Cyberian Technologies LLC
Version 1.0, effective October 15, 2026.
Cyberian Technologies LLC ("Cyberian," "we," "us," or "our") makes Odyssey, a closed-loop musical neurofeedback experience delivered through a consumer EEG headset, headphones, and our iOS and iPadOS applications. This Privacy Policy explains what personal information we collect through Odyssey, how we use and share it, how long we keep it, and the choices and rights you have.
Odyssey is a general wellness product. It is not a medical device, and the information it generates is not medical information. Please see the applicable Terms of Use for details.
This Policy applies to personal information we process through the Odyssey operator application, the Odyssey operator dashboard, any Odyssey personal (at-home) application, and related support channels (together, the "Services"). It covers three groups of people:
This Policy does not cover the practices of Operators, headset manufacturers (such as Interaxon Inc., maker of Muse), Apple, or other third parties, each of which has its own privacy policy.
Our role. For Participants, the Operator has the direct relationship with you and is responsible for presenting the Participant Terms and obtaining your consent. We act as the Operator's service provider (or "processor") for your identified Session Data, and as an independent controller of de-identified and aggregated data. For Operator Users and Personal Account Holders, we act as the controller of your account information.
When you take part in an Odyssey session, the headset and our Services collect:
We do not collect government identifiers, payment information, or precise location.
Business name and address, your name, work email, phone number, role, login credentials, device identifiers for Operator Devices, and your activity in the operator application and dashboard (such as sessions started, settings changed, and support requests).
If we offer home use in the future: name, email address, login credentials, headset identifier, subscription status and transaction history (payment card details would be collected directly by Apple or a payment processor, not by us), and your Session Data.
App version, device model, operating system, language, time zone, IP address, crash logs, and feature-usage events. We use this to keep the Services working and secure.
Emails, support requests, survey responses, and feedback you send us.
We collect information directly from you, from the headset and Operator Device during a session, from the Operator (for example when staff enter notes about a session), and automatically from your use of the Services. We may create, infer, or derive data (such as a brain-state estimate) from the data we collect.
What we will not do. We will not:
If we ever want to use personal information for a purpose that is not compatible with the purposes above, we will ask for your consent first.
Where the law requires a legal basis for processing, we rely on: your consent for the collection of neural, heart, and other Session Data (which you may withdraw at any time); performance of a contract for Operator and Personal Account Holder accounts; legitimate interests for security, service improvement using de-identified data, and defending legal claims, balanced against your rights; and legal obligation where applicable.
As of the effective date we use: Google Cloud and Firebase (hosting, database, file storage, sign-in and one-time SMS code delivery, crash reporting), located in the United States; and Apple (App Store, TestFlight, in-app purchase). A current list is available on request at info@cyberian.tech. We will give Operators notice of material changes.
We are headquartered in Iowa, USA, and store and process personal information on servers located in the United States (Google Cloud / Firebase). If you are in Canada or another jurisdiction with data-transfer rules, your information is transferred to the United States, where privacy laws may differ from those in your jurisdiction and where it may be accessible to U.S. authorities under U.S. law. We rely on your consent (for Participants) and on contractual safeguards with our service providers for these transfers, and we will enter into a data-processing addendum with Operators where their local law requires one.
| Category | Retention |
|---|---|
| Identified Session Data of Participants (the raw EEG recording, derived neural data, heart data, session metadata, self-reported data, and profile details linked to you) | Twenty-four (24) months after your last session, then deleted or de-identified. Shorter on your verified request. Your date of birth, gender and screening answers are deleted with the identified data. |
| Consent records | Three (3) years after your last session, so that the Operator and we can demonstrate that consent was obtained. |
| Operator account data | For the life of the Operator's account and three (3) years after closure, except invoices and tax records, which we keep as required by law. |
| Personal Account Holder data | For the life of your account and ninety (90) days after you delete it, except as required by law. |
| Technical and usage logs | Twelve (12) months. |
| De-identified and aggregated data | Indefinitely. It cannot be linked back to you. |
When we no longer need personal information, we delete it, de-identify it, or securely isolate it from further processing. Backups are overwritten on a rolling schedule of no more than ninety (90) days.
Regardless of where you live, you may: withdraw consent to future collection of Session Data at any time, by telling your Operator's staff or emailing us (withdrawal does not affect processing that already occurred or data that has already been de-identified); access the personal information we hold about you and receive a copy in a portable format; correct inaccurate information; delete your identified Session Data or account (we will complete deletion within thirty (30) days, except where we must keep information to comply with law, resolve a dispute, or enforce our agreements; deleting Session Data may mean we cannot provide you a summary of past sessions); object to or restrict certain processing, and appeal a decision we make on a request; and opt out of marketing emails using the unsubscribe link. We do not send marketing based on Session Data.
To exercise a right, email info@cyberian.tech or ask your Operator to forward your request, which it must do within five (5) business days. We will verify your identity before acting, which may involve matching the name, phone number, Operator, and session date you provide against our records. We will respond within thirty (30) days (forty-five (45) days where permitted by law, with notice). We will not discriminate against you for exercising a right. If we deny a request, we will tell you why and how to appeal; you may also complain to your privacy regulator.
We collect Session Data only with your express consent, which you may withdraw subject to legal or contractual restrictions. You may request access to and correction of your personal information and may challenge our compliance with the Office of the Privacy Commissioner of Canada or your provincial commissioner. Our Privacy Officer is reachable at info@cyberian.tech. Personal information may be stored and processed outside Canada, including in the United States.
Residents of states with comprehensive privacy laws (including California, Colorado, Connecticut, Virginia, Texas, Oregon, Maryland, and others) have the rights listed in Section 9.1. We treat neural data and health-related data as sensitive data and process it only with your consent and only as described in this Policy. We do not sell personal information or share it for targeted advertising, and we have not done so in the preceding twelve (12) months. Consumer health data notice (Washington My Health My Data Act, Nevada SB 370, Connecticut, and similar laws): the categories of consumer health data we collect, our purposes, and the categories of recipients are described in Sections 2, 3, and 5; we obtain your consent before collecting it; we do not sell it; and you may exercise the rights in Section 9.1, including the right to a list of third parties with whom we have shared your consumer health data, by emailing info@cyberian.tech. Maryland residents: we collect sensitive data only where strictly necessary to provide the session you requested and do not sell it.
If we process your information subject to the GDPR or UK GDPR, you also have the right to lodge a complaint with your supervisory authority. Our legal bases are described in Section 4. We do not currently offer Odyssey in these regions; if that changes, we will update this Policy.
The Services do not use third-party tracking or advertising cookies, so there is no tracking to disable. We honor Global Privacy Control signals where the law requires.
We use administrative, technical, and physical safeguards appropriate to the sensitivity of neural and health-related data, including encryption in transit (TLS) and at rest, role-based access controls that limit identified Session Data to personnel who need it, logging of access to identified Session Data, device requirements for Operator Devices, and security training for our team. No system is perfectly secure, and we cannot guarantee the security of your information. If a breach affects your personal information, we will notify you and any applicable regulator as required by law, and we will notify affected Operators within seventy-two (72) hours of becoming aware.
The Services are not intended for, and may not be used by, anyone under eighteen (18) years of age. The app checks your date of birth at check-in and will not create a profile for anyone under 18. If you believe we have collected information from a person under 18, contact us at info@cyberian.tech and we will delete it.
The Services run on Apple devices and are distributed through Apple's App Store or TestFlight; Apple's privacy policy governs Apple's own collection. The headset is made by Interaxon Inc.; its policies at choosemuse.com/pages/legal govern any data its own apps collect. We are not responsible for the privacy practices of third parties.
We may update this Policy from time to time. We will post the new version in the app settings and at this address with a new effective date. For material changes affecting Session Data, we will provide notice in the app and, where required, obtain fresh consent before the change applies to you. Your continued use after the effective date of a non-material change means you accept it.
Cyberian Technologies LLC, Attention: Privacy Officer
3105 Alleghany Dr NE, Cedar Rapids, Iowa 52402, USA
Email: info@cyberian.tech
If you are a Participant, you may also direct requests to the Operator where you had your session, which will forward them to us.