Privacy Policy
This Privacy Policy explains how Aqlyx ("we", "us", or "our") collects, uses, and protects information when you use the Aqlyx platform at onboard.aqlyx.com and dashboard.aqlyx.com (the "Service"). We are committed to handling your data responsibly and transparently.
1. Information We Collect
| Category | Examples | How we collect it |
|---|---|---|
| Account information | Email address, company name, hashed password | Provided by you at signup |
| Business data | Orders, customer records, ad spend, web analytics, social metrics | Pulled from connected platforms (Shopify, Google Ads, Meta Ads, GA4, Instagram) via OAuth or API credentials you provide |
| Usage data | Questions asked in the dashboard, session activity, feature usage | Collected automatically as you use the Service |
| Payment information | Billing name, last 4 digits of card, subscription status | Provided by Stripe; we never see or store full card numbers |
| Technical data | IP address, browser type, session tokens | Collected automatically via server logs and cookies |
2. How We Use Your Information
We use the information we collect to:
- Provide, operate, and improve the Service
- Authenticate your identity and maintain session security
- Process payments and manage your subscription via Stripe
- Respond to your support requests and communications
- Send transactional emails (OTP codes, account notifications, billing receipts)
- Detect and prevent fraud, abuse, and security incidents
- Comply with legal obligations
We do not use your business data or conversation history to train AI models. We do not sell your data to third parties.
3. AI Processing
When you ask questions in the Aqlyx dashboard, your query and relevant data excerpts are sent to Anthropic's Claude API to generate a response. Anthropic processes this data subject to their Privacy Policy. We only send the minimum data needed to answer your question. Anthropic does not use API-submitted data to train models by default.
4. Data Storage and Security
Your data is stored in Microsoft Azure Blob Storage in the East US 2 region. We apply the following safeguards:
- All data in transit is encrypted via TLS 1.2+
- Data at rest is encrypted using Azure-managed keys
- Passwords are hashed using bcrypt; plaintext passwords are never stored
- Session tokens are 256-bit random values with a 24-hour expiry
- Access to production systems is restricted to authorised personnel only
No security system is perfect. If you discover a security vulnerability, please report it to support@aqlyx.com.
5. Third-Party Services
We share data with the following third parties only as necessary to operate the Service:
- Stripe: payment processing. Your card details are handled entirely by Stripe under their Privacy Policy.
- Microsoft Azure: cloud infrastructure and data storage.
- Anthropic: AI response generation via the Claude API.
- Google, Meta, Shopify: data source OAuth providers. We access only the scopes you explicitly authorise.
We do not share your data with advertisers, data brokers, or any other third parties.
6. Cookies and Session Tokens
We use:
- Session cookies: to keep you logged in during your visit. These expire when your session ends or after 48 hours.
- CSRF tokens: small tokens stored in cookies to protect form submissions from cross-site attacks.
We do not use advertising cookies or third-party tracking cookies.
7. Data Retention
We retain your account data for as long as your subscription is active. If you cancel or your account is terminated:
- Your business data (pipeline data in Blob Storage) is retained for 30 days and then permanently deleted.
- Your account record is retained for up to 90 days for legal and audit purposes, then deleted.
- Billing records may be retained longer where required by financial regulations.
8. Your Rights
Depending on your location, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Request deletion of your personal data
- Object to or restrict certain processing activities
- Receive a copy of your data in a portable format
- Withdraw consent at any time (where processing is based on consent)
To exercise any of these rights, email us at support@aqlyx.com. We will respond within 30 days.
9. Children's Privacy
The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a notice in the Service at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.
11. Contact
For privacy-related questions or to exercise your rights, contact us at:
support@aqlyx.com