Privacy Policy

Last Updated: September 9, 2026

This page explains what Cyber City Media collects, why we use it, when we share it, how long we keep it, and how you can request access or deletion. It also describes each Google-connected feature and our Google API Limited Use commitments.

1. Who we are and what this policy covers

Cyber City Media (“CCM,” “we,” “our,” or “us”) provides media-production, scheduling, business-intelligence, creative, outreach, advertising, and related Workspace services. This policy covers cybercitymedia.com, the Cyber City Media Workspace, and services that link to this policy.

2. Information we collect

Information you provide

• Account and organization data: name, email address, profile information, organization name, membership, role, package, and invitation information.
• Business and creative context: websites, app or creator links, offers, audiences, corrections, briefs, decisions, uploaded media, rights attestations, approvals, contacts, and outcome observations.
• Scheduling and communications: availability, participant details, booking responses, messages, support requests, and consent or suppression records.
• Agent-to-agent sales: the buyer message sent to our sales agent is processed to prepare a reply. We keep an opaque conversation token and limited intent/offer state, not the raw sales message, in the sales thread database.
• Billing information: transaction and subscription records supplied by our payment processors. We do not store complete payment-card numbers.

Information collected automatically

We may collect IP address, browser and device information, session identifiers, pages and features used, security events, diagnostics, error logs, and performance data. We use cookies and similar storage for authentication, security, preferences, and measurement.

Information from connected services and public sources

When you authorize an integration, we receive the data and permissions needed for that feature. Business analysis may also observe public pages you submit and tightly bounded public links discovered from them. We preserve source URLs, observation times, and provenance so observed facts can be distinguished from your supplied context and from recommendations.

3. How we use information

• Authenticate users, provision the correct organization, enforce permissions and entitlements, and prevent cross-organization access.
• Provide requested analysis, forecasts, creative work, relationship workflows, booking, advertising safeguards, scheduling, storage, and support.
• Process approved provider actions, maintain lineage and audit receipts, recover interrupted work, prevent duplicate actions, and honor consent and suppression.
• Secure, troubleshoot, measure, and improve the services; comply with law; and enforce our agreements.
• Send service communications and marketing where permitted. You may opt out of marketing messages.

4. When we share information

We do not sell personal information or Google user data. We disclose information to infrastructure, hosting, storage, email, analytics, payment, AI-processing, and other service providers acting for us only as needed to deliver the service; to a provider you direct us to use; with your consent; for security; or when legally required. Buyer messages sent to the optional agent-to-agent sales tool may be sent to our model provider to generate a reply; do not include sensitive information in an initial inquiry. Providers are limited by contract or applicable terms. If CCM is reorganized or sold, information may transfer subject to notice and this policy.

5. Google user data and Google API Services

Google access is optional and begins only when you choose Google Sign-In or authorize a specific Google-connected feature. The Google consent screen identifies the requested permissions. Available data and actions depend on the feature you authorize:

• Google Sign-In: We receive your Google account identifier, verified email, name, and profile image to authenticate you, prevent duplicate identities, and provision or select an organization you are authorized to use.
• Google Calendar: Guest availability uses the account email and free/busy ranges needed for the scheduling session. It does not read guest event titles, descriptions, locations, attendees, or calendar names. An authorized staff or organization Calendar connection may separately read event titles, times, locations, descriptions, organizers, attendees, and response status to coordinate production scheduling and participant details. Authorized scheduling may create or update an event for a confirmed booking.
• Gmail: An authorized email feature may read message metadata or content needed to display and manage the relevant conversation. It may send only through a user-initiated or separately approved delivery action, subject to sender ownership, consent, suppression, and rate safeguards.
• Google Drive: A connected Drive feature may list, read, create, or update files for an action you request, such as selecting source material or saving a deliverable. Drive credentials and grants are not shared with another customer organization.
• YouTube: A connected YouTube feature may read channel, video, and analytics data. Uploads or channel changes occur only when expressly initiated or allowed by an operator-authorized automation policy.
• Google Ads: A connected Ads feature may read account and campaign information. Where enabled, it may create campaign or ad content, or pause a campaign, only after the applicable organization-owned account, proposal, approval, budget, audience, placement, permission, and execution safeguards are satisfied.

How Google data is used, stored, and protected

• We use Google user data only to provide or improve the user-facing feature you requested, maintain security, comply with law, and provide support with your permission.
• We do not sell Google user data, use it for personalized advertising, or transfer it to data brokers.
• We do not use Google Workspace API data to develop, improve, or train generalized or non-personalized artificial-intelligence or machine-learning models. Connected data may be processed for the user-requested feature but is not used to train a shared model.
• OAuth access and refresh tokens are stored server-side, excluded from browser responses, and restricted to authorized server operations. Organization integrations are isolated from other customer organizations.
• We retain credentials while needed for the authorized connection and derived records only as needed for the requested service, security, audit, legal, or user-directed recordkeeping.

Cyber City Media’s use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including Limited Use requirements.

6. Retention, disconnection, and deletion

Retention depends on the record and service. We keep information while an account or connection is active and as needed for delivery, security, audit, dispute resolution, legal obligations, or user-directed records. When no longer needed, we delete or anonymize it. A product disconnect, where available, deletes the locally stored credential but may not revoke access at Google. You can revoke provider access in Google Account permissions. To request deletion of connected data, saved content, or your account, email privacy@cybercitymedia.com. We will verify the request and explain any legally required retention.

7. Security and organization isolation

We use encryption in transit, access controls, server-side authorization, tenant isolation, secret redaction, bounded provider requests, and audit records. No transmission or storage method is completely secure. Platform support access is separate from organization membership and is intended to be explicit and audited.

8. Your rights and choices

Depending on your location, you may request access, correction, deletion, portability, restriction, or objection, and may opt out of marketing. California residents may also request the categories and specific pieces of personal information collected or disclosed. We do not sell personal information. Contact privacy@cybercitymedia.com.

9. Children and international transfers

Our services are not directed to children under 13, or the higher minimum age required locally. If we learn that we collected a child’s information without required consent, we will delete it. Information may be processed in countries with different data-protection laws using applicable safeguards.

10. Changes and contact

We may update this policy and will post the revised version and “Last Updated” date here. For privacy questions or requests, email privacy@cybercitymedia.com or legal@cybercitymedia.com.