Legal

Privacy Policy

1. Introduction

Airbrx, Inc. ("Company," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our services, and interact with us.

Please read this Privacy Policy carefully. If you do not agree with our policies and practices, please do not use our services.

2. Information We Collect

2.1 Information You Provide Directly

Account Registration: When you create an account, we collect information such as your name, email address, company name, job title, and password.

Profile Information: You may provide additional information about yourself and your organization, such as industry, company size, and data warehouse configuration details.

Communication: When you contact us via email, support forms, or chat, we collect the content of your communications and associated metadata.

Billing Information: If you subscribe to our paid services, we collect billing address, payment method details, and transaction history. Payment processing is handled by third-party payment processors; we do not store full credit card information.

Configuration: You provide the configuration the gateway runs on — gateway addresses, cache and invalidation rules, and the connection details for your own warehouse.

Where your query traffic is held depends on your plan. On Growth and above, cached results, query logs and rollups are written to storage in your own account, on your retention terms — we never hold them. On Starter the service is fully hosted, so we do hold that cache and those logs on your behalf. On every plan the caller's own warehouse credentials pass through us rather than being stored, and we never record result rows or raw credentials. See Trust and security for the mechanics.

2.2 Information Collected Automatically

Website, while you are only reading: Browsing airbrx.ai sets no cookies, unless you arrive on a partner referral link and agree to it — the one exception, described next. It stores a single item in your browser's local storage — your light or dark theme preference — which identifies nobody and is removed when you clear site data. We run no advertising tags, no pixels and no third-party analytics, which is why a partner referral is the only thing you can ever be asked about here. Loading the contact form reaches HubSpot, which sets a short-lived bot-protection cookie on its own domain.

Partner referrals: Some partners link to us with a referral code in the address, like airbrx.ai/pricing?affiliate=abc123. If you arrive on one we ask you first. Agree, and we store a cookie named abx_aff on .airbrx.ai holding that code and the time you arrived, for 90 days, so the partner is credited if you go on to sign up; a second cookie, abx_aff_consent, records your answer so we stop asking. Decline, and nothing is stored — we pass the code along on the links to app.airbrx.ai on that one page, and it goes no further. Neither cookie says anything about you, neither is used for advertising, measurement or profiling, and the partner learns only that a signup came from their link, never who you are. Arrive without a referral code and none of this happens; you are not asked, and nothing is written.

Website, once you sign in: The scan page lets you sign in to your Airbrx account. Doing so stores the same credentials described below under Application: an access token in a cookie and a refresh token in local storage. They are strictly necessary to keep you signed in, they are not used for measurement or profiling, and signing out clears them.

Application: Signing in to the Airbrx application stores an access token in a cookie so the application can call our API on your behalf, and a refresh token in local storage so your session can be renewed without asking you to sign in again. The access token expires after one hour. It identifies you — it carries your email address, your display name, and the tenants and accounts you have access to — because that is what authorizes the call. It is signed rather than encrypted, so treat it like a password: anyone holding it can read those fields and act as you until it expires. The application also keeps a small amount of interface state, such as your place in the navigation, tied to your login. None of this is used to track you, and none of it follows you across other websites.

Log Data: Our servers record ordinary request information, including IP address and browser string, as any web service does. We do not build behavioral profiles from it.

Analytics: We do not use analytics tools to track usage patterns, feature adoption or user behavior.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: Providing, maintaining, and improving our platform and services
• Account Management: Creating and managing your account, processing transactions, and sending service-related announcements
• Communication: Responding to your inquiries, sending you updates, product announcements, and customer support
• Marketing: Sending promotional materials, newsletters, and offers (with your consent where required)
• Partner Credit: Where you arrived on a partner referral link, matching that referral code to your signup so we can credit the partner who sent you
• Security: Detecting, preventing, and addressing fraud, abuse, and security incidents
• Compliance: Fulfilling legal obligations and enforcing our Terms of Service
• Research and Development: Improving our algorithms, developing new features, and conducting product research

4. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

4.1 Service Providers

We share information with third-party service providers who perform services on our behalf, including:

• Cloud infrastructure providers (hosting, storage, backup)
• Payment processors
• Customer support and CRM platforms, which receive what you submit through our contact form
• Email and communication services

Analytics providers are deliberately absent from that list. We do not use any.

These providers are contractually obligated to use your information only as necessary to provide services and must maintain appropriate security measures.

4.2 Legal Requirements

We may disclose your information when required by law, legal process, or government request, or when we believe in good faith that disclosure is necessary to:

• Comply with applicable laws, regulations, or legal obligations
• Enforce our Terms of Service and other agreements
• Protect the security or integrity of our services
• Protect the rights, property, and safety of Airbrx, our users, or the public

4.3 Business Transfers

If Airbrx, Inc. is involved in a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will provide notice of any such change and any choices you may have regarding your information.

4.4 Aggregated and De-identified Information

We may share aggregated or de-identified information that cannot reasonably be used to identify you with third parties for research, marketing, analytics, and other purposes without restriction.

5. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this Privacy Policy. The retention period may vary depending on the context and our legal obligations:

• Account Information: Retained while your account is active and for a reasonable period after account termination
• Log Data: Typically retained for 18 months
• Billing Information: Retained as required for tax and legal compliance
• Marketing Communications: Retained until you unsubscribe

You may request deletion of your account and associated personal information by contacting us. We will comply with deletion requests subject to legal and contractual obligations to retain certain information.

6. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information:

6.1 General Rights

• Access: You have the right to request access to the personal information we hold about you
• Correction: You can request that we correct inaccurate or incomplete information
• Deletion: You may request deletion of your personal information, subject to certain exceptions
• Portability: You may request a copy of your information in a portable format

6.2 European Economic Area (GDPR)

If you are located in the EEA, you have additional rights under the General Data Protection Regulation, including:

• Right to object to processing
• Right to restrict processing
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority

6.3 California (CCPA)

If you are a California resident, you have rights under the California Consumer Privacy Act, including the right to know, delete, and opt-out of the sale or sharing of personal information.

6.4 Exercising Your Rights

To exercise any of these rights, please contact us using the information provided in Section 12. We will respond to your request within the timeframe required by applicable law, typically within 30 days.

7. Data Security

We implement appropriate technical, administrative, and physical safeguards to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Secure authentication mechanisms
• Access controls and role-based permissions
• Employee training on data protection and privacy

However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

8. International Data Transfers

If you are located outside the United States, please note that your information may be transferred to, stored in, and processed in the United States or other countries where we or our service providers operate. These countries may have data protection laws that differ from your home country.

By using our services, you consent to the transfer of your information to countries outside your country of residence, which may have different data protection rules. Where required by law, we implement appropriate safeguards such as Standard Contractual Clauses to protect your information.

9. Third-Party Links and Services

Our website and services may contain links to third-party websites and services that are not operated by Airbrx. This Privacy Policy does not apply to third-party services, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services before providing your information.

10. Children's Privacy

Our services are not directed to individuals under 18 years of age, and we do not knowingly collect personal information from children. If we become aware that we have collected information from a child, we will take steps to delete such information and terminate the child's account.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by updating the "Last Updated" date at the top of this policy. Your continued use of our services following the posting of changes constitutes your acceptance of the updated Privacy Policy.

12. Contact Us