← Back to Corlyn

Privacy Policy

Last updated: 14 October 2026

This policy explains what personal information Corlyn collects, why, who it's shared with, and your choices. Corlyn (the website, web app and desktop app) is operated by Santu Deola, a sole proprietor based in Nepal (“we”, “us”). We are responsible for your personal information. Contact: corlynapp@gmail.com.

1. What we collect

• Account details. Your name, username and email address. If you sign up with email, you also set a password, which is stored only as a secure hash. We can never see it.
• Google sign-in. If you continue with Google, Google shares your name, email address and profile picture link with us. We never receive your Google password.
• Your office. Your chosen avatar and dark or light mode, so your office is the same on every device.
• Purchases. When you buy a plan, Paddle (our payment reseller) collects your payment details. We receive your name, email, country, what you bought and your subscription status. We never see or store your full card number.
• Technical data. Our sign-in and hosting providers automatically record basic technical information such as your IP address, browser or device type, and sign-in times. This keeps accounts secure and the Service working.
• Questions to Sam. What you ask Sam, our AI analyst, is sent to our server and, through OpenRouter, to Anthropic's Claude AI service (or Google's Gemini when Claude is busy) to work out the answer. We don't store the text of your questions or Sam's answers. We keep a record of each question's date, the credits it used, which AI model answered, how much processing it took, and which of Sam's data tools it used, to count your allowance and manage costs. Conversations are shown only in your browser or app and start fresh when you reload.
• Work with Alex. What you ask Alex, our AI engineer, and anything you attach (images, files, PDFs or folders) is sent to our server and, through OpenRouter, to Anthropic's Claude AI service to build your website. We save each project to your account: its files (including images you attached, or Maya's images he added), your conversation with him about it, and copies of its last 10 versions so you can undo. We also keep a record of each call to the AI: its date, the credits it used, the AI model, how much processing it took and what it cost.
• Work with Maya. What you ask Maya, our AI designer, and images you attach are sent to our server and, through OpenRouter, to Anthropic's Claude AI service (which plans the design) and to OpenAI's image service (which makes or edits the image). We save the images she makes, your conversation with her (the last 60 messages), and your brand kit if you give her one (your brand's name, colours, fonts, style, notes and logo). We keep a record of each message and image: its date, the credits it used, the AI model and what it cost.
• Work with Jason. What you ask Jason, our AI ad designer, and anything you attach (images, video clips, files or folders) is sent to our server and, through OpenRouter, to Anthropic's Claude AI service, which plans each video and ad and writes their text; ad images are made by OpenAI's image service. To know your product, Jason also reads what the team made for you: Alex's projects (their pages and your conversation with Alex), Maya's images and your brand kit. In the desktop app, screenshots of your newest Alex sites are taken on your computer and uploaded for Jason to use. We save his videos (as plans, not video files), his ads with their text, the screenshots, photos and clips he works from, and your conversation with him (the last 60 messages). Text from files and folders you attach is sent with that message and not stored. Video files are made on your computer and aren't uploaded. He uses the same brand kit as Maya, and can add to it when you tell him about your brand. We keep a record of each message, ad and video: its date, the credits it used, the AI model and what it cost.
• Other AI teammates. Teammates shown as “coming soon” don't take requests yet, so nothing you do with them is sent or saved.
• Business data you connect to Sam. See section 2.
• Support. If you email us, we keep the emails so we can help you.

2. Business data you connect to Sam

Sam answers questions about your business from data you choose to connect. For this data, we act on your behalf: you decide what to connect, and we use it only to answer your questions. You're responsible for having the right to share it with us, and for telling your own customers and website visitors about it where the law requires (for example, in your own privacy policy).

• Stripe. You give us a restricted, read-only Stripe key. We store it encrypted and use it only to read your payments, refunds, customers, subscriptions and balance every few hours. It can't move money or change anything in your account. We don't store your Stripe records. We turn them into daily totals (such as revenue, refunds and new customers), your monthly recurring revenue, your balance, and a list of your 10 biggest customers from the last 90 days (their name or email, and how much they paid).
• Spreadsheets. The file is read on your own device. Only the date, amount and (if you pick one) customer column of each row is sent to us. We keep daily totals and your 10 biggest customers from the last 90 days, not the file or its rows.
• Your website. If you add the Corlyn snippet to your site, it reports each page view: the page's address, the site the visitor came from (such as Google or Instagram), and whether they're on a phone, tablet or computer, plus events you choose to send (such as a sign-up). It uses no cookies and stores nothing on your visitors' devices. To count unique visitors, we combine the visitor's IP address and browser details with a random value that changes every day, and keep only the resulting code. We never store the IP address or browser details, and we delete the daily codes after two days, so they can't be traced back to anyone. We keep daily counts per page, traffic source, device and event.
• Sample data. “Try with sample data” adds a made-up business. It contains no real people.

When you ask Sam a question, only the finished numbers needed for that answer (for example, “revenue this week: $4,210” or a top-customer list) are sent to the AI service (through OpenRouter). Your Stripe key, spreadsheet files and raw records are never sent to the AI. We don't use your business data to train AI models, and we don't use it for anything except answering you.

You can remove a connected source at any time in Sam's data. This deletes its stored numbers and, for Stripe, its key straight away. You can also revoke the key in your Stripe dashboard.

3. Why we use it

• To create your account, sign you in, and keep it secure (needed to provide the Service).
• To answer your questions to Sam from the data you connect, build websites with Alex, make images with Maya and videos and ads with Jason, save your projects, images, videos, ads, screenshots and brand kit, and count your monthly allowances (needed to provide the Service).
• To save your office and show it on any device you sign in on (needed to provide the Service).
• To process purchases, subscriptions, refunds and invoices through Paddle (needed for our contract with you, and for tax and accounting law).
• To reply to support requests and send important account or billing messages (needed to provide the Service).
• To prevent fraud and abuse, and fix problems (our legitimate interest in keeping the Service safe and working).

We don't sell your personal information. We don't use it for advertising. We don't use tracking or advertising cookies.

4. Who we share it with

Only with service providers that help us run Corlyn, and only what they need:

• Supabase: accounts, sign-in, database, file storage and server hosting (stores your account, your office, Sam's data, Alex's projects, Maya's images, Jason's videos, ads, screenshots and clips, your conversations with them, your brand kit, and your allowances).
• OpenRouter: the gateway that passes every AI request to the AI providers below and returns their answers. It receives the same content those providers do. We haven't turned on OpenRouter's optional prompt logging, so it doesn't keep the content of requests, only details such as the time, the AI model and the cost. See OpenRouter's privacy policy.
• Anthropic: the provider of Claude, the AI service behind Alex and Sam, and behind how Maya and Jason read your requests, plan each design and write Jason's videos and ad text. Claude receives your messages, recent conversation, attached files and images, (for Alex) your project's files, (for Jason) the parts of your team's work he looks at, and (for Sam) the numbers needed to answer. Under Anthropic's commercial terms, it doesn't use this content to train its models, and keeps it only for a limited time for safety and abuse monitoring. See Anthropic's commercial terms.
• OpenAI: the provider of the image service Maya and Jason use to draw and edit images. It receives their written brief for each image and, when editing, the images being edited (your attachments, your logo, or an image they made). Under OpenAI's API terms, it doesn't use this content to train its models, and keeps it only for a limited time for safety and abuse monitoring. See OpenAI's privacy policy.
• Google: if you choose to sign in with Google, and as the provider of Gemini, the backup AI service that writes Sam's answers when Claude is busy. Gemini then receives your question, recent conversation and the numbers needed to answer it. Requests go to Google's paid Gemini API, under which Google doesn't use this content to improve its products. See Google's Gemini API terms.
• Stripe: only if you connect your Stripe account to Sam. We read from your account with the key you give us. We don't send your data to Stripe.
• Paddle.com: our online reseller and Merchant of Record, which handles checkout, payments, tax, invoices and refunds. See Paddle's privacy notice.
• Cloudflare: hosts and delivers this website, and counts visits to it with Cloudflare Web Analytics. The analytics use no cookies and store nothing on your device; they record the page, the site you came from, your country and your type of device and browser, without identifying you. See Cloudflare's privacy policy.
• Content delivery: jsDelivr (serves a sign-in code library) and Google Fonts (serves the site's fonts). These receive your IP address when your browser loads the site.

We may also disclose information if the law requires it, or to protect the rights and safety of our users or ourselves.

5. International transfers

Our providers may store and process information in countries outside the one you live in, including the United States and the European Union. When that happens, we rely on those providers' safeguards, such as standard contractual clauses, to protect it.

6. How long we keep it

• Account and office data: while your account exists. It's deleted within 30 days after you ask us to delete your account.
• Sam's data (daily totals, top customers, your Stripe key): until you remove that source in Sam's data, or delete your account. Removing a source deletes it straight away.
• Website visitor codes (for counting unique visitors): two days. The daily page, source and device counts are kept like other Sam data.
• Alex's projects (files, conversation and undo versions): until you delete the project, or your account.
• Maya's images: until you delete them, or your account. Each plan keeps a set number of images (30 on the free plan); past that, the oldest are removed to make room.
• Jason's videos, ads and their text: until you delete them, or your account. Each plan keeps a set number; past that, the oldest are removed to make room.
• Screenshots, photos and clips Jason works from: until you delete your account, or a newer screenshot of the same page replaces one. Each plan keeps a set number (200 on Jason Pro, 500 on Pro+); past that, the oldest are removed.
• Your conversations with Maya and Jason: until you choose Clear conversation, or delete your account. Only the last 60 messages with each are kept.
• Your brand kit: until you choose Forget in Maya's or Jason's panel, or delete your account.
• Records of questions, builds, messages and images (date, credits, model, usage, cost): while your account exists.
• Purchase and invoice records: as long as tax and accounting laws require, usually up to 7 years. Paddle keeps its own records as Merchant of Record.
• Support emails: up to 2 years after the conversation ends.
• Technical logs: kept by our providers for a short period, typically days to weeks.

7. Storage on your device

The Service stores a few things in your browser's or app's local storage: your sign-in session, a copy of your account name, your office settings and small preferences (such as Maya's and Jason's image quality), so the office opens quickly. This is needed for the Service to work, and it isn't used for tracking. Logging out removes your session from that device.

8. Your rights

Depending on the data protection laws where you live, you can ask us to:

• give you a copy of your personal information;
• correct information that's wrong;
• delete your account and personal information;
• restrict or object to how we use it, or give it to you in a portable format.

Email corlynapp@gmail.com from your account's email address. We'll reply within 30 days. You can also complain to the data protection authority where you live.

9. Security

We use trusted providers, encrypted connections (HTTPS), hashed passwords, and database rules that let each account read only its own data. Stripe keys you connect to Sam are encrypted before they're stored. Sam's data, Alex's projects, Maya's images, Jason's videos, ads and uploads and your brand kit can only be read by our server, never directly from a browser; images are kept in private storage and shown to you through links that expire. No system is completely secure, but we work to protect your information and will tell you if a breach affects you, as the law requires.

10. Children

Corlyn isn't meant for anyone under 16, and we don't knowingly collect information from them. If you think a child has given us information, contact us and we'll delete it.

11. Changes to this policy

We may update this policy. We'll post the new version here with a new “Last updated” date. If the changes are significant, we'll tell you by email or in the Service.

12. Contact

Santu Deola, Nepal (Corlyn). Email: corlynapp@gmail.com.