Privacy Policy

Last Updated: October 7, 2026

1. Data Controller

For the purposes of Regulation (EU) 2016/679 ("GDPR"), the data controller is:

MYX AD
Sofia Tech Park, Tsarigradsko Shose 111B, floor 2
Sofia, Bulgaria
Company Registration: 206192748
VAT ID: BG206192748
Email: info@myxrobotics.com

2. Data Categories We Process

We process the following categories of personal data:

• Account data: Name, email address, password hash, company name
• User Content: Documents, files, and data you upload to the Service
• Outputs: Extracted information and results generated from your User Content
• Technical logs: IP address, browser type, access times, feature usage
• Billing metadata: Subscription tier, payment history, invoice records
• Demo submissions: The work email address and documents you submit to the free demo on our website, and the extraction generated from them

3. Purposes of Processing

We process your personal data for the following purposes:

• To provide and operate the MYX Analyzer service
• To manage billing, tokens, and subscriptions
• To ensure security and prevent fraud
• To improve and optimize the Service
• To comply with legal obligations
• To respond to support requests

4. Legal Bases for Processing

We rely on the following legal bases under GDPR:

• Contract necessity (Article 6(1)(b)): Processing required to deliver the Service you requested
• Legitimate interests (Article 6(1)(f)): Security monitoring, fraud prevention, and service improvement
• Legal obligations (Article 6(1)(c)): Tax records, regulatory compliance, and law enforcement requests
• Consent (Article 6(1)(a)): Processing of free-demo submissions and contacting you about MYX Analyzer, based on the consent you give when submitting the demo; you may withdraw consent at any time

5. Subprocessors

We use the following subprocessors to deliver the Service:

These providers process data solely to deliver the Service. Pursuant to our contractual agreements, they do not use your User Content to train foundation models or for any purpose other than providing the contracted services.

6. Data Retention

• User Content and Outputs: Retained until deleted by you or for 30 days following account closure, after which they are permanently deleted
• Account data: Retained for the duration of your account and for 30 days following closure
• Billing records: Retained for 7 years after the transaction date to comply with Bulgarian tax law
• Technical logs: Retained for 12 months for security and operational purposes
• Demo submissions: Retained as demo data; deleted on request at any time (email info@myxrobotics.com)
• Legal holds: Data may be retained longer if required by law, legal proceedings, or regulatory investigation

7. International Data Transfers

Where processing occurs outside the European Economic Area, we rely on:

• European Commission Standard Contractual Clauses (SCCs)
• Supplementary technical and organizational measures as required

You may request a copy of the applicable SCCs by contacting us.

8. Your Rights Under GDPR

Under GDPR, you have the following rights:

• Access: Request access to your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Request restriction of processing in certain circumstances
• Data portability: Receive your data in a structured, machine-readable format
• Object: Object to processing based on legitimate interests
• Withdraw consent: Where processing is based on consent
• Lodge a complaint: With the Bulgarian Commission for Personal Data Protection (CPDP) or your local supervisory authority

To exercise your rights, contact us at info@myxrobotics.com.

9. Cookies and Analytics

The Service uses essential cookies only: they are required for authentication, security and core functionality and cannot be disabled. We set no advertising cookies and do no cross-site tracking.

On the public pages that carry our analytics tag (not the homepage, this policy or the terms page), and for two events inside the application (the signup page being shown and a demo result being claimed into a workspace), we measure visits with Umami, a self-hosted analytics tool running on MYX AD's own server in the EU. Our analytics sets no cookies and writes nothing to your browser's storage.

An analytics record contains:

• a fixed identifier for the page from our list of public pages (never the address bar's query string or fragment) and a fixed label, "MYX Analyzer", instead of the page title;
• the referring site's domain (never its full address), the browser language, the screen size and the browser and device type taken from the user agent;
• for the demo and trial buttons, an event name with counts (number of files, fields found, seconds), a status word and a button label, each from a fixed list.

Analytics records contain no email address, file name, document content, run identifier or claim token. Umami uses the IP address to derive the country and city and a one-way session hash with a salt that rotates monthly; the visit record does not keep the address. These are pseudonymous visit statistics with no cookies and no direct identifiers. The tool runs on our own server with its built-in telemetry switched off, and we do not use these statistics for advertising.

When your browser sends Do Not Track or Global Privacy Control, we do not load the analytics tracker and send no analytics events.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Access controls and authentication
• Regular security assessments
• Employee training on data protection

11. Contact Us

For any questions about this Privacy Policy or to exercise your rights, contact us at:

Email: info@myxrobotics.com
Address: MYX AD, Sofia Tech Park, Tsarigradsko Shose 111B, floor 2, Sofia, Bulgaria