Privacy Policy

Argelyx (“we”, “us”) is the service operated by Argelyx, and is currently in a limited beta. This policy describes what information we collect, why, and how it is handled while you use the service. If you have questions or a privacy request, contact us at support@argelyx.com.

What Argelyx does

Argelyx is an AI-assisted functional and user-experience testing tool. You give it a website you are authorized to test and a testing goal in plain language; it drives a browser through that goal and reports what it found. It is not a security scanner and does not perform vulnerability testing, and it never enters real payment details or completes a real purchase during a test.

Information we collect, and why

We collect the following categories of information, each for the purpose described:

• Account information — the email address and password (stored as a salted hash by our authentication provider, never in plain text) you use to sign up, plus basic workspace/organization details you create. Used to create and secure your account and let you sign back in — necessary to provide the service you signed up for.
• Website URLs and testing objectives you submit — the target URL and the plain-language testing goal you provide for each test run. Used to run the test you asked for and to show you the resulting report — necessary to perform the service at your request.
• Screenshots and test artifacts — screenshots, page text, and structured observations the browser automation collects while a test run visits the pages you asked it to test. Used to produce your report and as supporting evidence for any issue found — necessary to perform the service at your request.
• Service, usage, and observability logs — technical logs generated while a test runs or while you use the app (timestamps, run status, error codes, request metadata). These logs are structured and automatically redact anything that looks like a password, API key, authentication token, or payment card number before being stored. Used to operate, debug, and keep the service running reliably — our legitimate interest in a working, trustworthy product.
• Billing information — if you subscribe to a paid plan, payment details are collected and processed directly by Stripe, our payment processor. We do not receive or store your card number. Used to process payment for the plan you chose — necessary to perform that part of the service.

Where a lawful basis is required by applicable law, we process the categories above either because doing so is necessary to provide the service you asked for (performing our agreement with you), because it reflects our legitimate interest in operating, securing, and improving the service in a way that does not override your own rights, or because you have given consent (for example, by submitting a test). We do not use your data for advertising and do not sell personal information.

AI processing of your test data

Submitted URLs, testing objectives, and the pages a test run visits are sent to a third-party AI model provider (Anthropic) so it can plan and carry out your test — this processing is required for the service to function and is limited to what the test needs. We do not submit your account password or billing details to the AI provider.

Service providers and infrastructure

We rely on established infrastructure providers to run the service, and share only the data each provider needs to perform its role:

• Supabase — database, authentication, and storage for your account, test runs, and artifacts.
• Hosting/deployment infrastructure — runs the application and the worker process that executes browser-driven tests.
• Anthropic — AI model provider used to reason about and drive each test run, as described above.
• Stripe — payment processor for paid plans, where used.

These providers may process data on servers located outside your own country, including in the United States and the European Union, depending on the provider and region selected for our infrastructure. Where such international transfers occur, we rely on the safeguards and contractual protections each provider makes available (for example, standard contractual clauses or an equivalent mechanism), rather than any certification of our own.

Data retention and deletion

We retain account data, test run history, and associated artifacts (screenshots, reports, logs) for as long as your account is active, so you can review past test results. We decide how long to keep data based on whether it is still needed to provide the service to you, whether you still have an active account, and any legal or accounting obligation to retain particular records (for example, billing records). We have not yet fixed a specific retention period in days or months for every category; if you would like a specific answer for your own data, contact support@argelyx.com.

If you close your account or request deletion, we will delete or anonymize the personal data and artifacts associated with it within a reasonable period, except where we are required to retain certain records for legal or accounting purposes.

Your privacy rights

Depending on where you live, you may have rights to access the personal data we hold about you, correct it, request its deletion, receive a copy of it in a portable format, or object to or restrict certain processing. To exercise any of these rights, contact us at support@argelyx.com; we will respond within a reasonable time. If you are not satisfied with our response, you may have the right to lodge a complaint with your local data protection or privacy supervisory authority.

Security

We apply reasonable technical and organizational measures to protect your data, including access controls, encryption in transit, and redaction of sensitive values from logs. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We are not currently certified under any specific compliance framework (for example, SOC 2, HIPAA, or a formal GDPR certification).

Your responsibilities

You are responsible for only submitting websites you own or are otherwise authorized to test, and for not submitting real personal data, payment information, or other sensitive data as part of a testing objective. Do not use Argelyx to test systems you do not have permission to test.

Beta status and availability

Argelyx is currently offered as a limited beta. Features, limits, and this policy may change as the service develops, and we do not guarantee uninterrupted availability during the beta period. We will make reasonable efforts to notify users of material changes to this policy.

Contact

Questions about this policy, or requests regarding your data, can be sent to support@argelyx.com.