Privacy Policy

1. Who we are

Credyx (“Credyx”, “we”, “us”) operates credyx.ai, a B2B credit intelligence platform that retrieves company data from official government registries and produces credit risk assessments for business customers. This policy explains what personal data we process, why, and the rights you have over it.

For any privacy question or request, contact [email protected].

2. Data we collect from you

• Account data. Name, work email address, password hash, company affiliation, and billing details when you register or subscribe.
• Usage data. Searches you run, companies you look up, risk analyses you request, API key activity, and quota consumption. We keep this to operate rate limits, billing, and your audit trail.
• Technical data. IP address, browser type, and request logs, retained for security monitoring and abuse prevention.
• Correspondence. Emails you send to our sales, support, or privacy inboxes.

We do not collect payment card numbers ourselves; card processing is handled by our payment provider.

3. Public registry data

The core of the service is company information retrieved from official public sources: national business registers (for example UK Companies House, SEC EDGAR, INSEE Sirene, Brønnøysund), GLEIF, OpenCorporates, and OpenSanctions. This data can include personal data that appears in public records — typically the names, roles, and appointment dates of directors and officers, and names appearing on sanctions or PEP lists.

We process this data as it is published at source, under our legitimate interest (and that of our customers) in assessing counterparty credit risk — a purpose compatible with the reason the data was made public. We do not enrich registry records with data about private individuals from non-public sources, and we do not invent or infer data that is not present in the source record.

If you are a director or officer whose details appear in our cached registry data and you believe the source record is wrong, the correction must be made at the issuing registry; once corrected, a refresh of the record on our side will pick it up. You can request an immediate re-fetch or cache deletion via [email protected].

4. How we use data

• Providing the service: search, lookups, financials, risk analysis.
• Authentication, account management, and plan enforcement.
• Billing and subscription management.
• Security monitoring, rate limiting, and abuse prevention.
• Service communications — transactional email about your account, quota, or subscription. We do not sell personal data, and we do not send marketing email without consent.

5. Legal bases (GDPR)

Where the GDPR applies, we rely on: performance of a contract for account, usage, and billing data; legitimate interests for public registry data, security logging, and product analytics; legal obligation for tax and accounting records; and consent where we ask for it explicitly.

6. Sharing and subprocessors

We share data only with service providers who process it on our instructions: cloud hosting and database infrastructure, a CDN and TLS provider (Cloudflare), an LLM inference provider used for the narrative portion of risk assessments, an email delivery provider, and a payment processor. Each is bound by a data processing agreement. Financial figures sent to the LLM provider relate to companies, not to the analyst requesting the assessment.

We may also disclose data where required by law or to protect the rights, safety, or property of Credyx and its users.

7. Retention

• Cached registry data expires after 7 days; cached filings after 30 days, unless refreshed earlier.
• Completed risk assessments are retained for as long as your account exists, so your credit decisions remain auditable.
• Account data is deleted or anonymised within 30 days of account closure, except where retention is legally required.
• Security logs are retained for up to 12 months.

8. International transfers

Registry data originates from authorities worldwide. Where personal data is transferred outside the EEA or UK, we rely on adequacy decisions or the European Commission’s Standard Contractual Clauses with our subprocessors.

9. Your rights

Depending on your jurisdiction, you may have the right to access, rectify, erase, restrict, or port your personal data, and to object to processing based on legitimate interests. Write to [email protected] and we will respond within 30 days. You also have the right to lodge a complaint with your supervisory authority.

10. Security

All traffic is encrypted in transit with TLS, data is encrypted at rest, and administrative access is role-restricted. See our security overview for detail.

11. Changes to this policy

We will post any changes on this page and update the date above. Material changes affecting registered users will additionally be announced by email before they take effect.