Privacy Policy

1. Who we are

Hyprlyx ("Hyprlyx", "we", "us") operates hyprlyx.com and the Hyprlyx web application (the "Service"). We are the controller of the personal data described in this policy. For anything privacy-related, contact privacy@hyprlyx.com.

When you connect your own website and its data to Hyprlyx (for example Google Search Console), we process that data on your behalf and under your instructions. For that data you are the controller and we act as your processor.

2. What we collect

Account data

• Name, email address and a hashed password (we never store or see your password in readable form).
• Workspace name, team members and their roles.
• Security records: login attempts, password reset requests and the IP address they came from.

Billing data

• Your plan, subscription status and billing history. Card details are entered on Stripe's page and stored by Stripe; we never receive or store full card numbers.

Data from services you connect

• Google Search Console and Google Analytics 4: search queries, impressions, clicks, positions, page and traffic statistics for the properties you authorize, plus the OAuth tokens needed to keep the connection working.
• Cloudflare: traffic and bot statistics for zones you connect, using the API token you provide.
• Your website: publicly available pages, sitemaps and metadata we crawl for audits and planning.

Content you create

• Keywords you track, briefs, drafts, articles and settings you save in the Service.

Technical data

• IP address, browser type, device and request logs, kept by our hosting provider for security and debugging.
• Cookies and similar storage described in our Cookie Policy.

We don't knowingly collect sensitive categories of data, and the Service is not meant for anyone under 16.

3. Why we use it (and the legal basis)

AI and your data. When you ask Hyprlyx to write or analyse content, the relevant inputs (keywords, briefs, page text) are sent to our AI provider to produce the result. We use API access where providers state they do not use the data to train their models. We never use your data to train our own models.

4. Who we share it with

We share data only with service providers who process it for us under written agreements, and only as much as they need:

We may also disclose data if required by law, to protect rights and safety, or as part of a merger or acquisition (in which case we will tell you first). We do not sell or rent personal data, and we do not share it for cross-context behavioural advertising.

5. International transfers

Our providers are mostly in the United States. Where data from the EEA, UK or Switzerland is transferred, we rely on the European Commission's Standard Contractual Clauses, the UK Addendum, or the provider's certification under the EU-U.S. Data Privacy Framework, as applicable.

6. How long we keep it

• Account and content: while your account is active; deleted within 30 days after you close it.
• Data from connected services: until you disconnect the service or delete the website from Hyprlyx.
• Billing records: up to 7 years, because tax law requires it.
• Security logs and rate-limit records: up to 90 days.
• Backups: overwritten on a rolling basis within 30 days.

7. How we protect it

• Encryption in transit (HTTPS/TLS everywhere, HSTS) and at rest at our database provider.
• Passwords hashed with bcrypt; password reset links are single-use, expire after 30 minutes and are stored only as hashes.
• Changing your password signs you out on every device.
• Rate limiting on login, sign-up, password reset and every API route; checks against known breached passwords.
• Least-privilege access to production systems.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

8. Your rights

Depending on where you live, you can:

• access the personal data we hold about you and get a copy in a portable format;
• correct inaccurate data;
• delete your data ("right to be forgotten");
• restrict or object to certain processing, including processing based on legitimate interest;
• withdraw consent at any time, without affecting earlier processing;
• disconnect any third-party service from your settings at any time;
• complain to your data protection authority.

Email privacy@hyprlyx.com from your account address. We answer within 30 days and may ask you to confirm your identity. We will not treat you differently for using your rights.

California residents (CCPA/CPRA)

In the last 12 months we collected identifiers, commercial information, internet activity and the other categories listed in section 2, for the purposes in section 3. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use sensitive personal information to infer characteristics about you.

Canada (PIPEDA)

We collect, use and disclose personal information with your consent and only for the purposes described here. You can withdraw consent subject to legal or contractual limits, and you can contact the Office of the Privacy Commissioner of Canada if you are not satisfied with our answer.

9. Google API data

Hyprlyx's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to show you your own search and traffic analytics inside Hyprlyx; we don't use it for advertising, don't sell it, and don't let humans read it unless you ask us to for support, it is needed for security, or the law requires it. You can revoke access at any time from your Google Account settings.

10. Changes

If we make material changes, we will email account owners and show a notice in the app at least 14 days before they take effect. The date at the top always shows the current version.

11. Contact

Hyprlyx · privacy@hyprlyx.com