Privacy Policy

Cymbiote Technologies (“Cymbiote”, “we”) is an enterprise software engineering firm registered in Delaware, United States, with its principal place of business at 500 Howard Street, Suite 900, San Francisco, CA 94105.

For personal data we collect through this website and our commercial relationships, we act as a data controller. When we process data inside a client's systems during an engagement, we act as a data processor under that client's instructions and the data processing agreement signed with them.

Questions, requests or complaints: privacy@cymbiote.com.

We collect only what a specific purpose requires.

Information you give us

• Enquiries. Name, work email, company, optional phone number, budget and timeline indications, and whatever you write in the message field.
• Job applications. Name, email, an optional portfolio link and your written note. Anything you subsequently send us by email.
• Newsletter. Email address and the page you subscribed from.

Information collected automatically

• Essential. Session and preference cookies needed for the site to function, including your theme and motion preferences.
• Analytics, only with consent. Aggregate page views, referrer and approximate country, derived from a truncated IP address that we do not store.

We do not run advertising trackers, we do not build cross-site profiles, and we do not buy or sell contact data.

• To reply to your enquiry — necessary for steps taken at your request prior to entering a contract.
• To assess a job application — our legitimate interest in recruiting, and steps prior to an employment contract.
• To send the newsletter — your consent, withdrawable in one click from any email.
• To understand how the site is used — your consent, given through the cookie banner.
• To meet legal and accounting obligations — compliance with a legal obligation.

• Enquiries that do not become clients — 24 months, then deleted.
• Client records — for the engagement and 7 years afterwards, as required for tax and professional liability.
• Job applications — 12 months, unless you ask us to keep them longer for future roles.
• Newsletter subscriptions — until you unsubscribe, plus a suppression record so we do not re-add you.
• Analytics — 14 months in aggregate form only.

We share personal data only with service providers who process it on our behalf, under contract, and only to the extent required. Our current processors are:

• Cloud hosting and storage (AWS, in the region matching your location where possible)
• Transactional and marketing email delivery
• Error monitoring and performance analytics
• Accounting and payment processing, for client billing only

We will disclose data to authorities where legally compelled. Where we can lawfully tell you that we have been compelled, we will.

We do not sell personal data, and we have not done so in the preceding twelve months.

We operate from the United States, the United Kingdom, Singapore and Pakistan. Data may be accessed by our staff in any of those locations.

Transfers of personal data out of the UK and EEA are made under the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum, supplemented by encryption in transit and at rest and least-privilege, time-bound access controls. A copy of the relevant clauses is available on request.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct anything inaccurate
• Have it deleted, where no legal obligation requires us to keep it
• Restrict or object to certain processing
• Receive your data in a portable, machine-readable format
• Withdraw consent at any time, without affecting prior lawful processing

Email privacy@cymbiote.com. We respond within 30 days and do not charge a fee. If you are unhappy with our response you may complain to your local supervisory authority — in the UK, the Information Commissioner's Office.

We are SOC 2 Type II certified and ISO 27001 certified, audited annually by an independent third party. In practice that means:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Least-privilege, time-bound access with mandatory multi-factor authentication
• Background checks on all staff before they start
• Annual penetration testing, with findings tracked to closure
• Development against anonymised or synthetic data by default

Where a breach is likely to result in a risk to your rights, we will notify the relevant authority within 72 hours and you without undue delay.

Essential cookies store your theme and motion preferences and keep the site functioning. They cannot be disabled without breaking it, and they contain no identifiers.

Analytics cookies are set only after you accept them in the banner. Choosing “Essential only” means no analytics cookie is ever written. You can change your choice at any time by clearing site data for this domain.

We update this policy when our practices change. The date at the top always reflects the current version. Material changes affecting how we use data you have already given us will be notified by email before they take effect.

See also our Terms of Service.