This policy explains what personal data TRIXY INC ("VAKYN", "we") collects through vakyn.com, the console and the hosted VAKYN API, why, who else handles it, and what you can do about it. For data in your account, we are the controller. For personal data inside the documents you send to the API, your organization is the controller and we process it on your organization's behalf.
What we collect
From your sign-in provider. When you sign in with Google, GitHub or X, we receive your name, email address, profile picture and the provider's account id. We never receive your password.
About your account and organizations. The organizations you belong to, your role in each, invitations you send or receive, and settings you choose.
API keys. We store a one-way hash of each key and its first characters, so you can recognize it. We cannot show a key again after it is created.
Usage. For each API call: the time, the key and organization used, the number of input tokens, the charge, a request id and whether the call succeeded. This is how we bill you and show your usage.
Documents and questions you send to the API (inputs). We process them to produce the answer, then discard them. We do not keep inputs or outputs after the call returns, except in short-lived error logs (kept at most 14 days) when a call fails and we need to find out why.
Payments. Stripe processes your payment. We receive the amount, currency, tax, the last four digits and brand of the card, your billing country and the receipt. We never receive your full card number.
Messages. Emails you send us and our replies.
Technical data. Your IP address and browser details in server logs, kept up to 30 days for security and to fix problems.
Cookies. One sign-in cookie that keeps you logged in, and your light or dark theme choice in your browser's storage. We use no advertising or analytics cookies and no tracking pixels.
Why we use it
- To run the Service: sign you in, run your organizations, answer API calls, charge your balance.
- To send you service email: invitations, receipts, low-balance warnings, and notices about changes to our terms or prices.
- To keep the Service secure and stop fraud and abuse.
- To meet legal and tax obligations.
We do not sell personal data, and we do not use your inputs or outputs to train models unless your organization agrees to it in writing.
If you are in the UK or the European Economic Area, our legal bases are: performing our contract with you (running the Service, billing, service email), our legitimate interests (security, fraud prevention, improving the Service using usage records), and legal obligation (tax and accounting records).
Who else handles it
| Who | What for | Where |
|---|---|---|
| JEKYO LTD | Hosting of the website, console and database | United Kingdom |
| Stripe | Payments, tax calculation, receipts | United States, EU |
| Namecheap | Sending and receiving email | United States |
| Google, GitHub, X | Sign-in, when you choose that provider | United States |
| GPU hosting providers we rent from | Running the hosted model on your inputs, which are not stored there | Varies; listed on request |
We may also disclose data when the law requires it, to protect people or the Service, or to a buyer or successor if our business changes hands, under this policy.
How long we keep it
- Account and organization data: while your account is open, then deleted within 30 days of closing it.
- Usage and payment records: 7 years, for tax and accounting.
- Server logs: up to 30 days. Error logs that contain inputs: up to 14 days.
- Database backups: up to 14 days, after which deleted data is gone from them too.
Your rights
You can see, correct, download or delete your personal data. Most of it is in the console; for anything else, email us and we will answer within 30 days. Closing your account deletes your account data, except records we must keep by law.
If you are in the UK or EEA you can also object to or restrict some processing, and complain to your data protection authority (in the UK, the ICO). If you are a California resident, you have the right to know, delete and correct personal information, and not to be discriminated against for using these rights. We do not sell or share personal information for cross-context behavioral advertising.
International transfers
TRIXY INC is a US company and our servers are in the United Kingdom, so your data may be handled in the US and the UK. Where we transfer personal data out of the UK or EEA, we rely on adequacy decisions or standard contractual clauses.
Security
Connections are encrypted, API keys are stored only as hashes, and access to production systems is limited to the people who run them. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.
Children
The Service is not for anyone under 18, and we do not knowingly collect their data.
Changes
We will post changes here and change the date at the top. For material changes we will also email account holders before they take effect.
Contact
TRIXY INC · vali@vakyn.com