Privacy Policy

Argelyx (“we”, “us”) is the service operated by Argelyx Ltd, and is currently in a limited beta. This policy describes what information we collect, why, and how it is handled while you use the service. If you have questions or a privacy request, contact us at support@argelyx.com.

What Argelyx does

Argelyx is an AI-assisted functional and user-experience testing tool. You give it a website you are authorized to test and a testing goal in plain language; it drives a browser through that goal and reports what it found. It is not a security scanner and does not perform vulnerability testing, and it never enters real payment details or completes a real purchase during a test.

Information we collect, and why

We collect the following categories of information, each for the purpose described:

• Account information — the email address and password (stored as a salted hash by our authentication provider, never in plain text) you use to sign up, plus basic workspace/organization details you create. Used to create and secure your account and let you sign back in — necessary to provide the service you signed up for.
• Website URLs and testing objectives you submit — the target URL and the plain-language testing goal you provide for each test run. Used to run the test you asked for and to show you the resulting report — necessary to perform the service at your request.
• Screenshots and test artifacts — screenshots, page text, and structured observations the browser automation collects while a test run visits the pages you asked it to test. Used to produce your report and as supporting evidence for any issue found — necessary to perform the service at your request.
• Service, usage, and observability logs — technical logs generated while a test runs or while you use the app (timestamps, run status, error codes, request metadata). These logs are structured and automatically redact anything that looks like a password, API key, authentication token, or payment card number before being stored. Used to operate, debug, and keep the service running reliably — our legitimate interest in a working, trustworthy product.
• Free-trial abuse prevention — when a Free workspace starts a test and a trusted client IP address is available, we derive a keyed, one-way digest of the address (for IPv6, the /64 network prefix). We link this pseudonymous digest to the workspace and test to limit how many new Free workspaces may start trials from the same network in a rolling 24-hour window. We also use verified website and test-run records, along with whether a workspace previously held a paid subscription, to enforce the one-time Free trial across workspaces and websites. We rely on our legitimate interest in preventing abuse of the free offer; you can request a review.
• Authentication rate limiting — to protect sign-in, sign-up, confirmation and password reset, we use keyed digests of client network addresses and email addresses. These help limit automated attempts and repeated messages. Our legitimate interest is protecting accounts and the service against abuse. These digests are pseudonymous personal data, not anonymous information. Raw network addresses and email addresses are not stored in these rate-limit tables, although your email is separately held as account information.
• Billing information — if you subscribe to a paid plan, payment details are collected and processed directly by Stripe, our payment processor. We do not receive or store your card number. Used to process payment for the plan you chose — necessary to perform that part of the service.

Where a lawful basis is required by applicable law, we process these categories because doing so is necessary to provide the service you request (including running tests), or because of our legitimate interests in operating, securing, and protecting the service from abuse, subject to your rights and interests. If we introduce optional processing that requires consent, we will ask for it separately. Simply submitting a test is not treated as consent to unrelated processing. We do not use your data for advertising and do not sell personal information.

AI processing of your test data

Submitted URLs, testing objectives, and the pages a test run visits are sent to a third-party AI model provider (Anthropic) so it can plan and carry out your test — this processing is required for the service to function and is limited to what the test needs. We do not submit your account password or billing details to the AI provider.

Service providers and infrastructure

We rely on established infrastructure providers to run the service, and share only the data each provider needs to perform its role:

• Supabase — database, authentication, and storage for your account, test runs, and artifacts.
• Hosting/deployment infrastructure (Vercel and Render) — runs the application and the worker process that executes browser-driven tests.
• Anthropic — AI model provider used to reason about and drive each test run, as described above.
• Stripe — payment processor for paid plans, where used.
• Sentry — error monitoring for our application servers. When something fails on our side, a short diagnostic report is sent so we can find and fix the fault: the type of error, where included an error message from which web addresses, email addresses, and secret-looking values have been removed, the place in our code where it happened, the software version, and internal reference numbers (for example of a test run or workspace). It does not receive your password, payment details, the content or screenshots of websites you test, or recordings of your sessions, and it is not used to track your browsing; your browser does not send anything to Sentry directly. This is our legitimate interest in a reliable service.

Hosting and authentication providers may also process network addresses in their ordinary request and security logs, separately from the pseudonymous rate-limit records described above.

These providers may process data on servers located outside your own country, including in the United States and the European Union, depending on the provider and region selected for our infrastructure. Where such international transfers occur, we rely on the safeguards and contractual protections each provider makes available (for example, standard contractual clauses or an equivalent mechanism), rather than any certification of our own.

Data retention and deletion

We retain account data, test run history, and associated artifacts (screenshots, reports, logs) for as long as your account is active, so you can review past test results. We decide how long to keep data based on whether it is still needed to provide the service to you, whether you still have an active account, and any legal or accounting obligation to retain particular records (for example, billing records). We have not yet fixed a specific retention period in days or months for every category; if you would like a specific answer for your own data, contact support@argelyx.com.

Free-trial network digests stop being used for trial decisions after 24 hours. A scheduled cleanup normally deletes expired rows within another five minutes. Cleanup delays or unusually large backlogs can extend storage, but do not extend their 24-hour use window. Authentication rate-limit records are used in windows of 15 or 60 minutes. Their expired records are deleted during later authentication activity, and may remain stored longer when traffic is low.

Free-trial website usage is calculated from existing verified-domain and test-run records. Paid-history and support-exception records remain while relevant to the workspace, website and their test history, subject to deletion requests and legal obligations. Notes about website-level exemptions are retained until revoked or no longer needed.

If you close your account or request deletion, we will delete or anonymize the personal data and artifacts associated with it within a reasonable period, except where we are required to retain certain records for legal or accounting purposes.

Your privacy rights

Depending on where you live, you may have rights to access the personal data we hold about you, correct it, request its deletion, receive a copy of it in a portable format, or object to or restrict certain processing. To exercise any of these rights, contact us at support@argelyx.com; we will respond within a reasonable time. If you are not satisfied with our response, you may have the right to lodge a complaint with your local data protection or privacy supervisory authority.

If you believe a Free-trial restriction was applied incorrectly, for example because you share a network with other users or recently acquired a website, contactsupport@argelyx.com to request a manual review. We can grant an exception when appropriate. You can also object to processing based on legitimate interests, and we will consider your request under applicable data-protection law.

Security

We apply reasonable technical and organizational measures to protect your data, including access controls, encryption in transit, and redaction of sensitive values from logs. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We are not currently certified under any specific compliance framework (for example, SOC 2, HIPAA, or a formal GDPR certification).

Your responsibilities

You are responsible for only submitting websites you own or are otherwise authorized to test, and for not submitting real personal data, payment information, or other sensitive data as part of a testing objective. Do not use Argelyx to test systems you do not have permission to test.

Beta status and availability

Argelyx is currently offered as a limited beta. Features, limits, and this policy may change as the service develops, and we do not guarantee uninterrupted availability during the beta period. We will make reasonable efforts to notify users of material changes to this policy.

Company and privacy contact

Argelyx Ltd is registered in England and Wales under company number 17433467. Registered office: 128 City Road, London, EC1V 2NX, United Kingdom.

Questions about this policy, or requests regarding your data, can be sent to support@argelyx.com.