Legal
Privacy policy
Last updated
This policy explains what data Analux (“we”, “us”) collects, why, and how we handle it. It covers the website, the app and the API. The contractual terms for using the service are in our terms of service.
The short version
- Your data is yours. We do not sell it, and we do not use it to train AI models.
- The language model never sees your rows. It sees your question, column names, and the computed result of a reading. Every number is calculated by SQL and statistical code.
- History is kept until you remove it. Readings are the product, so they stay until you delete the gauge, the source or your account.
- No advertising or analytics cookies. The only cookie we set keeps you signed in.
1. Data we collect
We collect only what we need to run the service:
- Account data: your name, email address, a password hash (bcrypt) or your Google account identifier, and your workspace name.
- Your content: files you upload, the snapshots of them that gauges read from, the column types we detect, the questions you ask, gauge plans, and every reading a gauge produces with its explanation.
- Connection credentials: when you connect a live source, the credentials it needs, encrypted at rest and never shown again.
- Usage data: request logs, run times, error traces, IP address, and browser and operating system details.
- Communications: messages you send us.
We do not collect or store card details. Paid plans are paid through our payment providers, who handle your card; we store only your plan and a customer and subscription reference.
2. How we use it
- To run the gauges you create, on the schedule you set, and keep their readings in your workspace.
- To send the emails you have asked for: account emails such as verification and password reset, and gauge emails, which you can switch off per gauge in Settings.
- To secure the service, investigate abuse and fix errors.
- To meet legal obligations.
We do not sell or rent your data, share it with advertisers, or use your content to train AI models.
3. How AI is involved
Two models are involved, and neither of them calculates anything. A decision model (TypeSafe’s Jev) chooses between options when your sentence is turned into a proposed gauge plan: which column holds the number, how often to read it, what kind of gauge it is. It answers by picking from a list, with a confidence score, and when it is not confident Analux asks you instead of assuming. A language model (Anthropic) writes the plain-language explanation of a reading that is outside its normal range. You review every plan before anything is created.
Neither model calculates a number. Metrics, baselines, ranges, forecasts and level shifts are computed by SQL and statistical code that runs the same way every time. Between them the models receive your question, the names and detected types of your columns, and the computed result of a reading: values, ranges, and the names of segments such as a sales channel. They do not receive the rows of your data.
Readings are decision support, not decisions. Where local law gives you the right to contest or ask for human review of an automated outcome, write to privacy@analux.app and we will respond within 30 days.
4. How long we keep it
- Uploaded files and snapshots: while the source exists. Deleting the source removes them.
- Gauges and readings: until the gauge or your account is deleted. A gauge’s history is what makes it useful, so we do not expire it.
- Account records: until you delete the account.
- Logs: up to 90 days, longer only where needed for a security investigation.
- Billing records: for as long as tax law requires.
You can delete a source from the Data screen, a gauge from its page, and your whole account from Settings. Deleting a source also deletes the gauges on it. Rows are removed at once and stored files straight after. If you cannot sign in, email privacy@analux.app from the address on the account.
5. Service providers
We use a small number of providers to run the service. Each processes data only on our instructions and under a data processing agreement.
- Hosting and storage: application servers, a Postgres database, a job queue, and file storage for uploads and snapshots.
- Language model: Anthropic, receiving only what is described in section 3.
- Decision model: TypeSafe (Jev), receiving your question and your column names and types when a gauge is planned. It returns a choice, never text and never a number.
- Email delivery: Resend, for account and gauge emails.
- Payments: Paddle (the merchant of record) and Bachs, which take your payment and keep the billing records. They receive your email address, the plan you buy and an account reference, never your gauge data.
A current list is available from privacy@analux.app. We give 30 days’ notice before adding a provider that processes your content.
6. Security
- Encryption in transit, and at rest for connection credentials.
- Passwords stored only as bcrypt hashes.
- Sign-in tokens kept in memory; the session cookie is HttpOnly, Secure and rotated on use, and a reused one ends every session on the account.
- Production access limited and logged.
We will notify affected users of a personal data breach likely to result in a high risk within 72 hours of becoming aware of it. Report vulnerabilities to security@analux.app; we do not pursue good-faith researchers.
8. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you, and receive a copy in a portable format;
- correct it, or have it deleted;
- object to or restrict some processing, and withdraw consent;
- ask for human review of an automated outcome;
- complain to your data protection authority.
Email privacy@analux.app from the address on your account. We respond within 30 days.
9. Legal basis (GDPR and UK GDPR)
- Contract: to provide the service you signed up for.
- Legitimate interests: to secure and improve the service in ways you would reasonably expect.
- Consent: for anything optional, such as product news.
- Legal obligation: for tax, accounting and lawful requests.
10. Nigeria Data Protection Act 2023
If you are in Nigeria, the Nigeria Data Protection Act 2023 applies. We process personal data fairly, lawfully and only for the purposes set out here. Where personal data is transferred outside Nigeria, for example to our hosting or language model provider, we rely on safeguards permitted by the Nigeria Data Protection Commission, including data processing agreements. You may complain to the Commission at ndpc.gov.ng.
11. California (CCPA and CPRA)
California residents may know what personal information we collect and why, access, correct and delete it, and limit the use of sensitive personal information, without retaliation. We do not sell or share personal information for cross-context behavioural advertising. Requests go to privacy@analux.app.
12. International transfers
Our providers may process data outside your country. Where data leaves the EEA, the UK, Switzerland or Nigeria, we rely on Standard Contractual Clauses or equivalent protections.
13. Children
The service is not for anyone under 16. If you believe a child has given us data, write to privacy@analux.app and we will delete it.
14. Changes to this policy
We will announce material changes in the app and by email at least 14 days before they take effect.
15. Contact
Privacy questions and requests: privacy@analux.app. Security reports: security@analux.app.