1 Data Controller
Nyroxis AI (nyroxis.ai) is operated by Nyroxis, acting as a sole trader / individual operator. For the purposes of the General Data Protection Regulation (GDPR), Nyroxis is the Data Controller responsible for your personal data.
Contact: contact@nyroxis.com
Website: https://nyroxis.ai
We are committed to processing your personal data in compliance with the GDPR (Regulation (EU) 2016/679) and all applicable data protection laws.
2 Data We Collect
We collect the minimum data necessary to provide our cybersecurity AI service. We do not use cookies, analytics trackers, advertising pixels, or third-party behavioral tracking of any kind.
| Category | Data | Purpose |
|---|---|---|
| Account data | Email address, hashed password | Account creation, login, communication |
| Conversation data | Messages you send and AI responses | Providing the AI assistant service |
| Usage data | Token usage count, plan type, reset dates | Subscription management, quota enforcement |
| Billing data | Subscription status, payment confirmation | Managed entirely by Lemon Squeezy — we do not store payment card details |
| Technical data | IP address (for guest sessions only) | Security and abuse prevention |
| Security alert data | Rule name, severity, channel, source IP (HMAC-hashed — never stored raw) | AI Copilot analysis for nyroxis.fr users (with explicit consent) |
| Email tokens | Temporary verification/reset tokens | Email verification, password reset |
🔒 No Cookies, No Tracking. Nyroxis AI does not use cookies, Google Analytics, Facebook Pixel, or any other tracking technology. Your browsing activity on our platform is not tracked or profiled.
3 How We Use Your Data
We use your data only for the following purposes:
- Providing the service — Processing your cybersecurity questions through our AI assistant
- Account management — Creating and maintaining your account, verifying your email address
- Subscription management — Tracking usage against your plan limits, processing subscription changes
- Security — Detecting and preventing abuse, unauthorized access, or fraud
- Communication — Sending transactional emails (verification, password reset, workspace invitations)
📵 Your data is never used to train AI models. Messages you send to Nyroxis AI are processed in real-time to generate responses and are not used to train or fine-tune any AI model, including Anthropic's Claude models.
4 Legal Basis for Processing
Under GDPR Article 6, we rely on the following legal bases:
| Processing Activity | Legal Basis |
|---|---|
| Providing the AI assistant service to registered users | Contract — Art. 6(1)(b): necessary for performing our service agreement |
| Email verification and password reset | Contract — Art. 6(1)(b): necessary to maintain account security |
| Subscription and billing management | Contract — Art. 6(1)(b): necessary to fulfil your paid subscription |
| Security and fraud prevention | Legitimate interests — Art. 6(1)(f): preventing abuse and protecting users |
| Guest session tracking (IP address) | Legitimate interests — Art. 6(1)(f): preventing service abuse for free trial |
5 Third-Party Processors
We work with the following third-party processors to operate our service. Each processor is bound by data processing agreements and handles data only as instructed:
-
🤖
Anthropic, PBCProcesses your chat messages in real-time to generate AI responses. Anthropic is bound by a Data Processing Addendum (DPA) incorporating EU Standard Contractual Clauses. API data is not used for training.
Anthropic Privacy Policy -
🇫🇷
OVH SASOur VPS server and database hosting provider. All primary data storage (user accounts, conversations) is located on servers in Roubaix, France, EU.
OVH Privacy Policy -
💳
Lemon SqueezyPayment and subscription management. Lemon Squeezy acts as the Merchant of Record and handles all payment card data. We receive only subscription status notifications.
Lemon Squeezy Privacy Policy -
📧
ResendTransactional email delivery (verification emails, password resets, workspace invitations). Only your email address is shared for delivery purposes.
Resend Privacy Policy
6 International Data Transfers
Your data is primarily stored and processed within the European Union (OVH servers in France). However, when you use our AI assistant, your messages are processed by Anthropic's API servers located in the United States.
This international transfer is protected by:
- Standard Contractual Clauses (SCCs) — Anthropic's DPA incorporates EU SCCs (Module Two) as required by GDPR Article 46(2)(c), providing appropriate safeguards for EU-to-US data transfers
- No training use — Anthropic does not use API customer data for model training
- Data minimization — Only the text content of your messages is transmitted; no additional personal identifiers are sent to Anthropic's API
By using Nyroxis AI, you acknowledge that your chat messages are transmitted to Anthropic's servers in the United States for real-time processing, under the protections described above.
7 Data Retention
| Data Type | Retention Period | Reason |
|---|---|---|
| Account data (email, password hash) | Until account deletion | Required for service provision |
| Conversations — Free plan | 7 days (automatic deletion) | Storage optimization for free tier |
| Conversations — Paid plans (Pro, Team, Business) | Until account deletion | Full history access for paid users |
| Email tokens (verification, reset) | 24 hours (verification) / 1 hour (reset) | Security — short-lived tokens only |
| Alert analyses (nyroxis.fr) | 90 days (automatic deletion) | nyroxis.fr AI Copilot — auto-deleted by scheduled job |
| Guest session data | 30 days | Abuse prevention |
| Billing / subscription records | As required by Lemon Squeezy and applicable law | Financial and legal obligations |
When you delete your account, all personal data (account information, conversations, messages) is permanently deleted from our servers immediately. We do not retain deleted data.
8 Your Rights under GDPR
As a data subject under GDPR, you have the following rights. To exercise any of these rights, contact us at contact@nyroxis.com. We will respond within 30 days.
Request a copy of all personal data we hold about you (Art. 15).
Request correction of inaccurate or incomplete data (Art. 16).
"Right to be forgotten" — request deletion of your data (Art. 17). You can also delete your account directly in the app.
Request that we restrict processing of your data in certain circumstances (Art. 18).
Request your data in a structured, machine-readable format (Art. 20).
Object to processing based on legitimate interests (Art. 21).
We take all privacy concerns seriously and aim to resolve them directly with you. Please contact us first at contact@nyroxis.com and we will do our best to address your concerns promptly.
9 Security Measures
We implement appropriate technical and organizational measures to protect your personal data:
- Encryption in transit — All data transmitted via HTTPS/TLS 1.2+
- Password security — Passwords are hashed using bcrypt (never stored in plaintext)
- Authentication — JWT tokens with 24-hour expiry
- EU infrastructure — Primary data stored on OVH servers in France
- Daily backups — Automated encrypted database backups with 7-day retention
- Rate limiting — IP-based rate limiting to prevent brute force attacks
- No third-party tracking — No analytics tools, cookies, or tracking scripts
In the event of a personal data breach that poses a risk to your rights, we will notify the relevant supervisory authority within 72 hours and inform affected users without undue delay, as required by GDPR Article 33.
10 Age Requirements
Nyroxis AI is a professional cybersecurity tool intended for use by individuals aged 16 years or older, in compliance with GDPR Article 8.
We do not knowingly collect personal data from children under 16. If you believe a person under 16 has created an account, please contact us at contact@nyroxis.com and we will delete the account promptly.
11 Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make significant changes, we will:
- Update the "Last Updated" date at the top of this page
- Notify registered users by email if the changes materially affect how we process your data
Continued use of Nyroxis AI after changes take effect constitutes your acceptance of the revised policy.
12 Contact Us
For any privacy-related questions, data subject requests, or concerns, please contact us:
Data Controller: Nyroxis
Email: contact@nyroxis.com
Website: https://nyroxis.ai
Response time: Within 30 days of receiving your request
We take all privacy concerns seriously and aim to resolve them directly with you.