Xynyx Privacy Policy

RepresentMe Talent Systems LLC, a Texas limited liability company operating the Xynyx platform ("Xynyx," "we," "us"), provides software that helps product teams collect feedback, decide what to build, and ship changes to their own software with human approval at each step.

This policy explains what information we collect, why, and who we share it with.

1. Two different roles

Xynyx handles information in two distinct capacities, and your rights differ depending on which applies.

• As a controller — for the accounts of our customers and their team members. If you signed in to a Xynyx dashboard, this policy governs your information and you can exercise the rights in section 8 directly with us.
• As a processor — for information submitted through the Aura feedback widget embedded in a customer's own product. If you sent feedback through a widget on someone else's site, that company decides what is collected and how long it is kept, and we process it on their instructions. Direct access and deletion requests to them; we will support their response.

2. Information we collect

2.1 Account information

• Email address, and a password if you create one.
• If you sign in with GitHub, Google, or Microsoft, we receive your email address and basic profile information from that provider. We request only the minimum scopes needed to identify you, and we never receive your password for those accounts.
• Organization name, and the roles and permissions assigned to each member.

2.2 Source code and repository access

Xynyx connects to a customer's source code repository in order to propose and open changes. With the customer's authorization we read repository contents, commit history, and build or error output, and we write branches and pull requests.

Access is granted per repository by the customer and can be revoked at any time from their source control provider. Repository contents are used to carry out the customer's instructions and for no other purpose.

2.3 Feedback submissions

Feedback sent through the Aura widget may include the text of the submission, attached screenshots, and — where the customer has configured identified submissions — an identifier for the person submitting.

Screenshots are supplied by the submitter and may incidentally contain personal information that was on screen. We ask submitters not to attach anything they would not want shared with the operator of that product.

2.4 Payment information

Subscriptions are processed by Stripe. Card details are submitted directly to Stripe and are never received or stored by Xynyx. We retain a Stripe customer and subscription identifier and the status of the subscription.

2.5 Information collected automatically

• Usage and performance data via Vercel Analytics.
• IP address and email address, recorded briefly and in a limited form to rate-limit sign-in and password-reset requests and to prevent abuse.
• An audit record of actions taken in a workspace, including who took them and when.

3. What we do not collect

Xynyx does not take custody of customers' third-party API keys or credentials. Where a workflow requires an external service we link you to that provider and confirm you have completed setup — we do not ask you to paste the secret value into Xynyx, and we do not store it.

4. Automated processing and AI

Xynyx uses large language models to summarize feedback, draft specifications, and propose code changes. Submission text, repository contents, and related context are sent to the model providers listed in section 5 for this purpose.

These providers are used under their commercial API terms, which do not permit customer content to be used to train their models. Consequential decisions — approving a change and merging it — are gated on a human at the customer organization, not made automatically by a model.

5. Service providers

We share information with the following providers, each only as needed to operate the Service:

• Vercel — application hosting and usage analytics
• Supabase — database, authentication, and file storage
• Stripe — subscription billing and payment processing
• Resend — transactional email delivery
• GitHub — source control access and sign-in
• Anthropic, OpenAI, and Google — large language model processing

We may also disclose information where required by law or valid legal process, or to protect our rights or the safety of others. If Xynyx is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction; we will give notice before it becomes subject to a different policy.

We do not sell personal information, and we do not use it for targeted advertising.

6. Security

Access to customer data is restricted by tenant and by role, enforced at the database level. Data is encrypted in transit and at rest by our infrastructure providers. No system is perfectly secure, and we cannot guarantee absolute security.

7. Retention

Account information is retained while the account is active. Abuse-prevention records are retained only for the length of their rate-limiting window. Audit records are retained for the life of the workspace, so that customers keep an accurate history of who approved what.

On account closure we delete or anonymize personal information within a reasonable period, except where we are required to keep it for legal or accounting purposes.

8. Your rights

You may have the right to access, correct, delete, or obtain a portable copy of your personal information, and to appeal a refusal.

If you are a Texas resident, the Texas Data Privacy and Security Act gives you these rights, and we will respond within 45 days. Residents of other states and countries may have comparable rights under their own law; we apply the same process regardless of where you live.

To exercise any of them, contact us using the details in section 11.

If your information reached us through a customer's feedback widget, see section 1 — that request is best directed to the company operating the product you were using.

9. Children

Xynyx is a business product and is not directed to anyone under 18. We do not knowingly collect personal information from children. If we learn that we have, we will delete it.

10. Changes

We may update this policy. Material changes will be posted here with a revised effective date, and where the change is significant we will notify account holders by email.

11. Contact

RepresentMe Talent Systems LLC Email: legal@xynyx.ai Web: xynyx.ai