Who is responsible
Nyza Creations LLC (Nyza Solutions), Nyza Creations LLC, 3850 Kitsap Wy, Ste 104 PMB 1247, Bremerton, WA 98312, USA. For privacy questions, email hardiktrehan@nyza.us.
What we collect
When you use the public site
- Audit and contact forms: your name, email, business name, phone if you give it, and the answers you provide.
- The site chatbot: the messages you type. They are sent to a model provider to generate a reply.
- The voice agent: if you call or use the in-browser demo, the call audio and transcript.
- Analytics: we use Google Analytics on this site. It sets cookies and collects page views, approximate location, device and referrer.
When you have an account
- Account details: email, name, company and phone if provided, and a hash of your password (never the password itself).
- Google sign-in: if you sign in with Google we request only
openid,emailandprofile. We receive your email address, name and profile picture URL, and use them to create and identify your account. We do not receive, and never ask for, access to your Gmail, Drive or Calendar. - Billing: handled by Stripe. We store a customer and subscription identifier and the status of your plan. We never see or store your card number.
When your agents run
- What you configured: agent names, instructions, schedules, and which connections each agent may use.
- Run records: start and finish times, status, the model used, token counts and cost, the summary the agent wrote, the actions it took, and items it added to your ledger.
- Content the agent worked on: to do the job you gave it, an agent reads data through the connections you granted. What it reports back is stored with the run.
- Credentials you connect: see the next section. These are treated differently from everything else here.
Credentials you connect
API keys, tokens and passwords you add to your office are encrypted at rest with AES-256-GCM under a per-connection data key, which is itself wrapped by a master key held outside the database. They are decrypted only into the isolated environment of a single agent run, at the last possible moment.
They are never logged, never rendered back to the screen, and never written into a run transcript or report. We keep only the last few characters so you can tell two keys apart. Deleting a connection deletes our copy of the secret.
How we use it
- To provide the service: run your agents, show you their results, keep your account working.
- To respond to you, send the report you asked for, and follow up on a project you started.
- To take payment, where a paid plan or project applies.
- To keep the platform secure, diagnose failures, and prevent abuse.
- To send occasional product updates. You can unsubscribe from those at any time.
We do not sell your data, and we do not train models on it. We do not use the contents of your agent runs to improve anything other than your own service.
Who we share it with
Only the providers needed to operate the service, each for a specific purpose. They are named individually, with what they receive, on our Subprocessors page.
Model providers are worth calling out: when an agent runs, the instructions you wrote and the content it is working on are sent to the model provider you chose, using your own API key. Their handling of that data is governed by your agreement with them.
We also disclose information if legally required, or to protect our rights or someone's safety. If our business is ever sold or merged, data may transfer as part of it — you would be told before that took effect.
Where it is stored
On servers we operate in the United States, plus the providers listed on the subprocessors page. Secrets used to run the platform itself are held in Google Cloud Secret Manager. If you are outside the United States, using the service means your data is processed there.
How long we keep it
- Account data: while your account is open.
- Run records and ledger items: while your account is open, so you have a history of what your agents did. You can delete individual items.
- Connected credentials: until you delete the connection, or close the account.
- After you close your account: deleted or anonymised within 30 days, except records we must keep for legal, tax or accounting reasons.
- Enquiries and form submissions: up to 24 months, then deleted.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, or stop using it for a particular purpose. Email hardiktrehan@nyza.us and we will respond within 30 days, usually much sooner. We will not treat you differently for exercising a right.
If you are in California (CCPA/CPRA): we do not sell or share personal information as those terms are defined, and you have rights to know, delete, correct and opt out.
If you are in the EEA or UK (GDPR): our legal bases are performance of a contract (running the service you signed up for), legitimate interests (security, preventing abuse, improving the product), consent (analytics cookies and marketing email), and legal obligation. You may object, request portability, or complain to your supervisory authority.
Cookies
We set a first-party session cookie so you stay signed in — it is required for the site to work. Google Analytics sets its own cookies for measurement. We do not run third-party advertising trackers. You can block cookies in your browser; the analytics ones are safe to block, the session one is not, because signing in stops working without it.
Security
Passwords are hashed. Credentials are encrypted as described above. Agent runs execute in a hardened, isolated container as a non-root user with a read-only filesystem and no elevated capabilities, and an agent can only reach the connections you explicitly granted it. No system is perfect; if we ever have a breach affecting your data, we will tell you.
Health information
For healthcare clients on dedicated implementations, we sign a Business Associate Agreement. This public site, the chatbot, the voice demo and the Founders Office are not covered systems and must not be used to transmit protected health information unless we have a signed BAA covering that specific deployment.
Children
The service is for businesses and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe we have, email us and we will delete it.
Changes
If we change this policy materially, we will update the date at the top and tell account holders by email or in the product before it takes effect.
Contact
Nyza Creations LLC, 3850 Kitsap Wy, Ste 104 PMB 1247, Bremerton, WA 98312, USA
hardiktrehan@nyza.us