Privacy Policy

Effective August 18, 2026

Ryvx Labs ("Ryvx", "we", "us") builds an autonomous AI security-testing tool. This policy explains what we collect when you use our dashboard, CLI, and website: why, who we share it with, and how you can control it.

Ryvx Labs is a trading name of a sole trader based in the United Kingdom, and is the data controller for the personal data described here. UK GDPR and the Data Protection Act 2018 apply. You can reach the controller at ryvx.pentesting@gmail.com, and we'll provide a postal address on request.

Information we collect

  • Account data: name, email, and authentication identifiers when you sign up (directly, or via an OAuth provider).
  • Scan data: target identifiers, findings, evidence (PoC artifacts, request/response traffic, screenshots), and audit trails generated by scans you run. This can include data from systems you've configured Ryvx to test.
  • Billing data: subscription tier and usage/credit consumption. Payment card details are collected and processed directly by our payment processor, Stripe; we do not store full card numbers.
  • Usage & log data: pages visited, API calls made, timestamps, IP address, and device/browser metadata, for security and reliability purposes.
  • Cookies: session cookies to keep you signed in to the dashboard. No third-party advertising cookies.
  • Website analytics: on the website only — never in the desktop app or CLI — Vercel Analytics and Speed Insights collect page views, referrer, coarse (country-level) location, and page load performance, to help us understand traffic and keep the site fast. Neither uses cookies or assigns you a cross-site identifier.

How we use it

  • Operate and secure the product (authentication, audit logging, abuse prevention).
  • Run the scans you request and generate findings/reports.
  • Process payments and manage subscriptions.
  • Respond to support requests.
  • Improve the product (aggregated, where possible de-identified, usage analysis).

Our legal basis (UK GDPR)

  • Performance of a contract: running the scans you ask for, keeping your account working, and billing you for it.
  • Legitimate interests: securing the service, preventing abuse, and understanding usage well enough to improve the product — balanced against your interests, and never for advertising.
  • Legal obligation: keeping billing records, and responding where the law requires disclosure.

Where your data goes

Some of the processors below are based outside the UK, primarily in the United States, so using the hosted service means your data is transferred internationally. Those transfers rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as offered by each provider. If you would rather your scan data never left your own machine, Ryvx also runs entirely locally — the CLI and desktop app can be pointed at a local model, and in that mode none of the processors below are involved at all.

Who we share it with

We do not sell your data. We share it only with the processors that make the service work, under contract, and only for that purpose: Supabase (auth & database hosting), Stripe (payment processing), our infrastructure/cloud providers (compute for running scans), our LLM provider(s) (to power the agent's analysis of scan data), and Vercel (website hosting, and the analytics described above — website only). We disclose data if legally required to.

Data retention

Scan evidence — findings, PoC artifacts, traffic captures, reports, and the index that points at them — is kept for 90 days from when a scan runs, then deleted. The audit trail of what a scan actually did is kept separately, for 365 days, because it's what a security or compliance review needs even after the underlying evidence is gone. Both windows are enforced by our retention code; as of today we still run that job by hand rather than on an unattended schedule, so treat these numbers as the policy we run, not a claim that it has been firing silently every night since day one. Billing records are the one exception: we keep those indefinitely, since they're the ledger that proves what you were charged for.

Ask us to delete your account's data early and we will, by hand, across every system that holds it — including scan evidence held in cloud storage, which today is a separate manual step alongside the database tables. Rows are removed from the live database immediately; copies can persist for up to 14 days in encrypted backups on the same infrastructure, until the normal backup rotation ages them out.

Your rights

Under UK GDPR you can ask us for a copy of your personal data, correct it, delete it, restrict or object to how we use it, and receive it in a portable form. You can also withdraw consent where we relied on it. Exercising any of these is free and won't affect how we treat you. If you think we've handled your data badly, you can complain to the Information Commissioner's Office (ico.org.uk) — though we'd rather you told us first so we can put it right.

To make a request, email ryvx.pentesting@gmail.com. We'll respond within 30 days.

Security

We use industry-standard technical and organizational measures (encryption in transit, access controls, audit logging) to protect your data. No system is perfectly secure; see our responsible disclosure policy to report a vulnerability.

Children

Ryvx is not directed at, and we do not knowingly collect data from, anyone under 16.

Changes to this policy

We'll post updates here and, for material changes, notify account holders by email.

Contact

Questions about this policy: ryvx.pentesting@gmail.com