Legal
Privacy Policy
How nyxory processes the personal data for which we are the controller. Deutsche Fassung.
1. Controller
The controller under Art. 4(7) GDPR is nyxory GmbH, named in the Imprint. For all privacy questions and data-subject requests: privacy@nyxory.com.
2. What we process, why, and for how long
| Data | Purpose and legal basis | Retention |
|---|---|---|
| Account data — email address, GitHub handle, password hash | Providing the service (Art. 6(1)(b) GDPR) | Until you delete your account; backup copies within 30 days |
| Technical access data — IP address, user agent, timestamps | Operations, security and abuse prevention (Art. 6(1)(f) GDPR) | Up to 30 days; security events in our SIEM up to 90 days |
| Platform usage data — tool calls your coding agent makes to our MCP server, agent briefings without secret values, deployment outcomes | Operating and improving the service, aggregated (Art. 6(1)(f) GDPR); object at any time via privacy@nyxory.com | Raw data for as long as operations and troubleshooting require; aggregates without personal reference indefinitely |
| Communication — emails, support tickets, chat messages | Handling your request (Art. 6(1)(b) and (f) GDPR) | 3 years where § 147 AO applies |
| Billing data — billing address, VAT ID, payment-method token, invoices | Billing and statutory retention (Art. 6(1)(b) and (c) GDPR) | 10 years under § 147 AO / § 14b UStG |
Data you process in your own applications and projects on the platform (repository contents, deployed applications, their databases and logs, agent runs, AI Gateway inputs and outputs) we process on your behalf as a processor. That is governed solely by our Data Processing Agreement with its platform data sheet: subprocessors, AI model providers, processing locations, retention periods and technical and organisational measures live there, not here. Towards your end users you remain the controller.
We process no special categories of personal data (Art. 9 GDPR) and do not knowingly collect data from children under 16. We do not sell data.
3. Recipients and data locations
The platform, including account data and backups, runs on infrastructure of Infomaniak Network SA in Switzerland (European Commission adequacy decision, Art. 45 GDPR). Media files of this website and our security monitoring (SIEM) are hosted by Hetzner Online GmbH in Germany. Beyond that we use service providers for payment processing, email delivery and correspondence mailboxes, and for our support and operations tooling, all of which process your data only on our instructions. Some of these providers also process data in the United States; the basis is the EU-US Data Privacy Framework or Standard Contractual Clauses. The platform's subprocessors and the change procedure are listed in the platform data sheet of the Data Processing Agreement.
4. Cookies and analytics
The console sets strictly necessary session cookies only. Product analytics run on Plausible, cookieless and without storing anything on your device. We use no ad cookies, tracking pixels or conversion measurement for advertising platforms.
5. Your rights
You have the rights of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR), to withdraw consent (Art. 7(3) GDPR) and to lodge a complaint with a supervisory authority (Art. 77 GDPR). Send requests to privacy@nyxory.com; we respond within one month.
6. Security
Encryption in transit and at rest, isolated customer namespaces and role-based access control; the detailed measures are in the platform data sheet of the Data Processing Agreement. Please report vulnerabilities as described in our Security Policy.
7. Changes
We announce material changes by email and on nyxory.com at least 14 days before they take effect.
8. Language
The German version is binding. This English version is a translation for information; in case of conflict the German version prevails.