• OpenAI and Anthropic, when you use the AI assistant integrations, to deliver answers to you in ChatGPT or Claude.

• Tools you connect, such as Slack or email for scheduled reports.

• People in your organization, according to the permissions your workspace admin sets.

• Authorities or other parties when required by law, or to protect the rights, safety and security of Sylus, our users or others.

• A buyer or successor if Sylus is involved in a merger, acquisition or sale of assets, subject to this policy.

We do not sell personal data or share it for cross-context behavioral advertising.

8. How long we keep personal data

• Account information: while your account is active, and deleted within 30 days after it is closed.

• Customer Data: for as long as the Customer’s agreement is in place, and deleted within 30 days after the account is closed, unless the Customer instructs otherwise.

• AI assistant integration request logs: 30 days.

• Access tokens for the AI assistant integrations: until you disconnect or they expire.

• Website enquiries and sales records: as long as needed to respond to you and manage our relationship, or until you ask us to delete them.

Copies in encrypted backups are deleted on our normal backup cycle. We may keep some data longer where the law requires it, for example for tax or accounting records.

9. Your rights

Under the ADGM Data Protection Regulations 2021, and other laws that may apply to you such as the EU or UK GDPR and US state privacy laws, you can ask us to:

• give you access to, or a copy of, your personal data;

• correct inaccurate or incomplete data;

• delete your data;

• restrict or object to how we use it, including for direct marketing;

• send your data to you or another company in a portable format;

• withdraw your consent, where we rely on it; and

• not subject you to decisions based solely on automated processing that significantly affect you.

To make a request, email privacy@sylus.ai or use the form below. We may need to verify your identity. We respond within one month, or tell you if we need more time as the law allows. We won’t treat you differently for exercising your rights.

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the ADGM Office of Data Protection, or to the data protection authority where you live or work.

If you live in a US state with a consumer privacy law, such as California, you have the right to know, access, correct and delete your personal information. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about you.

10. International data transfers

Sylus is based in ADGM, United Arab Emirates. Our service providers, including OpenAI and Anthropic, may process personal data in other countries, including the United States and countries in the European Union. When we transfer personal data outside ADGM, the EEA or the UK, we use the safeguards required by law, such as standard contractual clauses.

11. Security

Sylus is SOC 2 Type 2 compliant. We encrypt data in transit and at rest, control access with role-based permissions and least-privilege principles, and regularly review our security controls. If a data breach affects your personal data, we will notify you and the relevant authorities as the law requires.

To report a security vulnerability, email privacy@sylus.ai with “Security” in the subject line.

12. Children

Sylus is a business service and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. We will change the “Last updated” date above and, for material changes, notify customers by email or in the product before the changes take effect.

14. Contact us

Sylus Labs Limited
Abu Dhabi Global Market, Abu Dhabi, United Arab Emirates
Email: privacy@sylus.ai

Your use of Sylus is also governed by our Terms of Service.