Privacy Policy

Effective September 7, 2026

Talyro is operated by OpenWeb360 OÜ (registry code EE 17499268, tax number EE103005601), a company registered in Estonia. This policy explains what data we collect, why, and the choices you have — both as a Talyro customer and as a visitor to talyro.app.

Data we collect from you

• Account data: your name and email address, and your password (stored hashed by our authentication provider, Supabase — we never see it in plain text).
• Billing data: handled directly by Stripe. We store your plan, credit balance, and payment status, but never your full card number.
• Mailbox connection: to send campaigns on your behalf, we store either an OAuth token (via Unipile) or encrypted SMTP credentials for the mailbox you connect.
• Campaign inputs: the targeting description, sender details, and any qualification criteria you provide when launching a campaign.
• Support communications: anything you send us via the contact form or email.

Data generated by using Talyro

Running a campaign on your behalf involves processing data about the leads you target:

• Lead contact data (name, business email, company, job title, LinkedIn URL) sourced from Apollo.io based on your targeting criteria — this is professional, business-context data, not sensitive personal data.
• Public company website content, retrieved via Firecrawl, used to personalize outreach and, if you enable it, to check whether a lead qualifies for your campaign.
• Email verification results from ZeroBounce, used to avoid sending to invalid addresses.
• Generated email content and replies, produced with Anthropic's Claude models from the lead and campaign data above.

For this data, you are the controller and Talyro acts as a processor on your behalf — you're responsible for having a lawful basis to contact the leads you target, and for handling any opt-out or deletion requests you receive from them.

Cookies and similar technologies

We keep this deliberately minimal:

• Strictly necessary — your login session (Supabase Auth) and your theme preference (light/dark), stored locally. These aren't optional; the app can't function without them, and no consent banner is needed for them under GDPR/ePrivacy.
• Anonymous usage counter — a single site-wide visit counter (no personal or per-visitor data, just a total), tracked once per browser session.
• Analytics & marketing — Google Analytics, Microsoft Clarity, and X (Twitter) Ads, only if you accept cookies in the banner. Declining, or not answering, means none of these load. You can change your choice anytime via "Manage cookies" in the footer.

Who we share data with

We use the following subprocessors, each only for the purpose described, and never sell your data:

• Supabase — database, authentication.
• Vercel — application hosting.
• Stripe — payment processing.
• Apollo.io — lead search and contact data.
• Unipile — mailbox connection for sending.
• ZeroBounce — email address verification.
• Firecrawl — website content retrieval for personalization.
• Anthropic — AI-generated email drafts and replies.
• Google Analytics, Microsoft Clarity, X (Twitter) Ads — only after cookie consent, as described above.

Some of these providers process data outside the EU/EEA (e.g. the United States). Where that applies, it's covered by Standard Contractual Clauses or an equivalent safeguard under GDPR.

Data retention

We keep account and campaign data for as long as your account is active, and for a reasonable period afterward to comply with legal, accounting, and anti-fraud obligations. You can request deletion of your account and associated lead data at any time — see "Your rights" below.

Security

Data is encrypted in transit (TLS) and at rest by our infrastructure providers. Access to production data is limited to what's needed to operate and support the service.

Your rights

Under GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data.
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw cookie consent at any time.
• Lodge a complaint with the Estonian Data Protection Inspectorate (AKI) or your local supervisory authority.

To exercise any of these, email us at info@openweb360.eu.

Children

Talyro is a B2B tool and is not directed at, or intended for use by, anyone under 16.

Changes to this policy

If we make material changes, we'll update the effective date above and, where appropriate, notify you directly.

Contact

OpenWeb360 OÜ · info@openweb360.eu