Privacy Policy

Information you provide

• Business contact information, such as name, work email, company, title, country, company website, and organization size.
• Enterprise qualification information, such as AI-agent maturity, number of agents, expected action volume, connected systems, high-impact use cases, timeline, and messages.
• Account and organization information, including users, roles, settings, agent registrations, integrations, policies, and known destinations.
• Support, security, legal, sales, or other communications.
• Billing and commercial information associated with enterprise contracts; payment-card information may be handled by a payment provider rather than stored directly by Asyrx.

Information processed through the Services

Depending on customer configuration, the Services may receive structured information about a proposed AI-agent action, including agent identifiers, target systems, action types, financial values, affected entity or record counts, destinations, data classifications, environment, reversibility, privilege changes, and contextual metadata. Customers control the data they submit and should use data minimization.

Information collected automatically

• IP address, device and browser information, timestamps, pages or features accessed, referring URLs, and similar web or service logs.
• API request identifiers, API-key identifiers or prefixes, route, response code, latency, environment, error codes, and usage volume.
• Authentication and security events, including login activity, audit events, and indicators of suspected abuse or unauthorized access.
• Strictly necessary cookies and browser storage as described in the Cookie Policy. Asyrx does not use advertising or marketing-analytics trackers.

• Provide, operate, maintain, secure, and troubleshoot the Services.
• Review and qualify Enterprise Sandbox and Agent Risk Assessment requests.
• Create and administer organizations, accounts, roles, API access, webhooks, policies, and integrations.
• Process proposed-action metadata and generate risk intelligence, scores, context, reason codes, and recommendations.
• Provide customer support, security communications, service notices, and contractual administration.
• Measure performance, usage, reliability, and product quality.
• Detect abuse, security threats, fraud, or violations of applicable terms.
• Improve our products using Service Data, customer feedback, and appropriately aggregated or de-identified information.
• Comply with legal obligations and enforce our agreements.
• Send business or marketing communications where permitted by law; recipients can opt out of marketing communications.

Where the GDPR, UK GDPR, or similar laws require a legal basis, Asyrx may rely on performance of a contract, legitimate interests (such as operating, securing, improving, and marketing an enterprise service), compliance with legal obligations, and consent where required. Where we rely on legitimate interests, we consider the interests and rights of affected individuals.

For Customer Data processed on behalf of an enterprise customer, the customer generally determines why the data is submitted and how it is used. If you are an individual whose information was submitted by an Asyrx customer, requests concerning that Customer Data may need to be directed to the relevant customer. Asyrx will provide reasonable assistance as required by the applicable DPA and law.

Asyrx uses a deterministic risk engine together with statistical behavioural analysis to produce Action Risk, Blast Radius, contextual, and recommendation outputs. Asyrx does not send assessment data to a third-party AI or large-language-model provider. Asyrx does not make the final decision to authorize, approve, deny, block, or execute a customer action; customers determine how Asyrx output is used. Asyrx does not intend the Services to make solely automated decisions about individuals that produce legal or similarly significant effects unless expressly agreed and lawfully configured.

• Service providers and sub-processors that support hosting, databases, authentication, network delivery, edge security, and service email, as listed on the Sub-processors page.
• Professional advisers such as lawyers, auditors, insurers, accountants, and consultants where reasonably necessary.
• Authorities, courts, or other parties when required by law, legal process, or to protect rights, safety, security, and the integrity of the Services.
• A successor or transaction counterparty in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate safeguards.
• Other parties at your direction or with your consent.

Asyrx does not sell personal information. Asyrx does not use personal information for cross-context behavioral advertising, and does not use third-party advertising or marketing-profiling trackers. If this ever changes, this Policy will be updated and any legally required choices provided beforehand.

A current list of sub-processors used to provide the Services is maintained on the Asyrx Sub-processors page. Enterprise customers may have additional notice or objection rights under an applicable DPA.

Asyrx and its providers may process information in countries other than the country where it was collected. Where required, Asyrx uses recognized transfer mechanisms such as adequacy decisions, contractual safeguards, or the European Commission’s Standard Contractual Clauses, and applicable UK or Swiss transfer mechanisms.

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, to provide the Services, meet contractual commitments, maintain security and audit records, resolve disputes, and comply with law. Enterprise customers may have configurable or contractual retention periods. Sandbox and evaluation data may be deleted after expiration or inactivity. Backup copies may persist for a limited period before deletion or overwriting.

Asyrx uses technical and organizational safeguards appropriate to the nature and risk of the information processed. These measures are designed around tenant isolation, authenticated access, role-based controls, secure secret handling, encrypted transport, logging, and data minimization. No system is completely secure. Additional information is available on the Security & Compliance page.

Depending on where you live and applicable law, you may have rights to request access, correction, deletion, portability, restriction, objection, withdrawal of consent, or information about use and disclosure. You may also have the right to appeal certain decisions or complain to a privacy regulator.

Canada

Individuals in Canada may have rights under PIPEDA or applicable provincial privacy laws, including rights concerning access, correction, accountability, consent, safeguards, and challenges to compliance.

European Economic Area, United Kingdom, and Switzerland

Where applicable, individuals may have rights under the GDPR, UK GDPR, or Swiss data-protection law, including access, rectification, erasure, restriction, portability, objection, and complaint rights.

California and other U.S. states

Residents of California and other U.S. states may have rights to know or access, correct, delete, obtain a portable copy, and opt out of certain uses of personal information, depending on the law and whether Asyrx meets applicable thresholds. Asyrx will not discriminate against individuals for exercising applicable privacy rights.

To submit a privacy request, email info@asyrx.com. We may need to verify your identity and, where applicable, your authority to act for another person. If the request concerns information controlled by an enterprise customer, we may direct the request to that customer.

Asyrx uses only strictly necessary cookies and browser storage for authentication, session management, security, and service functionality, as described in the Cookie Policy. Asyrx does not currently use advertising cookies, marketing-analytics cookies, or behavioural-tracking technologies.

The Services are designed for businesses and professional users and are not directed to children. Asyrx does not knowingly collect personal information from children in connection with enterprise use. If you believe a child has provided personal information directly to Asyrx, contact info@asyrx.com.

We may update this Policy as our Services, practices, or legal obligations change. We will post the revised version with a new Last Updated date and provide additional notice when required.