Privacy Policy

This Privacy Policy explains how Tessryx LLC ("Tessryx," "we," "us," or "our") collects, uses, discloses, retains, and otherwise processes personal information in connection with the Tessryx platform and related services (the "Services").

Tessryx LLC is a California limited liability company located at 8605 Santa Monica Blvd #347695, West Hollywood, CA 90069. Questions about this Privacy Policy or our privacy practices may be directed to privacy@tessryx.com.

#1. How This Policy Applies

Tessryx provides infrastructure that customers use to build, host, and operate websites, applications, workflows, APIs, automations, and related services. Because of that structure, Tessryx may process personal information in different capacities depending on how you interact with the Services.

If you have a Tessryx account, workspace, or subscription, this Privacy Policy applies to the personal information Tessryx processes in connection with your account and use of the Services.

If you visit or sign in to a website or application built by a Tessryx customer, Tessryx may process limited information associated with authentication and operation of that site. If you provide information directly to the customer through its site, the customer generally determines how that information is used. Section 9 explains this distinction in more detail.

#2. The Roles Tessryx Plays

Tessryx processes personal information in different capacities depending on the context.

#When Tessryx Acts as a Controller

Tessryx acts as a controller when we determine why and how personal information is processed for our own purposes. This includes information associated with:

• Tessryx accounts and authentication;

• subscriptions, transactions, and billing administration;

• customer support and service communications;

• security, fraud prevention, and abuse prevention;

• service administration and operational records;

• compliance with legal obligations; and

• establishing, exercising, or defending legal rights.

The sections below describe this processing in more detail.

#When Tessryx Acts as a Processor

Tessryx acts as a processor when we process personal information on behalf of a customer and according to that customer's instructions. This may include personal information contained in customer datafiles, workflows, endpoints, forms, applications, media, and other Customer Content.

The customer determines the purposes for which that information is collected and used. If your personal information is processed by Tessryx solely on behalf of a customer, you should ordinarily direct privacy requests concerning that information to the customer. If you contact Tessryx, we may refer you to the customer or forward your request as appropriate.

Our Data Processing Addendum provides additional terms governing our processing of Customer Personal Data on behalf of customers.

#3. Personal Information We Collect

The personal information Tessryx collects depends on how you interact with the Services.

#Account Information

When you create or use a Tessryx account, we may collect your email address, the name you provide, workspace information, and information used to authenticate and secure your account.

If you sign in through a third-party identity provider, we receive the identifying and authentication-related information that provider makes available to Tessryx.

#Billing and Transaction Information

If you subscribe to a paid Tessryx plan or make another purchase, we maintain information about your plan, transactions, purchased credits, and billing contact details.

Payments are processed by Stripe. Tessryx does not receive or store your full payment card number.

#Usage and Technical Information

We collect information generated when you interact with the Services, which may include IP addresses, browser and device information, timestamps, pages accessed, API and MCP activity, workflow executions, and error and operational records.

#Session and Authentication Information

When you sign in, we maintain information associated with the session, including the IP address and browser information associated with the sign-in. This allows you to review active sessions and revoke sessions you do not recognize.

The IP address associated with a session is captured at sign-in and is not continuously updated to track your location.

#Support Communications

We collect information you provide when communicating with us about support, billing, security, privacy, or other service-related matters, together with our responses.

#Records of Agreements and Consents

When you accept Tessryx terms or policies, or provide an approval or consent through the Services, we may record the applicable version, action, and date.

We may retain these records after an account closes as reasonably necessary to document the terms, policies, approvals, or consents that applied and to establish, exercise, or defend legal claims.

#4. Customer Content and Workspace Data

Customers determine what they place in their Tessryx workspaces and what their applications and workflows process.

Customer Content may include schemas, datafiles, workflow and endpoint definitions, media assets, stored credentials, model prompts and completions, applications, and information submitted by visitors through customer-operated forms and endpoints.

To the extent Customer Content contains personal information, Tessryx processes that information on the customer's behalf to provide the Services and in accordance with the customer's instructions, the Customer Terms, and our Data Processing Addendum.

Tessryx does not use Customer Content to train machine learning or artificial intelligence models.

#Workflow Run Traces

When a workflow executes, Tessryx records information about what individual workflow steps received and returned so that customers can debug and operate their workflows. If personal information passes through a workflow, that information may therefore appear in a workflow run trace.

Workflow run traces are retained for 14 days and then deleted in accordance with our ordinary retention process.

#Edge Caching

Customers may configure content to be cached at the edge for a specified period. If cached content is later deleted or unpublished, it is no longer made available from the origin through the ordinary operation of the Services, although cached copies may continue to be served until the applicable cache period expires.

Copies previously retrieved or independently stored by third parties are outside Tessryx's control.

#5. How and Why We Use Personal Information

When Tessryx acts as controller, we use personal information for the following purposes:

Where we rely on legitimate interests, those interests may include securing and operating the Services, preventing misuse, maintaining reliable infrastructure, supporting customers, protecting legal rights, and protecting Tessryx, our customers, users, and others. We consider the impact of this processing on individuals and rely on legitimate interests where those interests are not overridden by applicable privacy rights.

Where applicable law permits or requires another legal basis for particular processing, we may rely on that basis as appropriate.

Tessryx does not sell personal information or share personal information for cross-context behavioral advertising, as those terms are defined under California law.

#6. How We Disclose Personal Information

We disclose personal information only as described below or as otherwise permitted or required by law.

#Service Providers and Infrastructure Providers

We use service providers to operate and secure the Services.

Our current infrastructure Subprocessors are identified on our Subprocessor page and include Amazon Web Services for infrastructure, hosting, storage, database, and email delivery services, and Cloudflare for content delivery, edge services, DNS, TLS, and network security.

We also use Stripe to process Tessryx subscription payments and related billing information. Stripe does not receive Customer workspace content from Tessryx for payment processing, and Tessryx does not receive or store full payment card numbers.

#Customer-Selected Third-Party Services

Customers can configure workflows, APIs, webhooks, integrations, and other features to transmit information to external APIs, AI providers, or other third-party services.

When a customer configures such a connection, Tessryx makes the transmission on the customer's instruction. The customer chooses the provider and determines what information is made available to it.

The third party's own terms and privacy practices govern its independent processing after receiving the information. A customer-selected provider does not become a Tessryx Subprocessor merely because the customer connects that provider to the Services.

#AI Assistants and Agents

Customers may connect AI assistants or agents to a Tessryx workspace through the Tessryx MCP interface or API. Depending on the permissions granted, the assistant or agent may receive Customer Content, schemas, workflow definitions, or other workspace information.

The customer controls which assistant or agent is connected and the scope of access authorized. Information transmitted to the provider is subject to that provider's applicable terms and privacy practices.

#Legal, Security, and Safety Disclosures

We may disclose information where reasonably necessary to comply with applicable law or valid legal process, enforce our agreements, investigate fraud or abuse, protect the security or integrity of the Services, or protect the rights, property, or safety of Tessryx, our customers, users, or others.

Where legally permitted and reasonably practicable, we will notify an affected customer before disclosing Customer Personal Data in response to a legally binding request.

#Business Transactions

Information may be disclosed or transferred in connection with an actual or proposed merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar corporate transaction, subject to appropriate confidentiality protections where applicable.

#7. Retention and Deletion

We retain personal information for different periods depending on its purpose and the system in which it is maintained.

Retention periods may vary where a longer period is required by law, reasonably necessary to resolve a dispute or enforce an agreement, or necessary to protect the security and integrity of the Services. Where information is retained for one of these purposes, we limit further processing to the applicable purpose.

#Residual Copies

When information is deleted from live systems, residual copies may remain for limited periods in recovery, versioning, and logging systems before being automatically purged through their ordinary retention cycles.

Depending on the system, information may remain for:

• up to 35 days in point-in-time recovery data;

• up to 30 days in retained file or object versions; and

• up to 90 days in applicable logs.

Residual information is retained for recovery, integrity, security, or legal purposes and is not used for unrelated purposes.

#Media Files

Media files uploaded to Tessryx are not versioned or backed up. If you delete or overwrite a media file, Tessryx may be unable to recover it. Customers should maintain independent copies of media and other content they cannot replace.

#8. Security

Tessryx maintains technical and organizational safeguards designed to protect personal information against unauthorized access, acquisition, disclosure, alteration, loss, or destruction.

Those measures include encryption in transit and at rest, access controls, tenant isolation, and other safeguards appropriate to the operation of the Services.

Certain product-specific protections include:

• Stored credentials are write-only. After a secret is stored, its value cannot be retrieved through the user interface, API, or MCP server and is available only for authorized use at execution time.

• Session cookies are encrypted and bound to the hostname that issued them.

• Pages requiring sign-in are not placed in a shared cache. This protection is enforced by the platform rather than left to customer configuration.

No system or method of transmission or storage can be guaranteed to be completely secure.

If a Personal Data Breach affects information for which Tessryx is responsible for providing notice, we will provide notice as required by applicable law. Where Tessryx processes affected information on behalf of a customer, we will notify and assist the customer as provided in our Data Processing Addendum.

#9. If You Use a Site Built on Tessryx

Customers use Tessryx to build and operate websites and applications. Some customer sites allow or require visitors to sign in using a Tessryx account. Customers may also collect information directly from visitors through forms, endpoints, applications, or other features.

The customer operating the site generally determines why information collected through that site is used. Tessryx processes Customer Personal Data on the customer's behalf.

#Signing In with Tessryx

Before Tessryx sends information to a customer site through Sign in with Tessryx, we display an approval screen on our own domain identifying the site and asking you to approve the connection. Each site requires its own approval.

If you are not a member of the customer's workspace, the site receives a pseudonymous identifier generated specifically for that customer. It does not receive your email address, your name, or information from workspaces you belong to.

Because the identifier is different for each customer, different Tessryx customers cannot use the identifier alone to determine that the same Tessryx account visited both customers' sites.

Tessryx treats this identifier as personal information because Tessryx can associate it with your account. The customer cannot use the identifier alone to derive your Tessryx account information.

#Workspace Members

If you are a member of the customer's workspace, a page restricted to workspace members or particular roles may also receive your email address and applicable workspace role. The approval screen identifies the relevant workspace and the information that may be provided.

Because the customer-specific identifier is stable, a customer may be able to associate activity from your earlier visits with your workspace membership after you join that customer's workspace. We disclose this when you approve the applicable connection or invitation.

#Your Approval and How to Revoke It

Approving one customer site does not authorize another site.

You can review and revoke your approvals at any time through Connected apps in your Tessryx account settings.

#Information Tessryx Keeps About the Connection

Your session on a customer site is maintained through an encrypted cookie in your browser and expires after 30 minutes. Tessryx does not maintain a separate server-side record of each visit.

We do retain a record that you approved the site, together with the IP address and browser information associated with the sign-in, so that you can review and revoke the connection. The approval record is maintained per site rather than per visit.

#Information You Provide Directly to a Customer

If you submit a name, email address, comment, form response, file, or other information directly through a customer-operated site, the customer determines how that information is used. Tessryx processes the information on the customer's behalf as part of providing the Services.

The customer is generally responsible for its own collection and use of that information and should provide its own privacy notice where required. Privacy requests concerning information controlled by the customer should ordinarily be directed to that customer.

#10. Cookies and Similar Technologies

Tessryx uses cookies and similar technologies necessary to provide and secure the Services, including to keep users signed in, maintain secure sessions, and remember preferences selected by users.

We do not currently use analytics, advertising, or cross-site tracking cookies through the Tessryx Services, and we do not use cookies to build advertising profiles about users.

Because the cookies we currently use are limited to those necessary to provide requested functionality and secure the Services, we do not currently request consent for those cookies except where applicable law requires otherwise.

Customer-operated sites may independently collect information through functionality configured by the customer. Customers are responsible for disclosures and consent mechanisms required for their own processing activities.

#11. Your Privacy Rights

Depending on where you live and the capacity in which Tessryx processes your personal information, you may have rights concerning that information.

These rights may include the right to:

• request access to personal information;

• request correction of inaccurate personal information;

• request deletion of personal information;

• receive certain personal information in a portable format;

• request restriction of certain processing;

• object to certain processing; and

• withdraw consent where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

These rights are subject to the conditions, limitations, and exceptions provided by applicable law.

#California Residents

California residents may have rights to know or access personal information, request correction or deletion, and receive information concerning certain uses or disclosures of personal information, subject to applicable exceptions.

California residents also have the right not to receive discriminatory treatment for exercising rights provided by applicable privacy law.

Tessryx does not sell personal information or share personal information for cross-context behavioral advertising.

#Exercising Your Rights

To exercise a privacy right concerning information for which Tessryx acts as controller, contact privacy@tessryx.com.

We may need to verify your identity or authority before completing a request. We will respond within the period required by applicable law.

If your request concerns information Tessryx processes solely on behalf of a customer, the customer is responsible for responding to the request. We may direct you to that customer or forward the request as appropriate.

#Complaints

You may have the right to complain to an applicable data protection authority.

If you are in the European Economic Area, you may generally lodge a complaint with the supervisory authority in the country where you live or work or where you believe an infringement occurred.

If you are in the United Kingdom, you may lodge a complaint with the Information Commissioner's Office.

#12. International Data Transfers

Tessryx is based in the United States, and our primary processing infrastructure is located in the United States. Some service providers may process information in other locations, including through globally distributed infrastructure.

Where personal information protected by the GDPR, UK GDPR, Swiss data protection law, or another applicable privacy law is transferred internationally in circumstances requiring a transfer safeguard, we use an appropriate transfer mechanism as required by applicable law.

Depending on the transfer, these safeguards may include the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another legally recognized transfer mechanism.

Customers requiring additional information concerning Tessryx's processing of Customer Personal Data, international transfers, or Subprocessors should review our Data Processing Addendum and Subprocessor page.

#13. Children

You must be at least 16 years old to create or maintain a Tessryx account.

Tessryx does not knowingly permit individuals under 16 to create Tessryx accounts. If we learn that an account has been created by an individual under 16, we will take appropriate steps to close the account and delete associated personal information, subject to applicable law and any information we must retain for legal, security, or compliance purposes.

If you believe an individual under 16 has created a Tessryx account or provided personal information directly to Tessryx, contact privacy@tessryx.com.

Tessryx customers are separately responsible for complying with laws applicable to visitors and users of the sites and applications they operate through the Services. As provided in our Acceptable Use Policy, customers may not use the Services to submit or process Personal Data concerning children under 13.

#14. Email Communications

We send service-related communications concerning accounts, billing, security, operation of the Services, and material changes to applicable terms or policies. These communications are part of providing and administering the Services and may continue while an account remains open where reasonably necessary.

We do not currently send marketing email.

If we begin sending marketing email, we will obtain consent where required, provide an unsubscribe mechanism in each marketing message, and will not make consent to marketing a condition of using the Services.

Withdrawing consent to marketing communications will not prevent us from sending transactional, security, billing, legal, or other service-related communications where appropriate.

#15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the Services, our practices, legal requirements, or other operational needs.

When we update the Policy, we will post the revised version with an updated Effective Date.

If a change materially affects how we collect, use, or disclose personal information, we will provide additional notice, such as by email or through the Services, before the change takes effect where required or appropriate.

We may retain prior versions as reasonably necessary to document the privacy terms that applied at a particular time.

#16. Contact Us

Questions about this Privacy Policy, Tessryx's privacy practices, or requests concerning personal information for which Tessryx acts as controller may be directed to:

Tessryx LLC
8605 Santa Monica Blvd #347695
West Hollywood, CA 90069
privacy@tessryx.com