Privacy Policy

1Two roles we play

• For account, billing, website, sales, and marketing data, Cycle decides how and why the data is processed (we act as the data controller). That is what this policy covers.
• For the content our customers process through the Service — repository contents, NetSuite File Cabinet files and SDF objects, and query results — we act on our customer's instructions under our Terms of Service, which contain our data-processing commitments (Section 9 of the Terms). If your data appears in a customer's workspace (for example, you are a developer whose commits are synced), the workspace owner controls that data — contact them first; we will support their instructions.

2Information we collect

Account and profile. Name, email address, profile image, and workspace membership — including the name and image chosen for the workspace itself. Authentication is passwordless: we store passkey public keys (WebAuthn), one-time codes sent by email, and/or the account identifiers provided by the sign-in provider you choose (Google, GitHub, GitLab, or Bitbucket). We do not store passwords.

Billing. Billing contact, company name, billing address, and tax ID, processed with Stripe. Card numbers are held by Stripe, not by us. We store Stripe customer and subscription identifiers and payment status.

Connections. Credentials and certificates for the NetSuite accounts and Git repositories a workspace connects. These are stored encrypted at rest and are used only to operate the connection.

Operational records. Deployment and synchronization history and logs (including commit identifiers, commit titles, and committer names from connected repositories, and the name of the NetSuite user who last changed or deleted a file), configuration (branch mappings and other workspace settings), sync issue records, and webhook delivery records (which can include committer emails contained in the payload).

Customer code and files. The code and customizations the Service synchronizes live in your Git repository and your NetSuite account, not with us. We process file contents to operate synchronization and deployments, and keep temporary copies (caches) to compute and compare changes; these are transient operational copies, not a system of record.

Session and security. IP address, browser/user-agent, approximate location (country) and network (ASN) for sessions, and anti-abuse signals from Cloudflare Turnstile. To detect unusual sign-ins, we also keep a history of the devices used with each account (for example, browser, operating system, the countries and networks seen, and when each was used).

Support, website, and email. Messages you send us, and delivery/engagement metadata for email we send. This includes requests submitted on cycle.sh: what you tell us (for example, the number of NetSuite environments or the plan you asked about) and the country, network, and browser the request comes from. The IP address is stored only as a salted hash, to limit repeated submissions. If we give you access to the Cycle portal (cycle.sh/portal), we also collect your email address and how you use the portal (for example, which videos you watch).

How you found us. When you first visit cycle.sh, your browser keeps a note of how you got there (for example, the link's campaign tags, the referring website, and the first page you saw). It stays on your device and reaches us only with a form you submit.

Application details. If we invite you to complete an application after a request, we collect what you tell us about your role, your company, your NetSuite setup, and your project (for example, your website, NetSuite account ID, team, timeline, and how you heard about us). To confirm that a NetSuite account ID exists and how many sandbox accounts it has, we look up their public DNS names; we do not connect to the account. We rate each application from its answers and the domain of your email address, to decide how to follow up.

Public business information. To find and evaluate potential customers, including people who contact us, we collect business contact details (for example, name, job title, company, and work email) from public sources such as company websites and professional networks, and from data enrichment providers, and record them in our customer relationship management system (CRM).

Cookies. We use only cookies that are necessary for the Service and cycle.sh to work (session/authentication, security). We do not use advertising or third-party analytics cookies. If that changes, we will update this policy and, where required, ask for consent. The "How you found us" note is kept in your browser's local storage, not in a cookie, and does not follow you on other websites. We do not track you across other websites, so we do not respond differently to browser Do Not Track signals.

3What we do NOT do

• We do not sell personal data, and we do not share it for advertising.
• We do not use your content or your data to train AI or machine-learning models (and will not without prior written permission from the customer).
• We do not read or modify our customers' NetSuite business records on our own initiative. Automated operations cover File Cabinet contents and SDF objects — including installing and automatically updating the Cycle Components in the account (a source-code file plus the script and deployment records that register it), as authorized in the Terms (Sections 3.2 and 3.3) — and anything else happens only at the customer's direction.

4How we use information

To provide and operate the Service (including executing the workflows customers configure); to secure it (authentication, abuse prevention, audit); to bill and manage subscriptions; to send transactional and service email (delivered via Amazon SES); to respond to requests submitted on cycle.sh and measure which channels bring them; to find, evaluate, and contact potential customers; to send marketing email (Section 10); to provide support; to improve the Service using aggregated, anonymized usage information; and to comply with law.

5AI assistants (MCP)

Customers can connect their own AI assistant to the Cycle MCP server. When they do, data the assistant reads — including query results from the customer's NetSuite account — flows to the customer's AI provider under the customer's own agreement with that provider. Cycle does not send customer content to AI providers on its own initiative.

6When we share information

Service providers (subprocessors). We use a small set of vendors to run the Service and our business (hosting, edge network and storage, video hosting, payments, email, telemetry, customer relationship management, data enrichment, team messaging, and source-platform APIs). The current list is published at cycle.sh/subprocessors. We announce new subprocessors as described on that page. These vendors process data only to provide their service to us.

Workspace members. Activity in a workspace (for example, deployment history) is visible to that workspace's authorized members.

Legal. We may disclose information if required by law or to protect the Service, our customers, or the public, and — if Cycle is involved in a merger, acquisition, or asset sale — to the parties of that transaction under confidentiality.

7Where data is processed

Data is stored on infrastructure in the United States (primarily the New York region). If you use the Service from outside the U.S., you are transferring data to the U.S., where laws may differ from those of your jurisdiction.

8Security

We maintain commercially reasonable safeguards, including: encryption in transit (TLS); field-level AES-256 encryption at rest for Connected Account credentials; database storage encrypted at rest by our managed database provider; passwordless authentication (passkeys, email codes, OAuth); rate limiting, WAF, and bot protection; hardened container images with regular updates and vulnerability scanning; software testing at critical points; and deployment execution in isolated, ephemeral environments. Internal access to customer data is restricted to authorized personnel of Cycle and its affiliates who need it to operate and support the Service. No method of transmission or storage is completely secure; we cannot guarantee absolute security. If an incident requires notice, we will notify affected customers without undue delay (see Terms, Section 9.7).

9Retention

We keep account and workspace data while the account is active. After account closure, we delete it within 30 days and from backups within 90 days, except where the law requires longer retention (for example, billing records for tax purposes). Transient processing artifacts (queues, and caches used to move and compare files during synchronization) are short-lived by design: in-memory cache entries expire within hours, and any spillover storage is cleaned up within days by automatic expiration rules.

Messages you send us (including requests submitted on cycle.sh), application answers, records of your access to the Cycle portal and how you use it, and CRM records are kept, including after account closure, while you are a customer or a potential customer, unless you ask us to delete them sooner at privacy@cycle.sh.

10Your choices and rights

• Access, correction, deletion. Email privacy@cycle.sh to request a copy, correction, or deletion of your personal data. If the data belongs to a customer's workspace, we will route the request through the workspace owner, consistent with our Terms.
• Account closure. Closing the account triggers the retention schedule in Section 9.
• Email. Transactional and service email is part of operating the Service. Marketing email includes an unsubscribe link, and you can ask us to stop contacting you at privacy@cycle.sh; neither stops transactional and service email.
• Local law. Where a data-protection law applies to Cycle's processing of your personal data, we will honor requests that are valid under that law. This policy does not grant rights beyond those that applicable law requires.

11Business use; children

The Service is for business use and is not directed to consumers or to anyone under 18. We do not knowingly collect data from children.

12Changes to this policy

We will post updates at cycle.sh/privacy with a new effective date. For material changes, we publish the new version at cycle.sh/upcoming and notify every user of the Service by email and/or in-app notice at least 30 days before it takes effect.

13Contact

Midware Networks LLC · 8 The Green, Ste B, Dover, DE 19901, United States.

Privacy requests: privacy@cycle.sh · Legal notices: legal@cycle.sh