Legal · Privacy
Privacy Policy
This policy explains how Sylphx Limited handles personal data on Sylphx-operated surfaces: what we collect, why, who receives it, how long we keep it, and your rights.
Key points
- Sylphx Limited is the controller of the personal data described here.
- We do not sell your personal information.
- We rely mainly on performing our contract with you and on our legitimate interests. You have the right to object to processing based on legitimate interests.
- Our customers control the data about their own users that they put into Sylphx; ask them first about that data.
- You can complain to the UK Information Commissioner’s Office.
This summary points to the numbered sections below, which are the policy.
1. Who We Are
The controller, what this policy covers, and what it does not.
Sylphx is provided by Sylphx Limited, a company registered in England and Wales (company number 16438428) ("we", "us", "our"). Registered office: 128 City Road, London EC1V 2NX. We are the controller of the personal data this policy describes: data about visitors to our sites, people who hold or use a Sylphx account, and people who contact us.
- Sylphx-operated surfaces
- This site, the console, the CLI, and the Sylphx APIs and SDKs when used to manage your account and projects.
- Customer applications
- Applications our customers build and run on Sylphx. For personal data about their users, the customer is the controller and we are its processor; the customer’s own privacy notice applies, and requests about that data should go to the customer first.
2. Information We Collect
What you give us, what the Service records, and what partners send us.
| Source | Category | What it includes |
|---|---|---|
| You provide | Account information | Name, email address, password, organisation and profile information |
| You provide | Billing information | Billing contact, billing address, tax details and transaction history; card details are handled by Stripe |
| You provide | Communications | What you send us when you contact support, report an issue or give feedback |
| You provide | Project content | Code, configuration and data you store or process through the Service |
| Collected automatically | Usage data | Pages visited, features used, actions taken and resource usage |
| Collected automatically | Device and log data | IP address, browser and operating system, device identifiers, access times, errors and API requests |
| Collected automatically | Cookies | As described in the Cookie Policy |
| Third parties | Sign-in providers | Basic profile information when you sign in with Google, GitHub or another provider |
| Third parties | Payment processors | Payment confirmations and billing status from Stripe |
3. How We Use It and Our Lawful Bases
Each purpose, with the UK GDPR lawful basis we rely on for it.
| Purpose | Lawful basis |
|---|---|
| Providing the Service: running your account and projects, deploying and serving your applications, and exporting or deleting data when you ask | Performing our contract with you; legitimate interests in providing the Service to the organisation you act for |
| Billing, invoices, collecting payment and tax records | Performing our contract; legal obligation; legitimate interests in being paid |
| Service messages: sign-in and security notices, receipts, usage alerts and changes to our terms | Performing our contract; legitimate interests |
| Keeping the Service secure and reliable: logs, monitoring use for abuse, fraud and breaches of our terms, usage limits, and fixing faults | Legitimate interests in a secure, working service and in preventing fraud |
| Improving the Service: understanding how features are used and measuring quality, using aggregated or de-identified data where we can | Legitimate interests in developing our service |
| Telling customers about Sylphx features and offers by email; you can unsubscribe at any time | Legitimate interests, for existing customers as UK and EU e-privacy law allows; consent where the law requires it |
| Answering support requests | Performing our contract; legitimate interests |
| Meeting legal duties, enforcing our terms, and establishing, exercising or defending legal claims | Legal obligation; legitimate interests |
| Business changes: if we sell, merge or reorganise all or part of our business, sharing data with the buyer or successor and their advisers | Legitimate interests |
| Optional analytics cookies | Consent, as the Cookie Policy describes |
Where we rely on legitimate interests, we have weighed them against your rights and freedoms. You can ask us for details of that assessment. We make no decisions about you by solely automated means that have legal or similarly significant effects on you.
We do not sell your personal information.
4. Who We Share It With
The recipients of personal data, and why each receives it.
| Who | Why |
|---|---|
| Sub-processors and service providers | Hosting, network protection, payment processing and other services that help us run Sylphx, under written terms |
| Stripe | Payment processing |
| Professional advisers, auditors and insurers | Legal, accounting, audit and insurance services |
| Courts, regulators and law enforcement | Where the law requires it, or where it is needed to protect our rights, our customers or others |
| A buyer or successor | In connection with a merger, acquisition, reorganisation or sale of assets |
The providers that process customer personal data, with their regions, are listed in Sub-processors. We may change these providers as the Service develops, and we keep that list current.
5. How Long We Keep It
As long as the purpose needs it, and longer only where the law or a claim needs it.
We keep personal data for as long as we need it for the purposes above: account data for as long as your account is open, and support and security records for as long as they are useful for those purposes. When you close your account, we delete or de-identify your personal data within a reasonable period.
Deleted data can remain in encrypted backups and technical logs for a limited period until they are overwritten. We keep billing records for as long as tax and accounting law requires, and we may keep other data where we need it to meet a legal duty, resolve a dispute, prevent fraud or abuse, or enforce our terms.
6. Security
The measures we take, and when we tell you about a breach.
We use technical and organisational measures appropriate to the risk, such as encryption in transit and at rest, access controls, tenant isolation and monitoring. The security page describes them. No system is completely secure. If a personal data breach happens, we notify the Information Commissioner where the law requires, and we tell you directly where it is likely to result in a high risk to your rights and freedoms.
7. Your Rights
Your rights under UK and EU data protection law, and how we answer requests.
| Right | What it means |
|---|---|
| Access | Get a copy of your personal data |
| Rectification | Have inaccurate or incomplete data corrected |
| Erasure | Have your data deleted |
| Restriction | Limit how we use your data |
| Portability | Receive data you gave us in a structured, machine-readable format |
| Objection | Object to processing, as set out below |
| Withdraw consent | Withdraw consent where we rely on it, without affecting past use |
Your right to object. Where we rely on legitimate interests, you have the right to object to that use of your data on grounds relating to your particular situation. You can object to direct marketing at any time, and we will stop.
To use a right, email contact@sylphx.com. We may ask you to confirm your identity. We answer within one month; if a request is complex or we receive several, we may take up to two more months and will tell you why within the first month. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse it, as the law allows.
You can complain to the UK Information Commissioner's Office at ico.org.uk, or, if you live in the EU, to your local data protection authority. We would appreciate the chance to deal with your concern first.
8. International Transfers
What protects your data when it is processed outside the UK or EEA.
Your data may be processed outside the UK and the European Economic Area, for example by providers listed in Sub-processors. Where it is, we rely on an adequacy decision or UK adequacy regulations, or use the safeguards the law provides, such as the UK International Data Transfer Agreement or Addendum and the EU Standard Contractual Clauses.
9. Cookies
Where the detail lives, and which cookies need your consent.
We use cookies and similar technologies that are strictly necessary to run and secure our surfaces, cookies that remember your preferences, and, only with your consent, analytics cookies. The Cookie Policy describes them and how to manage them.
10. Children
Sylphx accounts are for adults.
Sylphx is not intended for children, and account holders must be at least 18. If we learn that we hold a child's personal data, we may close the account and delete the data. A parent or guardian can contact us at contact@sylphx.com.
11. California Residents
The rights California law gives, where it applies.
Where California privacy law applies to us and to you, you may have the right to know what personal information we collect, use and disclose, to have it deleted or corrected, and not to be discriminated against for using these rights. We do not sell or share personal information as that law defines those terms. Requests go to the address below.
12. Changes to This Policy
How updates are published.
We may update this policy. We will post changes here and update the date above. Before we use your personal data for a new purpose, we will tell you, as the law requires.
13. Contact Us
Where privacy questions and rights requests go.
- contact@sylphx.com — privacy questions and rights requests.
- Phone
- +44 333 335 7935
- Company
- Sylphx Limited, a company registered in England and Wales (company number 16438428). Registered office: 128 City Road, London EC1V 2NX.
- Regulator
- The UK Information Commissioner’s Office, ico.org.uk.
Privacy questions and rights requests
Write to the address below to ask a question or use a right. The regulator route is in Your Rights.
Phone: +44 333 335 7935
Sylphx Limited, a company registered in England and Wales (company number 16438428). Registered office: 128 City Road, London EC1V 2NX. Phone: +44 333 335 7935. Email: hi@sylphx.com.