Privacy Policy
Your data stays with you. We only process metadata.
Last Update: April 2, 2026
Table of Contents
π IMPORTANT NOTICE
- Cayra is a cloud-based (cloud SaaS) AI data analytics platform.
- Your data (customer data) is never stored on Cayra servers - only stays in your own DB.
- Only metadata (query logs, schema information) is stored for 30 days and automatically deleted.
WHO WE ARE
CAYRA ARTIFICIAL INTELLIGENCE TECHNOLOGIES INC.
Trade Registry No: 536999
Tax No: 2030912417
MERSIS No: 0203091241700001
Ankara, Teknokent Incubation
hello@cayra.io
privacy@cayra.io
CAYRA ARCHITECTURE: CUSTOMER DATA NEVER STORED
Cayra, as a cloud-based (cloud SaaS) AI data analytics platform, never stores, processes, or transfers customer data. Only metadata (query logs, schema) is stored for 30 days.
Architecture Flow
YOU
β Query: 'What are last month's sales?'
β CAYRA CLOUD (Generate SQL with AI)
β’ Schema analysis β (store 30 days)
β’ Write SQL β (with AI)
β’ Store customer data? β NEVER
β Response: 'SELECT * FROM...'
β Runs on your database (Cayra never accesses data)
Conclusion: Zero Risk for Customer Data
- β Customer Data: 100% Stays with You (Cayra never sees it)
- β At Cayra: Only metadata (query logs, schema) for 30 days
- β Breach: Impossible (no customer data)
WHERE IS YOUR DATA STORED?
| Data Type | Your Data (Customer Data) | Stored in Cayra Cloud | Retention Period |
|---|---|---|---|
| Customer Data (DB content) | In your database (AWS, Azure, On-Premise, etc.) | β Never stored | Forever (under your control) |
| Query Metadata (query logs) | Cayra Cloud (AWS EU/TR regions) | β Stored | 30 days (auto-deleted) |
| Schema Metadata (table/column names) | Cayra Cloud (AWS EU/TR regions) | β Stored | 30 days (auto-deleted) |
| Account Information (email, username) | Cayra Cloud (AWS EU/TR regions) | β Stored | Until account deletion |
Guaranteed: Your actual customer data (database content, query results) never reaches Cayra cloud servers.
DATA PROCESSED AT CAYRA (METADATA ONLY)
Only metadata is processed at Cayra. Your actual database data is never processed.
A. Account Information
Data: Email, Username, Password (hashed)
Purpose: Authentication, security
Retention: As long as account is active
Encryption: bcrypt (Argon2)
B. Database Schema (Metadata)
Data: Table names, Column names, Data types
β Example: users (id INT, name VARCHAR, email VARCHAR)
β NOT: Actual data (user@example.com)
Purpose: SQL generation, schema optimization
Retention: 30 days (then automatically deleted)
Legal Basis: KVKK Art. 8(b) - Contract Performance
C. User Queries (Natural Language)
Data: Written question
β Example: 'What are last month's sales?'
β NOT: Database data
Purpose: SQL generation, AI model development (after anonymization)
Retention: 7 days (personalized), 90 days (after anonymization - optional)
Note: Explicit consent required for AI training
D. Technical Logs
Data: IP address, Browser type, Session duration, API response time
Purpose: Debugging, performance, security
Retention: 365 days (1 year) - Legal requirement
Legal Basis: Law No. 5651 Art. 6/b (Traffic information)
AI MODELS: OPENAI AND ANTHROPIC (ZERO RETENTION)
Cayra uses artificial intelligence for SQL generation. Important: OpenAI and Anthropic do not train models with data sent by Cayra (Zero Retention Policy).
πΉ WHAT IS SENT?
- β Query (natural language): 'What are last month's sales?'
- β Schema metadata: 'revenue: INT, date: DATE, product: VARCHAR'
- β Database connection type (PostgreSQL, MySQL, etc.)
πΉ WHAT IS NOT SENT?
- β Actual Customer Data: 100, 2025-01-01, 'Product A' (never!)
- β Query results (result set)
- β Sensitive Information, personal data
πΉ OPENAI POLICY
Region: USA (API endpoint)
Retention: Zero Retention (Cayra Enterprise agreement)
Model Training: No - Our data is not used for model training
Privacy PolicyπΉ ANTHROPIC CLAUDE POLICY
Region: USA (API endpoint)
Retention: Zero Retention (not stored except API abuse prevention)
Model Training: No - Our data is not used for model training
Privacy PolicyπΉ CONTROL
- You can choose which AI to use via platform
- You can monitor token consumption in real-time
- Enterprise customers can use their own AI endpoints
USER RIGHTS (VERY SIMPLE)
Since your data stays with you, the rights are quite simple:
1. Right of Access
Learn what is stored about you at Cayra
Request: privacy@cayra.io
2. Right to Rectification
Correct incorrect or incomplete information
Request: privacy@cayra.io
3. Right to Deletion (Right to be Forgotten)
Delete your account and all your metadata
Request: privacy@cayra.io
Processing Time: 30 days (KVKK Art. 13)
4. Right to Data Portability
Export your data (JSON, CSV, SQL dump)
Request: privacy@cayra.io
5. Right to Object
Object to data processing
Request: privacy@cayra.io
6. Processing Restriction
Request restriction of certain data processing
Request: privacy@cayra.io
Cost: ZERO (Free)
DATA RETENTION PERIODS
| Data Type | Retention Period | What Happens After | Reason |
|---|---|---|---|
| Query (natural language) | 7 days | Automatically deleted | SQL optimization |
| Schema | 30 days | Automatically deleted | Debugging |
| Technical Logs | 365 days | Automatically deleted | Legal (Law No. 5651) |
| Account Information | Until account deletion | Permanent deletion | KVKK Art. 11 |
| Anonymous Queries* | 90 days | Automatically deleted | AI model training |
*With consent and can be disabled
LIABILITY IN CLOUD SERVICE
Cloud SaaS Deployment
- Customer Data: Never comes to Cayra (in your DB)
- Metadata: 30 days in Cayra cloud (auto-deleted)
- Control: Metadata at Cayra, customer data 100% yours
- Privacy: High (no data content, only metadata)
- Liability: Maximum amount paid in last 12 months (or 10,000 USD - whichever less)
Data Security
- Encryption: TLS 1.3 (transit) + AES-256 (rest)
- Location: AWS EU/TR regions (GDPR compliant)
- Backup: Automatic, encrypted
- Access: Role-based, logged
CAUTIOUS USE IN PRODUCTION ENVIRONMENT
π¨ IMPORTANT: If you are using AI-generated SQL in production, absolutely follow these 6 steps:
1. Review SQL
Have a human review the query written by AI
2. Run in Test Environment
In read-only mode
3. DBA Approval
Show to database administrator
4. Take Backup
Take full database backup
5. Rollback Plan
How will it be rolled back in case of error?
6. Monitoring
Monitor performance after running
If this is not done and an error occurs:
- β Cayra is NOT responsible
- β User is responsible
LEGAL COMPLIANCE
KVKK (Turkey)
β Full Compliance
Articles: Art. 4, Art. 8, Art. 12, Art. 13
GDPR (European Union)
β Full Compliance
Articles: Art. 6, Art. 7, Art. 32
Law No. 5651 (Internet)
β Compliant
Traffic logs are kept
Turkish Tax Law
β Compliant
10 years invoice retention
POLICY CHANGES
- Important changes: Announced 30 days in advance
- Current version: Always published on website
- Email notification: Registered accounts
CONTACT
General Questions
hello@cayra.io
Privacy / KVKK Application
privacy@cayra.io
Response Times
KVKK Requests: Within 30 days
Urgent (5651): Within 24 hours
FAQ (Frequently Asked Questions)
Q: Is my data stored at Cayra?
No. Cayra processes schema and queries. Actual data stays in your own database.
Q: Do you send queries to OpenAI?
We send the query and schema. We never send data. For example: 'Sales' + 'INT' is sent, '100, 200' is not sent.
Q: Is my data encrypted?
Since data is in your infrastructure, your encryption policy applies. Cayra's communication is encrypted with TLS 1.3.
Q: Is it GDPR/KVKK compliant?
Yes. Since data is not at Cayra, compliance is much easier. Almost zero risk when using on-premise.
Q: Is my data transferred abroad?
If you choose On-Premise: No. If you choose Cloud: Only schema and query (not data) are transferred to USA.
Q: What is the difference between On-Premise and Cloud?
On-Premise: All software and data on your servers. Data never leaves. Cloud: Runs on Cayra servers, metadata stored for 30 days. On-premise deployment is strongly recommended for production.
Q: Does data go out for AI training?
Only if you give consent and only anonymized queries are sent. Actual data is never sent. You can withdraw your consent at any time.
Q: How long is my data stored?
Query history: 7 days, Schema: 30 days, Technical logs: 365 days (legal requirement), Account information: Until account deletion. All are automatically deleted.
Q: Can I see my query history?
Yes. Under your KVKK right of access, you can request it at privacy@cayra.io. It will be sent in JSON/CSV format within 30 days.
Q: Can I connect multiple databases?
Yes. Cayra supports multiple database connections. Separate schema analysis is performed for each. Data still stays in your infrastructure.
Q: What happens if I withdraw my consent?
If you withdraw consent for AI training, your anonymized queries will no longer be used for AI model training. You can easily do this from Account > Privacy > Cookie Preferences.
Q: Is it CCPA/SOC 2 compliant?
In On-Premise deployment, since data is in your infrastructure, your SOC 2 certificate applies. Cayra meets CCPA requirements (no data sale, transparency exists).
Q: Is there a risk of my data being handed over in exceptional circumstances?
On-Premise: Since data is not at Cayra, there is nothing to hand over. Cloud: Only metadata exists, can be handed over under legal obligation if requested by court order (KVKK Art. 5/2-c).
Q: Do you perform penetration testing?
Yes. Regular penetration tests are performed (minimum once per year). Security vulnerabilities are immediately closed and users are notified if necessary.
Q: How about admin password in On-Premise?
In On-Premise deployment, all management is under your control. Admin passwords are managed according to your security standards. Cayra provides password policy recommendations.
CONTACT
General Questions
hello@cayra.io
Privacy / KVKK Application
privacy@cayra.io