CYNQOR Privacy Policy

Version: 1.11

Effective date: October 20, 2026

1. Who we are

CYNQOR is a mobile platform for browsing products, placing orders, and messaging between buyers and the store. Stores can also reply in CYNQOR to messages customers send them on WhatsApp and Instagram (see §14). Privacy contact: privacy@cynqor.app.

Operator. ИП CANADA.CLO, an individual entrepreneur in the Republic of Kazakhstan, provides the CYNQOR service and processes personal data in that service. A store still sells its own goods. The store-owner, staff, and platform-owner roles described below do not change. Legal contact: legal@cynqor.app.

2. Data we process

We do not sell personal data for advertising.

Location. CYNQOR does not collect your location in the background and does not require it to use the app. When you open the location picker in a direct chat, the app may ask permission to use your precise location while the app is open. If you allow it, the app reads your current position to place a pin. The coordinates are stored in that chat and shown to its participants only after you send them. If you refuse permission, CYNQOR does not read your coordinates; you can choose a point on the map, and it is sent only after you tap send. These coordinates are not sent to OpenAI, Higgsfield, or Vertex AI. While the map is open, tiles for the visible area are loaded from OpenStreetMap. That request does not include your name, phone number, or CYNQOR account identifier.

3. Authentication and account linking

CYNQOR supports sign-in with a phone number and Sign in with Apple. You may connect both methods to the same CYNQOR account.

When you use Sign in with Apple, Apple may provide an email address or a private relay email address provided by Apple. Apple may not always share an email address.

Authentication data is processed through Firebase Authentication (Google infrastructure).

Phone number and Sign in with Apple may be linked to one CYNQOR account identifier. CYNQOR does not automatically merge separate accounts based only on email, name, or phone number. If a sign-in method is already linked to another account, automatic merge is not performed.

4. Legal bases

• Contract performance (orders, delivery, external payment).
• Legitimate interests (safety, moderation, fraud prevention).
• Consent where required separately: sharing your requests and materials with third-party AI providers for CYNQOR AI (see §13).

5. Storage location

Data is hosted on Google Firebase (Firestore, Authentication, Storage). Project region is set in the Firebase console.

6. Retention

• Profile and messages while the account is active.
• Orders for accounting and disputes. After account deletion, order PII is anonymized (name, phone, address, sizes, receipts); buyer identifier and line items are retained for records.
• Reports until resolved and for a reasonable archive period.
• AI generations until you delete the generation in the app or delete your account (see §7 and §13).
• Credits history for purchase accounting and disputes.
• Messages to stores via WhatsApp and Instagram while the store uses the channel in CYNQOR or until a deletion request; technical copies of incoming events and messages held while a store tests its Instagram connection for 30 days, then deleted automatically (see §14).
• Backups. The deletion described in this policy happens in CYNQOR's live systems, the ones the app and stores work with. Deleted data may stay for a while in backups kept to recover from failures: 14 days in daily database backups, 8 weeks in weekly ones, 7 days in the database change history, 30 days for deleted files. The daily copy of files and separate copies made during system maintenance have no automatic retention period and are deleted by the operator manually. Only the operator can access backups; they are not used to run the app and are not visible to stores, and data from them does not return to the app automatically (see §5 of the Data Deletion page).

7. Account deletion

Deletion is available in the app: Settings → Account management → Delete account (platform owner accounts excluded).

Confirmation is required. Re-authentication may be required (if your session is older than 5 minutes):

• for phone-linked accounts — SMS confirmation;
• for accounts linked with Sign in with Apple — Apple confirmation.

For accounts linked with Sign in with Apple, CYNQOR revokes Sign in with Apple authorization before deleting the account.

*Deleted from live systems (for backups, see §6):*

• Firebase Authentication account;
• user profile;
• cart, likes, favorites, block list, push tokens;
• AI assistant chat history and assistant memory;
• CYNQOR AI generation history (prompts, settings, provider request identifiers);
• materials uploaded for AI generations and generated results in CYNQOR storage;
• your consent record for sharing data with AI providers;
• your reactions (likes, saves) on community AI prompts;
• avatar and payment receipt files in cloud storage (Firebase Storage);
• username in the username registry (released for reuse);
• follows and followers (social graph).

*Anonymized (no identifying data):*

• buyer orders (name, phone, address, measurements);
• chat metadata (display name replaced with “Deleted user”).

*Unpublished:*

• community AI prompts and AI news feed posts you published are hidden, and their prompt text, author name, and avatar are removed; published image and video copies are deleted from CYNQOR storage.

*Retained for legitimate purposes:*

• direct message text (for the other participant’s history);
• products and news feed posts created as shop content;
• technical account-deletion record (no personal data);
• Credits purchase and usage history, Apple In-App Purchase transaction records, and generation cost records (without prompts or media) — for accounting and disputes.

AI generations and account deletion. When you delete your account, CYNQOR deletes your AI generation history, materials uploaded for AI, and generated results from its systems. If deletion cannot be completed, your account is not deleted and you can try again. Data already shared with an AI provider is retained under that provider's terms — CYNQOR cannot delete it from the provider (see §13).

Deletion is irreversible.

8. Your rights

You may request access, correction, or deletion. Account deletion is in app Settings (see §7). How to delete data without access to the app, or messages you sent to a store via WhatsApp or Instagram, is explained on the Data Deletion page. Contact: privacy@cynqor.app.

9. Reports and moderation

Reports store: your account ID, target type/id, reason, description, timestamp. The platform owner can see the full report list. The owner of a store can also see image reports for that store's products and posts; a store employee cannot see that list.

Reasons include spam, fraud, harassment, inappropriate content, impersonation, counterfeit, deception, non-consensual intimate images (including AI-generated images), and child sexual content. Every report is saved and placed in the moderation queue. An image in News, a profile, a product, or a chat is hidden when a platform moderator submits that report, when a second different user reports the same image for one of the last two reasons, or when the reviewer removes it. One report by itself does not hide the image. The file stays in storage until the reviewer allows it or removes it. An AI result sent to News is not shown in the public feed until the platform owner approves it (see §13).

10. Blocking

Blocking creates an entry in your block list. Reported users are not automatically notified of a report.

11. Diagnostics and analytics

On mobile apps (iOS/Android) we use Firebase Crashlytics and Firebase Performance to detect crashes and slowdowns. Separate marketing or ad analytics SDKs are not used. The web app may not include all the same diagnostics.

12. Third parties

• Google LLC (Firebase) — hosting and authentication.
• Meta Platforms (WhatsApp Business Platform, Instagram) — delivering messages between customers and stores that connected WhatsApp or Instagram (see §14).
• OpenAI — processing messages sent to the CYNQOR AI assistant to generate responses and shopping assistance.
• Higgsfield and the AI model and compute providers it uses — creating AI images and videos you request (see §13).
• Google Cloud Vertex AI — finding similar products from a photo you choose. This needs its own consent. The 6 October 2026 consent for generation and the AI assistant does not cover it.
• Apple — payment for Credits purchases through the App Store. CYNQOR does not receive your card details.
• Payment partners (e.g. Kaspi) — payment outside the app via link/QR.

13. CYNQOR AI: content generation and AI assistant

Consent. Before your data is first sent to third-party AI providers, the app asks for your explicit consent ("Allow and continue"). Without consent, generation requests and assistant messages are not sent and no Credits are charged. We store that you consented, the terms version, and the date. If the terms change, we ask again.

What is sent for generation. When you create a photo or video (including from a template, a trend, or "Create similar"), CYNQOR sends the AI provider Higgsfield your text prompt, the photos, videos, or audio you select, and generation settings (model, format, duration, etc.). Higgsfield may use AI model and compute providers to process the request. Your name, phone number, email, and CYNQOR account identifier are not sent to Higgsfield.

What is sent to the AI assistant. Messages you write to the AI assistant, recent history of that chat, and preferences you saved (such as size, style, budget, city, delivery method) are sent to OpenAI to produce a response. Do not send the assistant information you do not want to share.

Why. Only to fulfil your request: to create the generation result or the assistant's response.

Processing by providers. Higgsfield and OpenAI process data under their own privacy policies. According to Higgsfield's published policy, it may use inputs and outputs to improve its models, and removed content may remain with it for up to 30 days and longer in backups. CYNQOR cannot delete data already shared with a provider.

Storage at CYNQOR. Your prompt, settings, references to uploaded materials, and generated results are stored in your CYNQOR AI history in Google Firebase. Unused uploaded files are periodically deleted automatically. You can delete a generation in the app; its record and results in CYNQOR storage are deleted. Results you publish are visible to other users until you unpublish them or delete your account.

Withdrawing consent. You can withdraw consent at Settings → Privacy → CYNQOR AI data processing. After withdrawal, new requests are not sent to AI providers. Withdrawal does not delete results already created and does not undo earlier processing.

Rights to materials. Upload only materials you have the right to use; images of other people only with their permission.

Search by photo. The photo you choose is sent to Google Cloud Vertex AI only after a separate consent. Without it, the photo is not sent. Consent for generation or the AI assistant does not include this.

AI posts in News. A generation you submit to News is not shown to other people until the platform owner approves it. A rejected post stays hidden.

Age. Image and video generation is available after you confirm that you are 18 or older. CYNQOR stores that confirmation and its date. Without it, the request is not sent and Credits are not charged. Search by photo and the AI assistant do not require this confirmation. Higgsfield does not intend its service for people under 18.

14. Messages to stores via WhatsApp and Instagram

What it is. A store can connect its WhatsApp Business or Instagram professional account to CYNQOR. Messages customers send the store on WhatsApp or in Instagram Direct then arrive in CYNQOR through Meta's official interfaces, and the store replies from the app. The store connects its Instagram account through Meta's business tools (Facebook Login for Business) and can disconnect it at any time. Customers do not need a CYNQOR account for this and do not sign in to CYNQOR with Facebook or Instagram.

What is stored. The conversation with the store (texts, photos and files sent, times and delivery statuses), the name or username that WhatsApp or Instagram provides, and the WhatsApp phone number or the Instagram ID assigned for the store's account. Attachments are stored in Firebase Storage and cannot be accessed directly from the app.

Why. Only so the store can read the message and reply. This data is not used for advertising, not sold, and not shared with AI providers.

Who can see it. Only the store owner and staff the owner has given access to messages in CYNQOR. A push notification about a new message contains the store name and the sender's name, not the message text.

Retention. The conversation is kept while the store uses the channel in CYNQOR or until a deletion request. Technical copies of incoming events are kept for 30 days and then deleted automatically; the message text and attachment links are removed from them right after processing.

Test mode. While a store tests its Instagram connection, messages from senders the store has not approved yet are held and not shown in the inbox. They wait for the store's decision: each message with its text and attachment links is kept for 30 days after it arrived, the sender's name or username for 30 days after their last message, and then deleted automatically. After approval the held messages appear in the conversation; after rejection they are deleted at once.

Deleted messages. If you unsend a message in Instagram, CYNQOR deletes its text and attachments from its live systems, including a held copy, and the store sees that the message was deleted. Backups do not bring such a message back into the conversation automatically (see §6).

Deletion. Email privacy@cynqor.app with the store, the channel, and the WhatsApp phone number or Instagram username you wrote from. We will delete the conversation, attachments and your identifiers from CYNQOR within 30 days. Messages in WhatsApp and Instagram themselves are kept by Meta and in the store's account. See the Data Deletion page.

15. Children

Not intended for users under 13 (or local legal age).

16. Changes

We publish updates with a new date. Material changes may be announced in the app. Version 1.9 keeps the version 1.8 terms for WhatsApp and Instagram messages and adds a separate photo-search consent, confirmation of age 18 or older before image and video generation, owner review before an AI post appears in News, and the image-report reasons in §9. Version 1.10 keeps every provision of version 1.9 and names the operator of the service and of personal data: ИП CANADA.CLO, Republic of Kazakhstan. Version 1.11 keeps every provision of version 1.10, describes the precise location you choose to send in a direct chat, and corrects §9: one unconfirmed report does not hide the image.

Russian version: PRIVACY_POLICY.ru.md