Privacy notice

Legacy Edge Private Limited, registered in India and trading as Nyraxis, operates nyraxis.io and the Nyraxis service. Contact compliance@nyraxis.io for privacy questions, grievances or requests.

For account administration, website operation, billing and direct enquiries, Nyraxis determines the processing purposes. For workload content an organization submits for evaluation, tracing or testing, we process on that organization’s instructions, subject to the applicable agreement. Your organization determines its purposes and lawful basis. A private deployment may place additional operating responsibilities on its operator.

• Account and access: name, email, authentication identifiers, password hashes where applicable, sessions, organization membership and roles. Enabled SSO, passkeys and two-factor features involve their associated authentication records.
• Customer workload: submitted prompts and outputs, agent configuration, trace/span metadata, policy findings, test cases, scan results and reports. Content retained depends on capture settings and the operation.
• Operations: technical request and security records, IP addresses, browser information and service failures. Infrastructure providers may keep separate access logs.
• Commercial and support: plan and order identifiers, subscription state, correspondence and information you provide when requesting support or a demo. Payment details entered into Polar’s checkout are handled by Polar.
• Optional measurement: consented feature/area and bounded CTA events through the configured analytics service, technical browser information and an in-memory identifier. The integration does not identify users by name or email or record sessions.

We receive information from you, your workspace administrators, configured integrations, identity providers and payment-service notifications.

Where GDPR or UK GDPR applies, the basis depends on the relationship and processing:

Provide an individual’s contracted service

Contract necessity for account access and delivery where you are the contracting individual.

Operate business workspaces, support and secure the service

Legitimate interests in administering business relationships, preventing abuse and maintaining reliable access, balanced against individuals’ rights. This includes business contact details where the contract is with your employer.

Billing and legal records

Contract administration, legitimate interests and applicable legal obligations, depending on the record and requirement.

Optional product analytics

Your consent. Declining or withdrawing does not prevent use of the service.

Customer-controlled workload processing

The customer’s documented instructions and applicable processing agreement; the customer is responsible for its legal basis.

Required account information is needed to provide access. Optional analytics and demo enquiries are optional. We do not use customer workload content to train Nyraxis general-purpose models. External model providers’ processing and retention terms depend on the selected service and agreement; review them before sending sensitive information.

Evaluation sends submitted text to the configured Nyraxis API. Selected detectors or judges can also send it to another model endpoint. Metadata-only storage restricts retained content; it does not prevent evaluation processing or external egress. Request-level restrictions cannot expand the organization’s capture ceiling.

Workspace retention is configurable. Automatic workload cleanup is currently off on the shared service; contact us to agree and arrange deletion rather than relying on the setting alone. Cleanup covers eligible traces, completed or terminal scans and test-run records; it does not promise that account records, saved regression payloads, billing records, exports or backups share that lifetime. Changing capture mode does not erase historical content.

Account, support and security records remain as needed for the relationship, security, dispute handling and legal obligations. Exact infrastructure log and backup expiry, legal-record schedules and deletion arrangements must be established for the deployment. Request that schedule before submitting data requiring a fixed deletion deadline. See data handling and processing terms.

Authorized workspace users may see organization data according to their access. Service providers can process information for hosting, delivery, payments, support, evaluation and optional analytics. Customer-configured models, alert destinations and exports introduce additional recipients.

Our provider directory explains each integration and when it is used. A configured integration is not proof that every deployment uses it. We may disclose information where law requires it or to protect rights and service security, subject to applicable law. A business transfer may require disclosure under appropriate safeguards and notice.

We do not sell personal information or use this integration for cross-context behavioural advertising. Global Privacy Control disables optional analytics in this application.

Our primary hosted application database is in Ireland. Some model-backed evaluation and transactional email processing uses services in the United States, and authorized operations or support can involve access from India. Other destinations depend on the identity, payment and customer-selected services used. Regional database hosting does not mean all processing stays in that region.

We do not make a universal EU-only hosting or transfer-safeguard claim. Ask for the deployment’s region, provider entities, remote-access locations and applicable transfer documentation. Where EEA or UK transfer rules apply, the required mechanism and any supplementary measures must be assessed and documented for the transfer before the affected personal data is transferred. A link to a provider’s terms is not evidence of an executed agreement.

Sign-in, security and chosen interface preferences use essential cookies or local storage. Optional analytics, when enabled, starts only after you allow it and uses memory rather than a persistent analytics identifier. Automatic click capture, user-profile identification and session replay are disabled. Browser error reporting is disabled; configured server error monitoring sends a minimal error receipt with raw details withheld.

The Cal.com calendar loads only when you select “Load booking calendar”; you can book by email instead. Payment and identity providers process information when you use their services. Their separate notices apply to their own processing.

Use cookies and privacy choices to allow or withdraw optional analytics. A browser choice lasts up to 180 days and can be changed earlier. If browser storage is blocked, the choice applies only to the page session. Clearing storage removes it.

Depending on the law that applies, you may request access, correction, deletion, a portable copy, restriction, objection, or withdrawal of consent. Where applicable you may appeal a decision or raise a grievance. Rights can have legal limits and exceptions. Withdrawal affects future consent-based processing and does not undo lawful earlier processing.

Contact compliance@nyraxis.io with the request type and relevant account or workspace. Do not send passwords, API keys, identity documents or workload content in the first email. We may need proportionate verification and authorization. For requests governed by GDPR, we respond without undue delay and within one month of receipt. If an extension is permitted because of complexity or the number of requests, we explain it within that first month; an extension can add up to two further months. We explain any refusal and the applicable complaint and judicial-remedy options.

If an organization controls the data, contact that organization first; we assist its authorized instructions where applicable. Account deletion is not the same as deletion of shared organization records or every third-party copy. See the request guide.

You may complain to the competent data protection authority where the relevant law gives that right, including your EEA supervisory authority or the UK Information Commissioner where applicable. You do not need to contact us before exercising that right.

The product includes authentication, organization authorization, API-key controls and capture restrictions. Hosting encryption, TLS, backups, key management, operational access and deletion execution depend on deployment and require verification. Read security and assurance scope.

Use synthetic data for early testing. Do not submit regulated health data, special-category data, children’s data or other restricted information without an agreed lawful scope, necessary contractual terms and verified controls. Detector availability or a policy template does not establish permission or regulatory compliance.

The service is intended for professional use and is not directed to children under 16. Do not create a child’s account or submit children’s information without an agreed lawful basis and safeguards. Tell us if you believe a child’s information was provided inappropriately.

Nyraxis returns automated policy and test results. The customer controls the application action and remains responsible for review and any legal requirements for decisions affecting individuals. A detector result is not a legal determination.

We update this notice as the service changes and identify the revision date above. Material changes may also require direct notice or renewed consent, as applicable. Contact compliance@nyraxis.io for a copy, deployment-specific information or a privacy concern.