Privacy Policy
Effective August 29, 2026
Ryvx ("we", "us") builds an autonomous AI security-testing tool. This policy explains what we collect when you use our dashboard, CLI, and website: why, who we share it with, and how you can control it.
Ryvx is a trading name of a sole trader based in the United Kingdom, and is the data controller for the personal data described here. UK GDPR and the Data Protection Act 2018 apply. You can reach the controller at privacy@ryvx.dev, and we'll provide a postal address on request.
Information we collect
- Account data: name, email, and authentication identifiers when you sign up (directly, or via an OAuth provider).
- Scan data: target identifiers, findings, evidence (PoC artifacts, request/response traffic, screenshots), and audit trails generated by scans you run. This can include data from systems you've configured Ryvx to test.
- Billing data: subscription tier and usage/credit consumption. Payment card details are collected and processed directly by our payment processor, Stripe; we do not store full card numbers.
- Usage & log data: pages visited, API calls made, timestamps, IP address, and device/browser metadata, for security and reliability purposes.
- Website analytics: on the website only (never in the desktop app or CLI), Vercel Analytics and Speed Insights collect page views, referrer, coarse (country-level) location, and page load performance, to help us understand traffic and keep the site fast. Neither uses cookies or assigns you a cross-site identifier.
How we use it
- Operate and secure the product (authentication, audit logging, abuse prevention).
- Run the scans you request and generate findings/reports.
- Process payments and manage subscriptions.
- Respond to support requests.
- Improve the product (aggregated, where possible de-identified, usage analysis).
Our legal basis (UK GDPR)
- Performance of a contract: running the scans you ask for, keeping your account working, and billing you for it.
- Legitimate interests: securing the service, preventing abuse, and understanding usage well enough to improve the product, balanced against your interests, and never for advertising.
- Legal obligation: keeping billing records, and responding where the law requires disclosure.
Where your data goes
Some of the processors below are based outside the UK, primarily in the United States, so using the hosted service means your data is transferred internationally. Those transfers rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as offered by each provider. If you would rather your scan data never left your own machine, Ryvx also runs entirely locally: the CLI and desktop app can be pointed at a local model, and in that mode none of the processors below are involved at all.
Who we share it with
We do not sell your data. We share it only with the processors that make the service work, under contract, and only for that purpose: Supabase (auth & database hosting), Stripe (payment processing), our infrastructure/cloud providers (compute for running scans), our LLM provider(s) (to power the agent's analysis of scan data), Vercel (website hosting, and the analytics described above, website only), and Brevo (delivering every email we send, both the service emails and the mailing list described below). We disclose data if legally required to.
Data retention
Scan evidence (findings, PoC artifacts, traffic captures, reports, and the index that points at them) is kept for 90 days from when a scan runs, then deleted. The audit trail of what a scan did is kept separately, for 365 days, because it's what a security or compliance review needs even after the underlying evidence is gone. Both windows are enforced by our retention code; as of today we still run that job by hand rather than on an unattended schedule, so treat these numbers as the policy we run, not a claim that it has been firing silently every night since day one. Billing records are the one exception: we keep those indefinitely, since they're the ledger that proves what you were charged for.
Ask us to delete your account's data early and we will, by hand, across every system that holds it, including scan evidence held in cloud storage, which today is a separate manual step alongside the database tables. Rows are removed from the live database immediately; copies can persist for up to 14 days in encrypted backups on the same infrastructure, until the normal backup rotation ages them out.
Service emails
Separately from the mailing list below, we send emails that are part of the service itself: a receipt when a hosted scan you started finishes, and an invitation when someone adds you to their team. These aren't marketing, so they carry no unsubscribe link; you can't opt out of being told the scan you paid for is done. They stop when you stop using the thing that causes them.
One case worth stating plainly, because it involves someone who may not be our user at all: if you invite a person to your organisation, we process the email address you typed in order to send them that invitation, and it is passed to Brevo to deliver. We use it for that invitation and the record of it, nothing else; an invited address is never added to the mailing list, and never used to market to them. If you invite someone, you are the one deciding to send them that email; make sure that's something they would expect.
Mailing list
We run a separate marketing/release-notes mailing list for ryvx.dev, distinct from the account and scan data described above. The lawful basis for it is your consent, given by ticking the checkbox on the signup form: nothing is added to this list without that.
Signing up does not subscribe you immediately. We send a confirmation email, and you are only added to the list once you click the link in it. For each subscriber we store: your email address, the exact consent wording you agreed to (by version), the page you signed up from, and the time, IP address, and user agent recorded both when you signed up and when you confirmed. If you never confirm, that signup is deleted after 30 days.
Every email carries an unsubscribe link, and it works in one click, no account or sign-in needed. If you unsubscribe, we keep a record that your address opted out, but not the address itself: it's replaced with a one-way hash, kept only so a later signup with the same address can't silently re-add you by mistake. We use Brevo as the processor that delivers these emails, the same one that delivers the service emails described above.
Your rights
Under UK GDPR you can ask us for a copy of your personal data, correct it, delete it, restrict or object to how we use it, and receive it in a portable form. You can also withdraw consent where we relied on it. Exercising any of these is free and won't affect how we treat you. If you think we've handled your data badly, you can complain to the Information Commissioner's Office (ico.org.uk), though we'd rather you told us first so we can put it right.
To make a request, email privacy@ryvx.dev. We'll respond within 30 days.
Security
We use industry-standard technical and organisational measures (encryption in transit, access controls, audit logging) to protect your data. No system is perfectly secure; see our responsible disclosure policy to report a vulnerability.
Children
Ryvx is not directed at, and we do not knowingly collect data from, anyone under 16.
Changes to this policy
We'll post updates here and, for material changes, notify account holders by email.
Contact
Questions about this policy: privacy@ryvx.dev