EU data controller: MYX AD, Sofia
MYX Analyzer is built and operated by MYX AD, a company registered in Sofia, Bulgaria, and MYX AD is the EU data controller for the platform. Under the GDPR, the controller is the party that decides why and how personal data is processed. Here, that party has a name, a registration number, and a street address.
| Legal entity | MYX AD |
| Company registration | 206192748 |
| VAT number | BG206192748 |
| Registered office | Sofia Tech Park, Tsarigradsko Shose 111B, floor 2, Sofia, Bulgaria |
| Role under the GDPR | EU data controller |
Because the controller is established in the European Union, the GDPR applies directly to the personal data the platform processes. There is no gap between the law that protects your data and the company answerable for it. That identity is stable across everything you sign: the terms, the privacy policy, and the DPA all point back to the same Sofia entity.
Never used to train AI models
Customer documents are never used to train AI models. MYX makes this commitment contractually. It is a clause your procurement team can cite, not a line on a slide.
Training means changing the underlying AI models with your content. Analysis means reading your documents to produce your extractions. The platform does the second, and only the second.
The distinction matters for the material you would upload. A lease portfolio encodes rent, escalation terms, renewal options, and your negotiating position. A tool that learns from customer data feeds that position into a model other companies can query. The Analyzer processes your documents to fill the fields you define, and nothing is trained on them.
The commitment is unqualified. It does not thin out as your documents move through the platform, and it covers the AI subprocessors named below.
Subprocessors under SCCs
Every AI document platform runs on other companies’ models and infrastructure. The difference is whether the vendor names them. MYX Analyzer uses four subprocessors: Google Cloud / Vertex AI, Anthropic, OpenAI, and Stripe. All four operate under Standard Contractual Clauses.
| Subprocessor | Transfer safeguard |
|---|---|
| Google Cloud / Vertex AI | Standard Contractual Clauses |
| Anthropic | Standard Contractual Clauses |
| OpenAI | Standard Contractual Clauses |
| Stripe | Standard Contractual Clauses |
Standard Contractual Clauses are the European Commission’s approved contract terms for moving personal data out of the EU; they bind the receiving party to EU-level protections. This is the complete list, and the privacy policy carries the authoritative version.
Encryption and access
Customer documents are encrypted in transit and at rest. In transit covers the connection between you and the platform; at rest covers documents in storage. The wider set of security measures is described in section 10 of the privacy policy.
Access inside your organization is scoped rather than open. The platform organizes work into shared workspaces with permissions, so which teams see which tables is a decision you make, not a default you inherit.
Encryption protects documents from interception and storage-level exposure. Permissions protect them from the more common failure: over-broad access inside the buyer’s own team.
DPA and governing law
A data processing agreement fixes a vendor’s obligations in contract: what it may do with your data, on whose instruction, and under which safeguards. MYX provides a DPA on request, as set out in section 10 of the terms of service. To request one, use the contact page or write to info@myxrobotics.com.
The terms are governed by Bulgarian law and reference the EU online dispute resolution platform. Jurisdiction is not an afterthought here: the company, the controller, and the governing law sit in the same EU member state. These are the details vendor reviews tend to reach last. They are stated here first.
Certified: ISO 27001
MYX is ISO 27001 certified — the international standard for information security management. Certificate details are available on request through the contact page.
Alongside the certification, the specifics are in writing: a named EU data controller in Sofia, four named subprocessors under Standard Contractual Clauses, a contractual commitment that customer documents are never used to train AI models, encryption in transit and at rest, and a DPA on request.
If a vendor security review needs more than this page answers, ask. The FAQ covers the common questions on data handling and the trial; the contact page reaches the people who can answer the rest. Print this page and check each sentence against the linked policies. That is what it is for.
Put the commitments in writing
Request the DPA before you upload a single document, or start the 30-day free trial and test MYX Analyzer on documents you choose.
30-day free trial · Card required — first charge only when the trial ends · Cancel anytime