# Privacy Policy Canonical: https://fairleadhq.com/legal/privacy/ Updated: 2026-10-01 Publication state: published Product version: platform Agent summary: Privacy Policy for the Fairlead platform, operated by Allyx, Inc. How Allyx handles personal data on the Fairlead platform. ## Prerequisites - None declared. ## Inputs - None declared. ## Outputs - None declared. ## Limitations - None declared. ## Permissions - None declared. ## Privacy - None declared. How Allyx handles personal data on the Fairlead platform. Allyx, Inc. ("**Allyx**," "**we**," "**us**," or "**our**") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with products, services, events, websites, and applications that link to this Policy (together, the "Allyx Services" or "Services"). Please read this policy carefully. By using our Services, you acknowledge that you have read and understood this Privacy Policy. ## 1. Two Types of Personal Data We Handle This policy covers two distinct contexts in which Allyx handles personal data: ### 1.1 Account and Business Data (Allyx as Controller) When you use our Services, create an account, communicate with our team, or enter into a commercial relationship with us, Allyx collects and processes personal data for which Allyx acts as the data controller. This data relates to our customers' representatives, Service visitors, and business contacts. This section of our Privacy Policy describes how we handle that data. ### 1.2 Customer Application Data (Allyx as Processor) When our customers use the Services, their application data — including traces, logs, session recordings, and source code metadata — is processed through our platform. This data may contain personal data relating to end users of our customers' applications. When processing this data, Allyx acts as a data processor on behalf of the customer (the data controller), under the terms of the applicable Data Processing Agreement. Allyx does not control, and is not responsible for, the privacy practices of its customers with respect to their end users. If you are an end user of a customer's application and have questions about how your data is handled, please contact that customer directly. ## 2. Personal Information We Collect ### 2.1 Information You Provide Directly We collect information about you when you provide it to us directly. - **Account information:** We collect information about you when you create an account with us, such as your name, email address, profile picture, company name, postal address, phone number, and payment information. - **Support information:** We collect information you provide to us when you open a support request or otherwise communicate with us (such as through third-party websites). This may include your name, email address, title, company, and any other information you provide with your request. - **General information:** We collect information you provide as a survey or feedback responses, requests the information, including name, email address, telephone number, IP address, and online identifiers. - **Service information:** We collect personal information submitted to us when you are using our Services, including the information provided in logs, traces, and metrics. This information may include a name, email address, IP address, online identifiers, and mailing address. ### 2.2 Information We Collect Automatically We automatically collect information about you when you access or use Allyx Services. - **Your use of Allyx Services:** We collect information about how you use the Allyx Services, such as your session date, time, and duration; the pages you viewed and feature used; action was taken within the Service; and the page you visited before navigating to the Services. - **Technical information:** We collect information about your computer or device when you access any of Allyx Services, such as the type of browser you use, your IP address, operating system, device identifiers, referring URL, and the location of your device. - **Cookies and similar technologies:** As described in our Cookie Policy at [fairleadhq.com/legal/cookies](https://fairleadhq.com/legal/cookies/). ### 2.3 Information We Collect from Other Sources We may also obtain information about you from other sources. - **Other services are linked to your account.** We may collect information about you when you link your Allyx account with other services. For example, when you log in using a third-party identity provider (Google, GitHub, or Microsoft), we receive your name, email address, and profile picture from that provider, subject to your settings with that provider. - **Through Allyx Services.** We may receive information about you from other users using Allyx Services. - **Third parties.** We may receive information about you from third parties that provide business information to us or from public sources. This information may include things like your name, title, email address, phone number, and social media profile. We may combine this information with information we collect through other means described above. ### 2.4 Sensitive Personal Data **Account and business data (controller role):** We do not intentionally collect special categories of personal data (Article 9 GDPR) or "sensitive personal information" (as defined under the CCPA/CPRA and other US state privacy laws) about our Services visitors or account holders, and we ask that you not provide it. **Customer application data (processor role):** Because the Services ingests traces, logs, recorded sessions, and other technical data from customer environments, sensitive or special-category personal data may be present in the customer data that passes through the Services. Allyx does not solicit such data and processes it only as a processor on the customer's documented instructions. Customers are responsible for having a lawful basis to include such data and must not submit special-category data except as expressly authorized in writing (see our Terms of Service §3.5 and our Data Processing Agreement). Where we process sensitive personal information, we use it only to provide the Services and not for any other purpose. ### 2.5 Job Applicant Data If you apply for a role at Allyx, we collect the information you provide (such as your name, contact details, CV/résumé, and employment history) and information from recruiting platforms or referrals. We use it solely to evaluate your application and run our recruitment process, on the basis of taking steps at your request prior to a potential employment contract and our legitimate interest in hiring. We retain applicant data for no longer than 24 months unless you consent to a longer period or we are required to retain it by law, and we do not use it for marketing. ## 3. How We Use Your Information We use the personal data we collect for the following purposes and on the following legal bases: | Purpose | Legal Basis (GDPR) | Legal Basis (CCPA) | |---|---|---| | Creating and managing your account | Performance of contract | Business purpose | | Providing and supporting the Services | Performance of contract | Business purpose | | Processing payments and sending invoices | Performance of contract | Business purpose | | Communicating about your account, incidents, and services updates | Performance of contract / Legitimate interests | Business purpose | | Responding to support requests | Performance of contract | Business purpose | | Detecting and preventing fraud and security incidents | Legitimate interests | Business purpose | | Analyzing aggregate usage to improve the Services | Legitimate interests | Business purpose | | Sending marketing and product update emails | Consent (where required) / Legitimate interests | Business purpose (with opt-out) | | Protecting the vital interests of a data subject (e.g., emergencies) | Vital interests | Business purpose | | Complying with legal obligations | Legal obligation | Legal obligation | Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms; you may request information about that balancing assessment by contacting us. ## 4. How We Share Your Information We do not sell your personal information. We share personal data only as described below. ### 4.1 Service Providers (Sub-processors) We share personal data with third-party vendors who process it on our behalf to enable us to provide the Services and operate our business. These organizations, called "sub-processors", are identified below with their locations and the types of services they provide to Allyx. | Vendor | Location | Purpose | |---|---|---| | Google LLC | USA, EU | Infrastructure services; AI services; user analytics and marketing insights; identity provider for authentication | | Axiom, Inc. | USA, EU | Observability and log management | | Cloudflare, Inc. | USA, EU | A global edge platform, infrastructure services, AI services | | GitHub | USA | Identity provider for authentication | | Microsoft Corporation | USA | Identity provider for authentication | The vendors marked "Sub-processor" process Customer Data on our behalf and are listed as authorized sub-processors in our DPA. We maintain a current sub-processor list at [fairleadhq.com/legal/subprocessors](https://fairleadhq.com/legal/subprocessors/). We will provide at least thirty (30) days' advance notice of material changes to our sub-processor list. ### 4.2 Business Transfers If Allyx is acquired, merges with another company, or transfers all or a portion of its assets, personal data may be transferred as part of that transaction. We will notify affected users of any such transfer and any resulting material change to data handling. ### 4.3 Legal Requirements We may disclose personal data if required to do so by law, regulation, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Allyx, our customers, or the public. Where legally permitted, we will provide prior notice to affected users. ### 4.4 With Your Consent We may share your information with third parties when you have explicitly consented to such sharing. ### 4.5 Aggregated and De-Identified Data We may create and use aggregated or de-identified data that does not identify you. We maintain such data as de-identified, do not attempt to re-identify it, and use it only for purposes such as improving and securing the Services. ## 5. International Data Transfers Allyx is incorporated in the United States, and our primary infrastructure is operated in the United States by Google Cloud Platform. If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, your personal data is transferred to the United States. For transfers of personal data from the EEA, UK, or Switzerland to the United States, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission (Commission Decision 2021/914), together with the UK International Data Transfer Addendum and the Swiss adaptations where applicable, as the legal basis for the transfer. A copy of our SCCs is available upon written request to legal@fairleadhq.com. **EU Representative (Article 27 GDPR):** Allyx is established in the United States and does not have an establishment in the EU/EEA. To the extent Article 27 of the GDPR requires it, Allyx will designate a representative in the EU/EEA for data protection matters and will publish that representative's name and contact details in this section upon appointment. Until an EU representative is appointed, EU/EEA data subjects may contact Allyx directly at legal@fairleadhq.com. ## 6. Data Retention We only keep your personal information for as long as necessary to fulfill the purposes we collected it for, after which it will be deleted or archived unless we are required to keep it to comply with our legal obligations or for another legitimate and lawful purpose. To determine the appropriate retention period for personal information, we consider several factors, including: - the terms of our agreements with you; - our legitimate interests (as outlined in this Privacy Policy); - our legal obligations; - the amount and nature of your personal information. In some cases, we may anonymize your personal information so that you are no longer identifiable, in which case we may use the resulting information without further notice to you. ## 7. Your Rights Depending on your location, you may have the following rights regarding your personal data: ### 7.1 Rights Available to All Users - **Access:** Request a copy of the personal data we hold about you. - **Rectification:** Request correction of inaccurate or incomplete data. - **Erasure:** Request deletion of your personal data, subject to legal retention obligations. - **Portability:** Receive your personal data in a structured, machine-readable format. - **Objection:** Object to processing based on legitimate interests. - **Restriction:** Request that we limit our processing of your data in certain circumstances. - **Withdraw consent:** Where processing is based on consent, withdraw it at any time (without affecting the lawfulness of prior processing). ### 7.2 Additional Rights Under GDPR (EEA and UK Users) EEA and UK residents have the rights listed in Section 7.1 under the GDPR and UK GDPR. You also have the right to lodge a complaint with your local supervisory authority. A list of EU supervisory authorities is available at edpb.europa.eu. ### 7.3 Additional Rights Under US State Privacy Laws Residents of California (CCPA, as amended by the CPRA) and of other US states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, and Texas) have, depending on their state of residence, the following rights: - **Know / Access:** the categories and specific pieces of personal information we collect, the sources, the business or commercial purposes, and the categories of third parties to whom we disclose it. - **Delete:** request deletion of personal information we collected from you. - **Correct:** request correction of inaccurate personal information. - **Portability:** receive your personal information in a portable, machine-readable format. - **Opt out of sale/sharing and targeted advertising:** Allyx does not sell or share personal information (as those terms are defined under the CCPA and other US state privacy laws), and does not process it for cross-context behavioral or targeted advertising. - **Limit use of sensitive personal information:** to the extent we process sensitive personal information, we use it only as necessary to provide the Services and not for purposes that would trigger a right to limit under applicable law. - **Opt out of profiling:** we do not engage in profiling that produces legal or similarly significant effects. - **Non-discrimination:** we will not discriminate against you for exercising your rights, and we do not offer financial incentives in exchange for personal information. **California "Shine the Light" (Civil Code § 1798.83):** We do not disclose personal information to third parties for their own direct-marketing purposes. ### 7.4 Exercising Your Rights To exercise any of the rights described above, please contact us at: - **Email:** legal@fairleadhq.com - **Response time:** We will respond within thirty (30) days of receiving a verified request (or within 45 days if we notify you of an extension). We may need to verify your identity before processing your request. We will not charge a fee for exercising your rights, unless your request is manifestly unfounded, excessive, or repetitive. Because Allyx operates exclusively online, we accept privacy requests by email at legal@fairleadhq.com. ### 7.5 Authorized Agents You may use an authorized agent to submit a request on your behalf. We may require the agent to provide proof of your written authorization and may require you to verify your identity directly with us. ### 7.6 Appeals If we decline to act on your request, you may appeal by emailing legal@fairleadhq.com with "Privacy Appeal" in the subject line. We will respond to your appeal within the period required by applicable law (for example, within 60 days under the Virginia VCDPA). If your appeal is denied, you may contact your state Attorney General or supervisory authority. ### 7.7 Opt-Out Preference Signals (Global Privacy Control) Some browsers and extensions transmit opt-out preference signals such as the Global Privacy Control (GPC). Because Allyx does not sell or share personal information or use it for targeted advertising, there is currently no such processing to opt out of. If our practices change, we will treat a valid GPC signal as a request to opt out where required by law. ## 8. Marketing Communications You can opt out of marketing emails at any time using the unsubscribe link in those emails or by contacting us. Even if you opt out of marketing, we will still send you service-related and transactional messages (such as billing, security, and account notices). ## 9. Cookies We use cookies and similar tracking technologies to collect information about your interactions with Allyx Services. For detailed information about the cookies we use, their purpose, and how to control them, please see our Cookie Policy at [fairleadhq.com/legal/cookies](https://fairleadhq.com/legal/cookies/). ## 10. Children's Privacy The Services are not directed to individuals under the age of 16 in the EU/EEA and UK, United States and other jurisdictions. We do not knowingly collect personal data from children under the applicable minimum age. If we become aware that we have collected personal data from such a child, we will take steps to delete such information promptly. If you believe we have inadvertently collected data from a minor, please contact us at legal@fairleadhq.com. ## 11. Security We implement commercially reasonable administrative, technical, and physical security measures to protect your personal data from unauthorized access and against unlawful processing, accidental loss, destruction, and damage. No security measure is perfect. In the event of a data breach that is likely to affect your rights and freedoms, we will notify you and, where required, the relevant supervisory authority, within the timeframes required by applicable law. ## 12. Third-Party Links Our Services may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party sites you visit. ## 13. Changes to This Privacy Policy We may update this Privacy Policy from time to time. For material changes, we will notify you by email or through a prominent notice in the Services at least thirty (30) days before the effective date. Non-material changes take effect immediately upon posting. Your continued use of the Services after the effective date of a material change constitutes your acceptance of the updated policy. We encourage you to review this Privacy Policy periodically. The "Last Updated" date at the top of this page indicates when the policy was most recently revised. ## 14. Contact Us If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: Allyx, Inc.\ Attn: Privacy Team\ 1501 Yamato Rd\ 2nd Floor #3030\ Boca Raton, FL 33431\ Email: legal@fairleadhq.com **EU Representative (Article 27 GDPR):** TO BE APPOINTED. Until then, contact legal@fairleadhq.com. **Data Protection Officer / UK Representative:** If Allyx is required to appoint a Data Protection Officer under GDPR Article 37, or a UK representative under the UK GDPR, the contact details will be provided here. fairleadhq.com/legal/privacy © 2026 Allyx, Inc. All rights reserved.