Privacy notice

1. Who is responsible

Controller: AIXY GATEWAY, S.R.L. UNIPERSONAL

Spanish tax number: B05579420

Registered office: Calle Islas Baleares, 14, escalera 1, piso 2, puerta A, 10001 Cáceres, Cáceres, Spain

Country: Spain

Privacy contact: [email protected]

2. Scope and roles

This notice covers aixy-gateway.com, the Aixy dashboard, direct sales and support interactions, and personal data for which Aixy decides the purposes and means.

When a customer sends prompts, responses or workload metadata through the gateway, the customer normally acts as controller and Aixy acts as processor. Those activities are governed by the customer's agreement and the Data Processing Addendum.

3. Data we process

• Account and organization data: name, business email, organization, role, project and team memberships.
• Authentication data: password hashes, session-token hashes, passkey public-key metadata, login and security events. Aixy does not store passkey private keys or biometric data.
• Service metadata: project, API key and user identifiers, selected provider and model, timestamps, tokens, cost, latency, routing and policy outcomes, error information, IP address and bounded user agent where required for security or audit.
• Customer content: prompts and responses only when an authorized customer administrator explicitly enables encrypted content capture. Content capture is disabled by default.
• MCP beta data: enabled server and tool configuration, encrypted user or shared connection credentials, agent-token hashes, and bounded call metadata such as server, tool, request ID, status and duration. Aixy does not retain MCP tool arguments or results in the call history.
• Billing data: plan, subscription identifiers, invoice and payment status. Payment-card data is handled by the payment provider when billing is enabled.
• Communications: business correspondence, support requests and transactional email delivery metadata.
• Website and security data: request metadata processed by the hosting and edge-security provider. The public website does not use advertising or audience-measurement cookies.

4. Purposes and legal bases

Aixy does not use customer prompts or responses to train its own models or for advertising. When Aixy acts as processor, the legal basis is determined by the customer controller.

5. Recipients and international transfers

Aixy uses infrastructure, edge delivery, operational monitoring, transactional email and payment suppliers as needed to provide the service. The current processing chain and review status are documented on the subprocessor page.

Aixy-operated regional infrastructure is based in AWS Europe (Frankfurt). A customer's selected model provider may process a request in another location. Before non-EEA transfers are enabled, Aixy and the customer must identify an applicable adequacy decision or appropriate safeguards such as Standard Contractual Clauses and assess any necessary supplementary measures.

6. Retention

• Operational analytics: Starter 5 days; Pro 30 days; Enterprise Custom.
• Optional encrypted prompt/response capture: 1 day, 3 days, 7 days, 30 days, 90 days, selected by an authorized customer administrator.
• Browser sessions: 12 hours by default and invalidated on logout, password reset or administrative revocation.
• Aixy-controlled production service logs: one day under the current infrastructure configuration. A separate deployment-drain function log is configured for seven days.
• Account and tenant data: for the active relationship. An owner-requested organization deletion stops access and schedules live tenant purge after 90 days, subject to documented holds, billing and dependency safeguards. Database backups expire seven days after creation and may therefore remain for up to seven additional days after live purge.
• Inactive free-tier organizations: the current designed process warns after 30 inactive days and requires at least 45 inactive days plus 15 complete days after accepted notices before a protected purge can proceed. Activity, paid service or uncertain telemetry cancels or postpones that path.
• MCP credentials and configuration: until disconnection, token revocation, server removal or tenant purge. Call history is bounded by count; a final time-based retention period is still being verified before general availability.
• Billing and legal records: for the applicable statutory period.

The normal 90-day tenant-termination schedule is not the automatic response to an individual erasure request. Rights requests are assessed without undue delay, including whether Aixy is controller or processor and whether a lawful exception applies. A narrowly scoped billing, dispute, security, privacy-request or legal hold may delay deletion of data that must be preserved. The public compliance claim remains disabled until user and tenant deletion, audit-snapshot handling, backup expiry and connected-vendor deletion are operationally verified.

7. Your rights

You may request access, rectification, erasure, restriction, portability or objection, and may withdraw consent where processing relies on consent. You may also object to decisions based solely on automated processing; Aixy does not make such decisions about website visitors or account users.

Send requests to [email protected]. Aixy will verify identity proportionately and respond without undue delay, normally within one month. You may complain to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority.

8. Security and changes

Aixy applies access control, encryption, tenant isolation, bounded retention, audit evidence and incident procedures described in its technical and organizational measures. No internet service can promise absolute security.

Material changes will be reflected on this page. Where required, Aixy will provide additional notice through the service or by email.