eya
Legal

Privacy Policy

Website, user account, lead data and AI processing

Effective date
9 October 2026
Operator
Craftio Ltd, trading as Eya
Contact
hello@goeya.app

  1. 1.Who we are and scope

    This Privacy Policy explains how Craftio Ltd, operator of Eya, collects and processes personal information through https://goeya.app, https://my.goeya.app and related support, accounts and outreach functionality. Craftio Ltd's contact address is The Workary Welling, 1 Churchfield Road, Welling, DA16 3PA, United Kingdom; email: hello@goeya.app. This Policy covers account users, website visitors, business contacts and leads whose information may appear in customers' campaigns. Eya is intended for adults aged 18 or older.

  2. 2.Controller and processor roles

    For our own account creation, security, payments, website and support purposes, Craftio Ltd generally acts as a personal-data controller. When a customer directs Eya to handle leads, messages, prospects or campaign data for that customer's purposes, the customer will often be the controller and Craftio Ltd a processor. The precise role depends on the processing activity. Customers should provide appropriate notices and lawful bases to their contacts. Where required, we will enter into a Data Processing Agreement setting out processing instructions, subprocessor arrangements, security and assistance with rights requests.

  3. 3.Categories of personal information

    We may handle: (a) names, email addresses, organisation names, account identifiers, authentication details, plan and trial status; (b) billing contact details, transaction identifiers, payment status and invoices (full card credentials are handled by Stripe rather than deliberately stored in Eya's app database); (c) connected LinkedIn or, when launched, email account identifiers, connection tokens, permitted profile details, messages and conversation metadata; (d) lead/prospect names, job titles, companies, public profile links, business contact details, saved searches, campaigns, opt-out preferences and reply histories; (e) prompts, AI instructions, contextual messages, generated content and AI-agent actions; (f) support correspondence; (g) IP addresses, browser/device details, sign-in records, security logs and essential technical usage data. Availability of each category depends on enabled integrations and features.

  4. 4.Sources of information

    Information comes from users directly; connected accounts that users authorise; prospect information made available through search, authorised integrations and other lead sources; people who respond to outreach; Stripe and other providers that confirm transactions; and technical systems used to operate the platform. Publicly available professional information remains personal data when it identifies an individual. Customers must not assume public availability alone authorises any marketing or other processing.

  5. 5.Purposes and lawful bases

    We process account data to register users, provide plans and features, administer trials, and give support (performance of a contract); invoices and transaction records for payment administration and legal recordkeeping (contract and legal obligation); logs and authentication data for fraud prevention, availability, abuse detection and security (legitimate interests and sometimes legal obligation); business communications to users where permitted (consent or legitimate interests, subject to electronic marketing rules); and optional analytics or ad targeting only when a valid legal basis and any required cookie consent are in place. Legitimate interests include securely operating, preventing abuse of and improving Eya, balanced against individuals' rights. Where customer-controlled campaign data are processed as processor, the customer's documented instructions and lawful basis govern the underlying outreach purposes.

  6. 6.Lead generation and outreach

    Eya permits users to search for leads and run outreach campaigns. For prospect data under a customer's control, that customer determines whom to contact and must comply with data protection, anti-spam and electronic marketing laws, including responding to objections and keeping suppression lists where necessary. Eya may process professional identity information, messages and engagement events to enable the requested campaign. Recipients who want to object to a particular customer's outreach should contact that sender; they may also contact us and we will route or assist with the request as legally appropriate.

  7. 7.AI messages and autonomous replies

    The AI agent can process user instructions, relevant profile information and message/conversation history to draft, personalise and, where enabled, send responses. Anthropic is an AI technology provider used to process inputs and return outputs. AI outputs may be inaccurate. Users must configure and supervise autonomous messaging and should avoid submitting unnecessary sensitive personal data. We do not independently authorise use of customer content to train unrelated general-purpose AI models; actual provider retention, access and training arrangements depend on contractual settings, and we will configure and verify them before relying on a specific no-training assurance. We do not intend Eya's standard outreach workflows to make automated decisions producing legal or similarly significant effects on individuals.

  8. 8.Recipients and service providers

    Current named service providers include Stripe (payments); Supabase (application database, authentication and supporting services as configured); Unipile (connected-account integrations); Anthropic (AI processing); and Hetzner (hosting servers in Germany). These suppliers may process information necessary for their functions under their own relevant roles and agreements. We may also disclose information to professional advisers, regulators, public authorities where required, or transaction counterparties in a business reorganisation subject to legal safeguards. Gmail, Microsoft Outlook and new integration/data suppliers are planned or may be added later; they are not claimed as active today. Updated privacy notices and relevant subprocessor information will reflect material supplier changes.

  9. 9.Storage and international transfers

    Eya's identified Hetzner server environment is in Germany. Data processed by Supabase, Stripe, Unipile, Anthropic and other providers may be stored or accessed in other locations depending on their configurations. We will not claim that all information stays in Germany. When UK GDPR restricted transfers arise, we will rely on an applicable adequacy regulation or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum to standard contractual clauses, and carry out legally required assessments. Contact hello@goeya.app for details of safeguards relevant to your data. Exact supplier regions and subprocessors should be verified against production configurations.

  10. 10.Cookies, analytics and advertising

    Eya may use strictly necessary cookies and similar storage for sessions, login, fraud prevention and platform operation. As of the effective date, Eya does not intentionally use Google Analytics, Meta Pixel, LinkedIn Insight Tag or Mixpanel. We intend to add some or all of those technologies in future. Before deploying non-essential analytics/advertising cookies or pixels, we will update disclosures and provide consent and rejection controls as required by law. Simply continuing to browse is not treated as consent where affirmative consent is required. Users can also control cookies through their browser, though blocking essential cookies may impair login and security.

  11. 11.Data retention and deletion

    Trial accounts: the seven-day trial is followed by 30 days in which a user may purchase; if no purchase occurs, the account and associated service data are scheduled for deletion after that period. Paid accounts: core account and service data are kept while needed to supply the Service. Closed accounts: service data are deleted or anonymised when no longer needed, subject to documented backup cycles, security needs and legal obligations. Payment, tax, accounting and certain dispute-related records may need to be retained longer, potentially at least six years under applicable UK requirements. Customer-controlled lead data should be deleted or exported according to customer instructions and our processor obligations. We will not promise instantaneous deletion from backups; exact backup retention windows must be confirmed from production operations before publishing a more precise commitment.

  12. 12.Security

    We use proportionate technical and organisational safeguards, which may include authentication, role-based access, secure network connections, system maintenance, logging and restricted service-provider access. No system is risk-free. We will assess personal-data breaches and notify regulators, controllers or affected individuals where required by applicable law. Customers should protect their credentials, restrict connected-account permissions and report suspected compromise to hello@goeya.app.

  13. 13.Your rights

    Depending on applicable law, individuals may ask for access, correction, erasure, restriction, portability, objection to certain processing and withdrawal of consent, and may have rights concerning significant automated decisions. Contact hello@goeya.app. We may verify identity and respond within applicable statutory periods. Where we process data for a customer as processor, we may direct a request to the controller or assist them in addressing it. People may complain to the UK Information Commissioner's Office at https://ico.org.uk or an appropriate local authority. Additional region-specific rights may apply worldwide.

  14. 14.Marketing communications

    We may send necessary service notices about account access, trials, payments and security. Promotional messages about Eya are sent only where legally permitted, with opt-out mechanisms and any consent required by law. Unsubscribing from promotions does not stop essential security or transactional communications. Customers operating outreach through Eya are separately responsible for their own marketing compliance and recipient opt-outs.

  15. 15.Children, sensitive information and third parties

    Eya accounts are not intended for anyone under 18. If we learn that a child registered, we will take appropriate steps to close the account and delete information as required. Customers should avoid uploading special-category or similarly sensitive information unless lawfully authorised and necessary. Connected services such as LinkedIn, Google, Microsoft and payment providers have separate privacy notices governing their independent operations. We do not sell account-holder personal information to data brokers for independent reuse; prospect discovery processing may still involve personal information and must comply with applicable law.

  16. 16.Changes and contact

    We may update this Privacy Policy as features, providers and laws change. The current version and its effective date will be displayed on our website. We will give additional notice and obtain consent where required for a material new processing purpose. Data protection questions and rights requests: hello@goeya.app. Craftio Ltd, The Workary Welling, 1 Churchfield Road, Welling, DA16 3PA, United Kingdom. Website: https://goeya.app.