Privacy policy
Last updated 7 November 2026
Cyproxy connects your AI agents to the security tools you choose through one audited endpoint. This policy explains what we collect, why, and the choices you have. We keep it short and we only collect what we need to run the service.
The data controller is Lowside Intelligence Ltd, trading as Cyproxy, a company registered in England and Wales, company number 17387625, registered office 66 Paul Street, London, EC2A 4NA.
What we collect
| Data | Why |
|---|---|
| Account: email address and password (handled by our identity provider; we never see your password). | To sign you in and contact you about your account. |
| Profile: name, role, organisation, team size and type, country, intended use, tools you use, how you heard about us, and your marketing preference. | To set up your account, understand who uses Cyproxy and improve it. Marketing emails only if you opt in. |
| Vendor credentials: API keys you add and tokens from vendors you sign in to (e.g. VirusTotal). | To call those vendors' tools on your behalf. Encrypted at rest, scoped to your account, never shown to agents or returned to the browser. |
| Audit log: each tool call's name, outcome and time, and who made it. On Teams and Enterprise it also keeps the call's arguments, which are what your agent looked up, so they can include personal data such as an IP address or email address you're investigating. On Community and Pro, arguments aren't kept. | So you can review what your agents did. Kept for your plan's audit period (7–365 days), then deleted automatically. |
| Cyproxy Agent and collections: the questions you ask the Cyproxy Agent, any images you attach, its answers, and the collections you or your agent save. | To show you your conversations and lists. Kept until you delete them or close your account. |
| Feedback: what you send with the feedback button, including any screenshot you attach. | To fix problems and improve Cyproxy. |
| Billing: your plan, subscription status and Stripe customer reference. Card details are entered on Stripe's own checkout page; we never see or store your card number. | To take payment for paid plans and keep your plan in step with your subscription. |
| Enquiries: what you tell us when you contact us about Teams or Enterprise. | To reply and follow up on your enquiry. |
| Usage: monthly credit counts, daily counts of the kinds of calls you make (not what they contained), and upgrade requests. | To apply your plan's limits and handle plan changes. |
| Technical: IP address and request logs. | Security, abuse prevention and troubleshooting. Kept for up to 30 days. |
Why we can use it (legal basis)
| Purpose | Legal basis (UK and EU GDPR) |
|---|---|
| Running your account, routing tool calls, the audit log, plan limits and billing | Contract: we need it to provide the service you signed up for. |
| Security, abuse prevention, troubleshooting and improving Cyproxy (technical logs, profile answers) | Legitimate interests: keeping the service safe and useful. You can object at any time. |
| Product update emails | Consent: only if you opt in, and you can withdraw it at any time. |
| Keeping invoices and payment records | Legal obligation: UK tax law. |
How long we keep it
- Account, profile and vendor credentials: until you delete them or close your account, then within 30 days.
- Cyproxy Agent conversations and collections: until you delete them or close your account, then within 30 days.
- Audit log: your plan's audit period (7 to 365 days).
- Technical logs: up to 30 days.
- Billing records: six years, as UK tax law requires. Stripe keeps its own records under its privacy policy.
Tool calls go to the vendors you choose
When your agent calls a tool, Cyproxy sends the request to that vendor, usually through the vendor's own MCP server; for some vendors Cyproxy runs a connector to their API, using your key. Either way, the vendor processes it under its own terms and privacy policy. Some actions share data publicly by design — for example, files and URLs submitted to VirusTotal are shared with the security community. Only submit what you're allowed to share.
Where data is stored
Cyproxy is hosted in the EU. Data is encrypted in transit and at rest. Stripe, our payment provider, may process payment data in the United States, and HubSpot, which holds our contact records (your name, email, organisation, plan and the details you give us when you sign up, request access or contact us), may process them there too. Questions you ask the Cyproxy Agent, and the tool results it reads to answer them, are processed by our AI model provider, Anthropic, which may process them in the United States and doesn't use them to train its models. Those transfers are covered by Stripe's, HubSpot's and Anthropic's data processing terms, which use the UK International Data Transfer Addendum and the EU Standard Contractual Clauses. Vendors you connect may be based outside the UK and EU and process your tool calls under their own terms.
Cookies
We use only essential cookies: a session cookie that keeps you signed in to the console. No advertising or tracking cookies. When you pay, Stripe's checkout and billing pages (on Stripe's own website) set their own cookies, for example to prevent fraud; see Stripe's privacy policy.
Sharing
We don't sell your data. We share it only with processors that run the service (our hosting and email providers, Stripe for payments, Anthropic for the Cyproxy Agent's AI model, and HubSpot, where we keep our customer and sales contact records; the list is available on request), with vendors when your agent calls their tools, or where the law requires it.
Your rights
You can view and edit your profile under Account & plan, and ask us to export or delete your data at any time. Under UK and EU GDPR you can also object to or restrict processing, and complain to your data protection authority (in the UK, the ICO).
Children
Cyproxy is a professional security tool and isn't for anyone under 18.
Changes to this policy
If we change this policy in a way that matters, we'll update the date above and tell account holders by email before the change takes effect.
Contact
Email privacy@cyproxy.io, or write to Lowside Intelligence Ltd, 66 Paul Street, London, EC2A 4NA.