English
English
Join us on WhatsApp

Privacy Policy

Effective date: October 23, 2026

1. Who we are

Cyango is operated by Wishes and Intuition Unip. LDA, Rua Circular Norte do PITE, NERE, 7005-841 Évora, Portugal ("Cyango", "we", "us"). We are the controller of the personal data that this policy describes. You can contact us at info@cyango.com.

This policy applies to the websites at cyango.com, to the Cyango platform and its products (xr/studio, xr/viewer, xr/links, xr/migrator, xr/converter, xr/panoedit, xr/panoconnect and Cyango Stores), and to the Cyango AI connector (MCP) and plugins (together, the "Service").

When a Cyango customer publishes an experience for its own visitors, that customer controls the visitor data that the experience collects. We process that data for the customer and follow its instructions.

2. Data we collect

  • Account data: your name, email address, password and profile details. Our sign-in service stores the password in hashed form. If you sign in with Google, Google gives us your name, email address and profile picture.
  • Workspace content: the stories, scenes and assets that you create or upload (for example images, videos, panoramas, 3D models and splats), and the data that you enter in the editor.
  • Billing data: your plan, invoices, billing address and tax number. Stripe processes your card. We do not keep full card numbers.
  • Usage and device data: pages that you visit, features that you use, browser, device type, IP address and error reports.
  • Messages: what you send to us through the contact form or by email.
  • Shopify data: if you install the Cyango app on a Shopify store, we receive the store and product data that the app needs to work.

3. Why we use your data

  • To give you the Service: your account, storage, editing, publishing and processing jobs. Legal basis: contract.
  • To bill you and keep invoices. Legal basis: contract and legal obligation.
  • To keep the Service secure, prevent misuse and fix errors. Legal basis: legitimate interests.
  • To measure and improve the Service with analytics. Legal basis: consent.
  • To show you advertising and send you marketing emails. Legal basis: consent. You can withdraw it at any time.
  • To answer your messages. Legal basis: legitimate interests.

4. Who receives your data

We do not sell personal data. We share it only with these service providers, and only as they need:

  • Amazon Web Services: hosting, storage and content delivery, in the EU (Ireland) region.
  • Stripe: payments.
  • Google: sign-in with Google, and Google Tag Manager when you give consent.
  • PostHog: product analytics, when you give consent.
  • OpenAI and Anthropic: AI features. We send only the content that the feature needs, for example a prompt or an image. OpenAI also measures advertising when you give consent.
  • RunPod: GPU processing for conversion and AI jobs.
  • Our email provider: account and service emails.
  • Pexels, Poly Haven and Sketchfab: the search words that you use when you search their free assets in the editor.
  • Public authorities, when the law requires it.

5. Transfers outside the EEA

Some of our providers process data outside the European Economic Area, for example in the United States. For these transfers we use the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

6. How long we keep your data

  • Account data and workspace content: while your account is active. When you delete your account, or ask us to delete it, we delete or anonymise this data unless the law requires us to keep it. Copies in backups are deleted when the backups expire.
  • Billing records: for the period that tax law requires (currently 10 years in Portugal).
  • Analytics data: only as long as we need it to improve the Service.
  • Messages: as long as we need them to answer you and follow up.

7. Cookies

We use strictly necessary cookies to run the Service. We use personalization, analytics and advertising cookies only when you agree. The tools in these categories are Google Tag Manager, PostHog and the OpenAI advertising pixel. You can change your choice at any time in the cookie preferences.

8. AI assistants and the Cyango MCP server

The Cyango MCP server at mcp.cyango.com and the Cyango plugins for ChatGPT, Claude, Cursor and Grok let an AI assistant edit a story that is open in Cyango xr/studio. Cyango operates the server. It passes requests between your AI assistant and the xr/studio tab where you turned MCP on.

a. Data the MCP server handles

  • The content of the story that is open in xr/studio: scenes, entities, settings, and asset names and links. The assistant reads and changes it through the MCP tools.
  • URLs that you or the assistant give to the upload tool. The server downloads those files and sends them to xr/studio.
  • Search words for free asset providers.
  • Sign-in records: your Cyango user ID, the AI assistants that you allowed, and refresh tokens, which the server stores only as hashes.

You sign in with your Cyango account. The AI assistant never receives your password. The server does not collect contact details, location or payment data, and it has no analytics or tracking.

b. Who receives this data

  • The AI assistant that you use (for example ChatGPT, Claude, Cursor or Grok) receives the tool results, which include story content. The privacy policy of that assistant applies.
  • xr/studio saves story changes and uploaded assets to your Cyango account, as this policy describes.
  • Free asset providers receive search words through xr/studio.

The MCP server runs on Amazon Web Services in the EU (Ireland) region.

c. Retention

The MCP server does not store story content. It holds each request in memory only while it runs. Refresh tokens expire after 30 days without use. Your approvals of AI assistants stay until you ask us to remove them. Story content and uploaded assets stay in your Cyango account until you delete them.

d. Your controls

  • Turn MCP off in Story Settings to stop all access to the story.
  • Disconnect or remove Cyango in your AI assistant.
  • Delete assets and stories in xr/studio.
  • Write to info@cyango.com to remove your approvals of AI assistants.

9. Your rights

You can ask us to give you a copy of your data, correct it, delete it, limit its use or send it to another service. You can object to processing based on legitimate interests, and you can withdraw consent at any time. To do this, write to info@cyango.com. You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt).

10. Security

We use HTTPS for all traffic, we give access to personal data only to the people who need it, and we keep backups. No system is fully secure, so we cannot guarantee that a breach will never occur.

11. Children

The Service is not for children under 13, or under the minimum age for consent in their country. We do not knowingly collect their data.

12. Changes to this policy

We can change this policy. We publish the new version on this page with a new effective date. If a change is important, we also tell you by email or in the Service.

13. Contact

For questions about this policy or your data, write to info@cyango.com or to Wishes and Intuition Unip. LDA, Rua Circular Norte do PITE, NERE, 7005-841 Évora, Portugal.