Privacy at LyraShield AI

Data we process

The dashboard processes account, workspace membership, integration, scan, finding, evidence, approval and audit records needed to provide the launch gate. OAuth stores client, consent, refresh-token and access-token records; tokens are not placed in prompts or configuration snippets.

Agent connections

Hosted MCP requests carry a short-lived OAuth bearer or an API key. Each OAuth connection is bound to one workspace. We record privacy-safe connection and error events without token values, prompts, targets, findings or report contents.

Cookies and browser storage

The marketing site sets a first-party cookie to remember your light/dark theme choice; it carries no identifier and is not used for tracking. The dashboard sets the session cookie needed to keep you signed in. Analytics preferences use a first-party lyrashield-analytics cookie with an on/off value for up to 180 days; on the canonical marketing and app hosts, that preference is shared between those hosts. When you follow a campaign or referral link into sign-up, first-party cookies can hold bounded campaign or referral tokens for up to 30 days, until they are claimed or expire. Turning analytics off expires pending acquisition, referral-capture and scorecard-visitor cookies; it does not delete sign-in/theme cookies or change an already-qualified referral reward. PostHog uses first-party browser storage while optional analytics are enabled. We do not use third-party advertising cookies.

Analytics

We use privacy-bounded product analytics (PostHog) on the marketing site and dashboard to understand feature usage and improve the product. Optional analytics are enabled by default for anonymous visitors and signed-in accounts unless a browser preference or privacy signal disables them. An authenticated account preference is stored with the account and applies across devices; the browser control applies to that browser and is shared between the canonical marketing and app hosts. Do Not Track and Global Privacy Control always take precedence and stop optional collection. If an authenticated preference cannot be checked, optional event capture waits. Autocapture and session recording are disabled, and recorded page URLs omit query strings and fragments.

Bot verification

The free public Lite Check uses Cloudflare Turnstile to distinguish real visitors from automated abuse before running a scan. Turnstile is loaded from Cloudflare and operates under Cloudflare's own privacy terms; we do not receive raw biometric or device-fingerprint data from it, only a pass/fail verification result.

Myra, the AI support assistant

Myra uses Azure OpenAI when the Azure provider is enabled for a deployment. In that configuration, messages and the service context needed to answer them are processed by Microsoft Azure OpenAI through LyraShield's configured Azure endpoint. Myra conversation records are retained for 30 days. Support cases and their related replies are retained for 365 days after case creation. Demo-booking records are retained for 365 days after creation. Canceled bookings with an outstanding calendar-event cancellation remain until provider cleanup succeeds. Myra audit events are retained for 90 days after creation, then removed by the scheduled retention job.

Who else processes data on our behalf

We use third-party service providers to run LyraShield: cloud hosting and content delivery, the OAuth identity providers you choose to connect, the analytics and bot-verification providers named above and email delivery for account and support messages. Each is used only to provide the service, under its own applicable terms and none is authorized to use your data for its own purposes.

Retention and sharing

Customer records are retained according to the account and service configuration. Public scorecards are explicitly privacy-bounded. We do not sell customer data.

International users

LyraShield is available globally and the service providers above may process data in countries other than your own. If you are in the European Economic Area, the United Kingdom or another jurisdiction with its own transfer requirements, we take reasonable steps to ensure any such transfer is protected consistent with applicable law.

Children's privacy

LyraShield is a developer tool intended for professional and business use. It is not directed at children and we do not knowingly collect personal information from anyone under 16.

Your choices

You can disconnect OAuth clients, revoke tokens, delete API keys and request account or workspace deletion through the dashboard or support@lyrashieldai.com. Use the control below to turn optional analytics off or on in this browser. In dashboard settings, you can also change the account preference that applies across devices. Do Not Track and Global Privacy Control always stop optional collection and cannot be overridden by either setting.

Security reports

Report suspected vulnerabilities through the security-reporting channel. Do not include credentials or customer data.

Changes to this policy

We will update the "Last reviewed" date above when this policy changes and, for material changes, make a reasonable effort to notify account holders directly.

Contact

Questions about this policy: support@lyrashieldai.com.