Coryn AI ("Coryn AI," "we," "us," or "our") provides a secure session replay platform that helps developers, QA teams, and product managers understand and resolve issues within their applications. This Privacy Policy explains how we collect, use, disclose, and safeguard information in connection with the Coryn AI website, SDK, dashboard, and related services (collectively, the "Service"), and describes the choices and rights available to you.
This Privacy Policy is directed at two audiences: (1) our direct customers who integrate the Coryn AI SDK into their applications ("Customers"), and (2) the end users of Customer applications whose interactions may be captured through the Service ("End Users"). Where obligations differ between these audiences, we note that distinction below. Customers are responsible for providing this Policy, or their own equivalent privacy disclosures, to their End Users as required by applicable law.
1. Information We Collect
1.1 Account and Billing Information
When a Customer creates an account, we collect information such as name, business email address, company name, billing address, and payment details (processed through our payment processor). We also retain records of plan selection, subscription history, and usage relevant to billing.
1.2 Session Replay Data
The core of the Service involves capturing structural layout information from a Customer's application in order to reconstruct a visual replay of an End User's session. Importantly, this capture is layout-based, not screenshot-based: Coryn AI records the composition and state of an application's UI elements at a defined frame rate, rather than pixel images or video of the device screen. As a result, and by design, Coryn AI does not capture content rendered outside of the Customer's application (such as notifications, other apps, or the device's home screen or status bar), and it is not technically capable of doing so.
Customers can configure specific UI elements — such as password fields, payment forms, private messages, or any other designated view — to be excluded from capture entirely. Where our systems cannot confirm with confidence that a designated element has been properly excluded from a given capture, that capture is automatically discarded and is never transmitted to or stored on our servers.
1.3 Device and Environmental Context
Alongside layout data, the Service captures contextual information that helps Customers diagnose issues, including device model and manufacturer, operating system and application version, network connectivity type and quality, screen orientation, available memory, application window size, and crash or exception indicators. Where a Customer integrates a third-party crash reporting tool (such as Firebase Crashlytics), the Service may generate a session identifier that the Customer can associate with that tool's crash reports.
1.4 Custom Metadata
Customers may configure the SDK to capture additional custom metadata to aid in filtering and grouping session recordings, such as screen names, feature flag values, application language or theme settings, or Customer-assigned user or account identifiers. Customers determine what custom metadata is captured and are responsible for ensuring that any such metadata does not include data types they are not authorized to collect or process.
1.5 Website and Support Information
When you visit our website, request a demo, subscribe to our newsletter, or contact support, we may collect your name, email address, and the content of your communications with us, as well as standard technical information such as IP address, browser type, and referring pages.
2. How We Use Information
We use the information described above to:
● Provide, operate, and maintain the Service, including generating session replays and associated dashboards;
● Process subscriptions, calculate usage, and manage billing;
● Monitor, investigate, and respond to unusual, anomalous, or potentially fraudulent or abusive account activity, including activity that may indicate misuse of session limits, automated or non-human traffic, credential sharing, or attempts to circumvent privacy or masking controls, as further described in Section 9;
● Maintain the security, integrity, and availability of the Service and prevent misuse;
● Provide customer support and respond to inquiries;
● Improve and develop the Service, including analyzing aggregated or de-identified usage trends;
● Communicate with Customers about their accounts, service updates, security notices, and, where permitted, product or marketing communications; and
● Comply with applicable legal obligations and enforce our Terms of Service.
3. Legal Basis for Processing
Where the General Data Protection Regulation (GDPR) or similar data protection law applies, we rely on the following legal bases to process personal data: performance of a contract (to provide the Service to our Customers), legitimate interests (including maintaining service security, preventing fraud and abuse, and improving the Service), compliance with legal obligations, and, where applicable, consent obtained by the Customer from its End Users. Customers act as the data controller with respect to End User data captured through the Service, and Coryn AI acts as a data processor (or service provider, as applicable under the CCPA) on the Customer's behalf and instructions.
4. How We Share Information
We do not sell personal information. We may share information in the following circumstances:
● Service providers. We engage third-party vendors to provide infrastructure, cloud storage, payment processing, analytics, and customer support functions on our behalf, under contractual obligations to protect the information consistent with this Policy.
● Customer-configured integrations. Where a Customer connects the Service to a third-party platform (such as a crash reporting or analytics tool), relevant identifiers may be shared with that platform as configured by the Customer.
● Legal and safety reasons. We may disclose information where required by law, legal process, or governmental request, or where we believe disclosure is necessary to protect the rights, property, or safety of Coryn AI, our Customers, End Users, or the public.
● Business transfers. Information may be disclosed or transferred in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.
5. Data Retention
We retain session replay data and associated context for the retention period corresponding to the Customer's subscription plan, after which it is automatically deleted, unless the Customer configures a shorter retention period or requests earlier deletion. Customers may permanently delete individual session recordings, or all recordings associated with their account, from our servers at any time. Account and billing information is retained for as long as necessary to provide the Service and to comply with legal, tax, and accounting obligations.
6. Data Security
We implement administrative, technical, and organizational measures designed to protect information against unauthorized access, alteration, disclosure, or destruction, including encryption in transit, access controls, and the automatic, fail-safe discard of captures where sensitive-data exclusion cannot be confirmed, as described in Section 1.2. No system can be guaranteed to be completely secure, and we cannot warrant the absolute security of information transmitted to or stored within the Service.
7. International Data Transfers
Coryn AI may process and store information in countries other than the country in which it was originally collected. Where we transfer personal data internationally, we rely on appropriate safeguards recognized under applicable data protection law, such as standard contractual clauses, to ensure that the data continues to receive an adequate level of protection.
8. Your Rights and Choices
Depending on your jurisdiction, you may have rights with respect to personal data we hold, including the right to request access to, correction of, deletion of, or a portable copy of your personal data, and the right to object to or restrict certain processing. End Users seeking to exercise these rights with respect to data captured through a specific application should contact the operator of that application (our Customer) in the first instance, as the Customer generally controls what data is collected and how it may be corrected or deleted. Customers may contact us directly using the details in Section 12 to exercise rights regarding their own account and billing information, or to facilitate an End User request.
California residents may have additional rights under the California Consumer Privacy Act, as amended, including the right to know, delete, correct, and opt out of the sale or sharing of personal information; as noted above, we do not sell personal information.
9. Monitoring for Unusual Usage and Investigation of Suspicious Activity
Because the Service is priced and provisioned based on usage, and because session replay capabilities can be misused if accessed improperly, we monitor account and usage activity as part of our ongoing security, fraud-prevention, and billing-integrity practices. This monitoring may involve analysis of usage volume, access patterns, authentication activity, and configuration changes at the account level.
Where we identify usage or activity that appears unusual, anomalous, or inconsistent with an account's typical or disclosed use — including sudden spikes in session volume, patterns suggestive of automated or non-human traffic, repeated attempts to bypass masking or privacy controls, suspected unauthorized access, or other indicators of potential fraud or abuse — we may investigate that activity. Such an investigation may include reviewing account logs and configuration history, contacting the Customer for additional information, and, where necessary to protect the security or integrity of the Service, temporarily limiting or suspending affected functionality while the investigation is ongoing. We undertake this monitoring as part of our legitimate interest in maintaining a secure, reliable, and fairly billed Service for all Customers.
10. Children's Privacy
The Service is intended for use by businesses and is not directed at children. We do not knowingly collect personal information directly from individuals under the age of 16. If you believe a child has provided us with personal information, please contact us so we can take appropriate action.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. Where changes are material, we will provide reasonable notice, such as by email to Customers or a notice on our website or dashboard, prior to the change taking effect. The "Last Updated" date at the top of this Policy indicates when it was last revised.
12. Contact Us
If you have questions about this Privacy Policy or wish to exercise any of the rights described above, please contact us through privacy@coryn.ai