Privacy Policy

Algorix (“Algorix”, “we”, “us”, or “our”) provides managed private n8n hosting, integration, and infrastructure services through algorix.online and the Algorix client portal. This Privacy Policy explains how we collect, use, share, and protect personal data when you visit our website, create an account, subscribe to a plan, submit onboarding or credential information, or contact us.

For personal data processed to operate our website, manage accounts, and provide the Services, Algorix is the data controller unless we say otherwise in a separate agreement. Where we process data on behalf of a client, the client is the controller and we act as a processor.

This policy does not apply to third-party websites, platforms, or models that you or we connect to the Services. Those providers have their own privacy policies.

Information you provide

• Account and contact details such as your name, email address, company, role, and any phone number you choose to provide.
• Onboarding and business information such as your infrastructure preferences, target workflows, current tools, goals, and success metrics.
• Deployment credentials such as cloud or VPS details, API keys or tokens, subdomain and DNS information, and workflow rules needed to deliver the Services. These are encrypted at rest.
• Communications such as support emails, client portal messages, project inquiries, and feedback.
• Billing and subscription details such as your plan, billing status, and any payment-provider customer, subscription, and transaction identifiers. Payment card details are handled by the payment provider, not by us.

Information collected automatically

• Authentication data such as your Firebase user identifier, sign-in provider, and session information.
• Technical and usage data such as IP address, browser and device type, pages visited, referring pages, timestamps, and error or security logs.
• Analytics data collected through Vercel Analytics to understand aggregate website traffic and performance.

Information from third parties

We may receive account and authentication information from Firebase, billing and transaction information from our payment provider, and information from service providers that help us operate the Services.

We use personal data to:

• Provide the Services — create and manage accounts, complete onboarding, deploy and maintain workflows, and operate the client portal (performance of a contract).
• Process payments and subscriptions — manage plans, invoices, renewals, and billing records through our payment provider (performance of a contract and legal obligations).
• Communicate with you — respond to inquiries, provide support, send service notices, and share updates about your deployment (performance of a contract or our legitimate interests).
• Protect the Services — detect fraud, prevent abuse, secure accounts, and investigate security incidents (our legitimate interests and legal obligations).
• Improve our Services — analyse aggregate usage, diagnose errors, and develop new features (our legitimate interests).
• Comply with law — meet tax, accounting, record-keeping, and other legal requirements (legal obligations).
• Establish or defend legal claims — manage disputes, enforce our Terms, and protect our rights (our legitimate interests).

We use your contact details to provide the Services, respond to inquiries, send transactional or service-related messages, and administer your account. We do not add account holders to marketing audiences, and we do not send promotional email. Where we rely on consent for a specific communication, you may withdraw it at any time. Withdrawing consent does not affect processing that happened before withdrawal. We do not use your personal data for automated decision-making that produces legal or similarly significant effects.

When billing is enabled, a payment provider acting as merchant of record will be identified at checkout and will collect and process your payment details, billing address, tax information, and transaction data under its own privacy policy. We receive subscription and transaction information needed to provide the Services, such as your plan, status, customer identifier, and amount.

We process client data to configure, deploy, and maintain the workflows you request. Depending on your deployment, data may remain in infrastructure you control, such as your own cloud account or private VPS, or may pass through service providers that support the Services.

We do not sell client data, and we do not use confidential client data to train general-purpose models unless you instruct us to do so or agree in writing. Workflows may use third-party providers and APIs that you select or approve; those providers process data under their own terms and privacy policies.

You are responsible for ensuring you have a lawful basis to submit personal data and for avoiding special-category or highly sensitive data unless we have agreed in writing to appropriate safeguards.

We do not sell, rent, or share personal data for advertising or marketing purposes. We do not use the personal data you provide to build marketing audiences, and we do not provide marketing services to third parties.

Our Services are limited to managed private infrastructure for internal business operations and system-to-system integrations. Any message sent through a client workflow must be transactional or service-related, directed to people with an existing relationship and a lawful basis for contact, and compliant with applicable law.

You can read the full permitted scope and enforcement process in our Acceptable Use Policy.

We share personal data only as needed to operate the Services, comply with law, or protect rights. Recipients may include:

• Supabase — database and backend infrastructure for profiles, onboarding, purchases, and portal records.
• Firebase / Google — authentication and user identity services.
• Payment provider — payment processing, subscription billing, tax, and merchant of record services, once billing is enabled.
• Resend — transactional and account email delivery.
• Vercel — website hosting, deployment, and privacy-friendly analytics.
• Cloudflare — bot protection and security challenges, including Turnstile.
• Integration providers — only those you select or approve for your workflows, such as model, CRM, ERP, email, or cloud providers.
• Professional advisers and authorities — auditors, lawyers, accountants, insurers, law enforcement, regulators, or courts where required or reasonably necessary.
• Business successors — a buyer or successor in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality.

We do not sell personal data or share it for cross-context behavioural advertising. We require service providers to protect data and use it only for the purposes we specify.

We and our service providers may process personal data in countries other than your own, including the United States. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or other lawful transfer mechanisms. You may contact us for more information about the safeguards we use.

We keep personal data only for as long as necessary for the purposes described above:

• Account and profile data — while your account is active and for up to 30 days after deletion, unless longer retention is required by law.
• Billing and tax records — generally up to 7 years to meet accounting and tax obligations.
• Deployment credentials — while the engagement is active, then deleted or returned within 30 days of termination unless you ask us to retain them. Encrypted backups may persist for up to 90 days.
• Security and technical logs — generally up to 90 days, unless needed to investigate an incident or comply with law.
• Support and portal communications — generally up to 24 months after the last interaction.
• Project inquiries that do not become engagements — generally up to 12 months.

We use technical and organizational measures designed to protect personal data, including encryption in transit, encryption at rest for stored credentials using AES-256-GCM, least-privilege access controls, authentication safeguards, monitoring, and backup procedures.

No method of transmission or storage is completely secure. If we become aware of a personal data breach that requires notification, we will notify affected parties and regulators as required by applicable law.

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to request a portable copy. You may also have the right to withdraw consent and to lodge a complaint with your local supervisory authority.

To exercise your rights, email contact@algorix.online. We may need to verify your identity before responding. We will respond within the timeframe required by applicable law, generally within 30 days. We do not discriminate against you for exercising your privacy rights.

If you are a California resident, you may also request information about the categories of personal information we collect, the sources, the business purposes, and the categories of recipients. We do not sell or share personal information for cross-context behavioural advertising as those terms are defined by the CCPA/CPRA.

We use essential cookies and local storage to keep you signed in, secure your session, and remember basic preferences. Blocking these technologies may prevent the client portal and authentication from working.

We use Vercel Analytics to understand aggregate website traffic and performance. It is designed to be privacy-friendly and does not use cookies for cross-site tracking. We do not use advertising cookies or sell data to ad networks. You can control cookies through your browser settings and opt out of non-essential analytics where available.

The Services are intended for businesses and professional users. They are not directed to children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will take appropriate steps to delete it.

We do not use personal data for solely automated decisions that produce legal or similarly significant effects. Automated features in the Services are assistive: they generate suggestions and workflow outputs, but you remain responsible for reviewing them and for any decisions you make using them. If you have questions about how a particular workflow uses automated processing, contact us.

Our website and client portal may link to third-party sites or connect to third-party services. We are not responsible for their privacy practices. We encourage you to review their privacy policies before providing personal data. Our Terms of Service and Refund Policy also apply to your use of the Services.

We may update this Privacy Policy from time to time. We will post the revised version and update the date above. If changes are material, we will provide reasonable notice by email or through the client portal. Continued use of the Services after the effective date means you acknowledge the updated policy.

For privacy questions, requests, or complaints, contact us at contact@algorix.online. We will try to resolve your concern promptly.

Algorix is the business name under which we operate algorix.online. For privacy questions, data requests, or complaints, write to contact@algorix.online. Formal business details, including the contracting entity where one applies, are set out in the applicable service agreement or order form and on invoices.

You also have the right to complain to a data protection authority in your country of residence, place of work, or where an alleged infringement occurred. If you are in the European Economic Area or the United Kingdom, you can find your local authority through the European Data Protection Board or the UK Information Commissioner’s Office.