1. Introduction & Scope

CyCity Inc. and CyCity International Pvt Ltd ("CyCity", "we", "us") are committed to engineering privacy at the quantum level. This Privacy Policy details our robust practices regarding the collection, use, processing, and protection of your Personal Data when you utilize the CyCity Quantum Web Standard (CQWS) platform, billing portal, website, APIs, and kernel hardware modules (collectively, the "Services"). We strictly adhere to global privacy frameworks, including the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act (CCPA).

2. The Zero-Knowledge Layer-3 Guarantee (Ring-0)

A foundational pillar of CQWS is that we mathematically cannot read or decrypt your application data.

• No Layer 7 Inspection: Unlike legacy web application firewalls (WAFs) that terminate TLS, decrypt your traffic, and inspect HTTP headers or payloads, CQWS operates entirely at OSI Layer 3 (Network Layer) using Linux Kernel Ring-0 Netfilter hooks.
• Mathematical Impossibility: Because we never hold your application's SSL/TLS private keys and we drop malicious traffic at the IP packet level before it reaches user-space, it is physically and mathematically impossible for CyCity to intercept, read, or harvest your customers' sensitive application data (e.g., passwords, credit cards, or PHI).
• Automated SOC 2 / HIPAA Compliance: By routing traffic through CQWS, you maintain a pure Zero-Trust boundary. We see network telemetry (packet drops, IP addresses) but we have zero visibility into your application payloads.

3. Data We Collect and Process

We collect data necessary to provision secure cryptographic services and manage your account. This includes:

• Account & Contact Data: Full name, corporate email address, company name, telephone number, and physical billing address.
• Financial Data: Processed entirely by our PCI-DSS compliant sub-processor (Stripe). We only store a secure cryptographic token representing your customer ID and do not store full credit card numbers on our infrastructure.
• Technical & Telemetry Data: IP addresses, server hardware identifiers (MAC addresses, UUIDs), daemon connection states, kernel entropy statistics, and security intrusion logs generated by the CQWS shield intercepting malicious traffic.

4. Use of Cookies and Tracking Technologies

Our platform uses cookies and similar tracking technologies to ensure secure authentication, session management, and to analyze platform performance.

• Strictly Necessary Cookies: Required for the operation of our platform (e.g., authentication tokens, CSRF protection). These cannot be disabled.
• Performance & Analytics Cookies: Used to understand how users interact with our portal. We do not sell this data. You may opt out of these cookies via your browser settings.

5. Sub-Processors and Third-Party Sharing

CyCity does not sell, rent, or trade your Personal Data. We utilize highly vetted third-party sub-processors strictly to operate our Services:

• Stripe, Inc.: Payment processing and subscription management.
• Vercel / AWS: Secure hosting of our global application infrastructure.
• Plesk / DigitalOcean: Specialized node routing and database management.

We mandate that all sub-processors enter into rigorous Data Processing Agreements (DPAs) binding them to the same strict data protection standards enforced by CyCity.

6. Your Privacy Rights (GDPR & CCPA)

Depending on your jurisdiction, you possess explicit rights regarding your Personal Data:

• Right to Access & Portability: You may request a copy of the Personal Data we hold about you in a structured, machine-readable format.
• Right to Rectification: You may correct inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your data, subject to legal and accounting retention requirements.
• Right to Restrict Processing: You may ask us to suspend the processing of your data in certain scenarios.
• CCPA Specific Rights: California residents possess the right to know what personal information is collected, the right to non-discrimination, and the right to opt-out of the "sale" of personal information (Note: CyCity does not sell personal information).

To exercise any of these rights, please contact our Data Protection Officer at privacy@cycity.space.

7. International Data Transfers (SCCs)

For enterprise clients operating within the European Economic Area (EEA), the UK, or Switzerland, CyCity acts as a Data Processor for server telemetry and a Data Controller for billing data. To ensure lawful international data transfers to our US-based infrastructure, we utilize Standard Contractual Clauses (SCCs) approved by the European Commission, coupled with supplemental cryptographic safeguards (Dilithium/Kyber).

8. Data Retention and Deletion

We retain your Personal Data only for as long as necessary to fulfill the purposes for which it was collected.

• Active Subscriptions: Data is retained for the duration of the active agreement.
• Telemetry Data: Automatically rotated and purged within 30 to 90 days, depending on your subscription tier.
• Billing Records: Retained for 7 years post-cancellation to comply with United States federal and state tax laws.

9. Data Breach Notification

In the highly unlikely event of a data breach compromising your Personal Data, CyCity commits to notifying affected customers and the relevant supervisory authorities within 72 hours of becoming aware of the breach, in strict accordance with GDPR Article 33. We will provide detailed reports on the nature of the breach, the data affected, and the mitigation strategies deployed.