What we keep, and who sees it.

Who we are

Kyros Company LLC is a Virginia LLC. We build websites for shops. This site is kyros-co.com. Public email is info@kyros-co.com — that is the main way to reach us.

Why this page exists

The Virginia Consumer Data Protection Act (VCDPA) currently applies only if you process 100,000 consumers in a year, or 25,000 consumers and make more than half of your revenue selling personal data. Kyros does not sell personal data, and we are far under those numbers. VCDPA does not currently apply to us.

We publish this because the form and accounts collect personal information. This is not a claim that we are certified under VCDPA, GDPR, CCPA, or any other law. If you live in the EU or California and write in to see, fix, or delete what we have, we will still do that. Email info@kyros-co.com.

What we collect

When you send the public form or create an account, we ask for:

• business name
• contact name
• phone
• email
• what you need
• optional current website URL

Customer accounts also keep a login (email and a hashed password), notes, chat, project status, photos you send, and subscription or plan choices.

The public form creates a lead in our private staff CRM. That CRM is not a public page. Staff use it to quote, build, and reply.

We also keep first-party counts of which public pages were opened (path and day), for staff Analytics only. Those counts are not tied to your name or email.

We also keep first-party traffic-source notes on our own servers (the browser referrer and campaign tags on our links, like UTM, when present) so staff can see whether visits came from an ad link, search, social, another link, or direct. Still not Google Analytics. No ads pixels. Path, day, and source notes are not tied to your name or email.

We do not estimate or store ages from site visits. Kyros Analytics does not invent age groups.

We also keep a country code and, when available, a region/state code for visits (from Cloudflare’s edge headers) for staff Analytics. We do not store full IP addresses for Analytics, and we do not keep city or precise location.

Why we use it

To quote the work, build the site, send invoices, and reply. We do not sell or rent personal data. We do not put you on a marketing list.

We keep first-party visit counts on our own servers — which pages were opened, traffic-source notes (the browser referrer and campaign tags on our links, like UTM, when present), and totals for forms, signups, and tickets. That is for our CRM so we can see what the site is doing. It is not Google Analytics. There are no ads pixels or marketing trackers. We do not sell this data.

Email

There is no marketing list. Quotes, invoices, account invites, and approve links are job-related mail. That is transactional, not ads. We will not send ads email unless you later ask. Job emails that are purely transactional (quotes, invoices, receipts, password resets) do not include a postal address. Ads or other commercial mail will include our mailing address and an unsubscribe.

Phone

We may ask for a phone number as contact info. We reach you by email at info@kyros-co.com. We do not call.

Photos and copy

Photos, logos, and copy you send are used to build the site you hired. We do not put them in our ads without asking.

Who we share with

We use a few companies to run the shop. They see what they need to do their job:

• Authorize.net (primary) and Square (backup). Card invoices may be paid through one of them when that invoice is issued. Kyros does not store full card numbers.
• Resend sends mail as info@kyros-co.com.
• Inbound mail to that address is Google Workspace (Gmail).
• Render hosts the app and the Postgres database.
• Cloudflare handles DNS and the CDN.

We don’t sell the list. We don’t rent it. We don’t hand it to a broker.

Cookies

Page-view, traffic-source, and country/region-code counts come from our own server when a public page is requested (path, day, the browser referrer, campaign tags on our links like UTM when present, and a country code plus, when available, a region/state code from Cloudflare’s edge headers when present). There is no extra analytics cookie and no third-party analytics script in the browser. Form, signup, and ticket totals come from the same shop records we already keep to do the work.

Type on the pages is served from this site. We do not load Google Fonts from Google for this site’s type.

We set one cookie ourselves: a first-party session cookie named kyros when you visit, even before you log in. It is HttpOnly, SameSite=Lax, and Secure on the live host. It supports the session and security — including staying logged in after you sign in. It is strictly necessary, so we do not show a cookie banner for it.

When you send the Write us form, our security provider Cloudflare may run a quick check and set a short-lived security cookie. It isn’t used for ads or tracking.

Payments

Invoices may be paid through Authorize.net (primary) or Square (backup) when that invoice is issued. You pay on that processor’s page. Kyros does not store full card numbers. Name, email, and what the invoice is for stay on our side so we can match the payment to the job.

When you type a card on Authorize.net’s or Square’s page, that company’s own privacy notice and terms apply to that card entry. Square’s privacy notice and terms are on their site. Authorize.net’s own privacy notice and terms of use apply on theirs.

How long we keep it

We keep a customer record while the job or account is active, and a reasonable time after for invoices and taxes. If you ask us to delete it, we will when we legally can. Staff can delete a customer record.

If a job is denied or closed, chat on the account may lock. Email still works. Write info@kyros-co.com.

See, fix, or delete

Email info@kyros-co.com. Tell us what you want: a copy of what we have, a correction, or a deletion. A person reads it. There is no self-serve download button.

We aim to answer those emails within 45 days. That is a target, not a ticket SLA. If you live in the EU or California, you can still write in the same way. We are not claiming GDPR or CCPA certification.

We don’t sell your data

Kyros does not sell or rent personal data. We use it to quote, build, bill, and reply.

Children

This site is for shop owners. It is not directed at children under 13. We don’t knowingly collect kids’ data. If a child sent us something, email us and we will delete it.

Security

The site runs over HTTPS. Passwords are hashed, not stored in plain text. Staff pages sit behind a gate. We do not claim SOC 2 or any other audit badge.

If we learn of a security incident that affects you, we will email the address on file.

Complaints

If you have a complaint about how we handle your information, email info@kyros-co.com. You can also write the Virginia Office of the Attorney General, Consumer Protection: https://www.oag.state.va.us/consumer-protection/.

Virginia law

Virginia law governs this notice.

Changes to this page

If this notice changes, we will update the date at the top. The current version is the one on this URL.