Privacy Policy

Aviso de Privacidad / Privacy Notice

This Privacy Policy is issued as an aviso de privacidad integral under the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, "LFPDPPP") and its regulations. It explains who is responsible for your personal data, what data we process when you use Scytala (the "Service"), for what purposes, with whom we share it, and how you may exercise your rights.

1. Responsable (Data Controller)

The party responsible for the processing of your personal data (the responsable) is:

• Responsable: Hector Antonio Jasso Garza
• Domicile: Monterrey, Nuevo León, Mexico
• Contact for privacy matters: privacy@scytala.com

You may direct any question about this notice or about the handling of your personal data to the contact above. References to "we," "us," or "Scytala" in this notice mean the responsable identified here.

2. Personal Data We Collect

We collect only the personal data needed to operate the Service. We do not request or knowingly collect sensitive personal data (such as health, religious, ethnic, or biometric data). The categories we process are:

• Account and identity data: your name, email address, and the identity information returned by the identity provider you choose to sign in with (Google or GitHub OAuth), such as your provider username and account identifier.
• Usage and billing data: session history, credit and feature usage, timestamps, billing and subscription status, and basic device/log data (IP address, browser, and access timestamps) used for security and operation. Payment card details are handled by our payment processor; we do not store full card numbers.
• Connected-resource metadata: the configuration you provide for your environments — repository URLs, allowed (allowlisted) domains, environment names, default branches, and the names (keys) of the secrets you have configured.
• Encrypted credential references: for secrets you configure (for example, repository tokens, database connection strings, or environment variables), we store only an encrypted reference to the secret. Raw secrets/credentials are encrypted at rest, and the agent that runs your sessions never receives them in plaintext (see Section 4).
• Session and audit data: messages you send to the Service, results returned to you, and audit metadata about access made through our credential proxy (for example, that a credential was used, a database query was proxied, or an outbound request was made), retained for security and abuse investigation.
• Consent records: which versions of our policies you accepted and when, so we can demonstrate consent.

3. Purposes of Processing

In accordance with the LFPDPPP, we distinguish between primary purposes (necessary to provide the Service you requested) and secondary purposes (not necessary for the Service).

3.1 Primary purposes

• Creating and administering your account and authenticating you.
• Operating the Service and running agent sessions against the resources you connect.
• Processing billing, payments, and credit usage.
• Maintaining security, preventing fraud and abuse, keeping audit records, and meeting legal obligations.
• Providing support and responding to your requests.

3.2 Secondary purposes

• Product analytics and measurement of how the Service is used.
• Improving and developing the Service.
• Optional communications, such as product news or non-essential updates.

Opt-out for secondary purposes. Secondary purposes are not required for us to provide the Service. If you do not wish your data to be used for one or more secondary purposes, you may opt out at any time at no cost by sending a request to privacy@scytala.com with the subject "Secondary purposes — opt-out." Your refusal of secondary purposes will not be a condition for, nor affect, your ability to use the Service. (Our product analytics tool is additionally configured to use in-memory persistence only and to honor "Do Not Track" browser signals.)

4. How the Agent Accesses Your Data (Zero-Trust Model)

The Service runs an automated agent in isolated, ephemeral containers. Access to your connected resources follows a zero-trust model designed so that the agent does not hold your raw credentials:

• No raw credentials in the agent: agent containers do not receive raw secrets or credentials. Stored secret references are encrypted at rest.
• Mediated by a credential proxy: when a session needs to use a connected resource, access is brokered by a credential proxy rather than by handing the secret to the agent.
• Session-scoped, short-lived tokens: the proxy issues scoped tokens that are valid only for the session and are revoked when the session ends, so the agent does not retain long-lived access.
• Transparency and revocation: signed-in users can review connected providers, per-environment scope, stored secret references, allowed domains, and recent access activity — and revoke access — from the in-app Security & Access dashboard.

5. Transfers and Sub-processors (Including International Transfers)

We do not sell your personal data. To provide the Service, we rely on the following providers and remittances/transfers ("sub-processors"):

• Cloud hosting (Amazon Web Services, AWS): infrastructure, storage, and encryption for the Service.
• OpenAI / ChatGPT / Codex and Anthropic / Claude API: model inference used to power the selected agent backend. Codex may use your connected ChatGPT plan directly, or Scytala API fallback credits when API billing is enabled.
• Slack: when you install and use the Scytala bot integration, we exchange the messages and workspace/user identifiers needed for that integration.
• Payment and analytics providers: a payment processor for billing and a product-analytics provider for the secondary purposes described above.
• Resources you connect: the GitHub repositories, databases, and allowlisted domains that you yourself configure. When you instruct the Service to act on these, data is exchanged with them at your direction.

International transfers. Some of this processing occurs outside Mexico (for example, in the United States), because the providers above operate internationally. These transfers are necessary to provide the Service you requested and to maintain the contractual relationship with you. We carry them out relying on the applicable exceptions under Article 37 of the LFPDPPP (including transfers necessary for the performance of the contract you have entered into, and transfers to providers acting on our behalf under a data processing relationship) and, where required, on your consent. We require our sub-processors to protect your data consistently with this notice and applicable law.

6. ARCO Rights

As the holder (titular) of the personal data, you have the following ARCO rights under the LFPDPPP:

• Acceso (Access): to know what personal data we hold about you and how we process it.
• Rectificación (Rectification): to correct your data when it is inaccurate or incomplete.
• Cancelación (Cancellation): to request that we delete your data when it is no longer needed for the purposes above, subject to legal retention obligations.
• Oposición (Opposition): to object, for legitimate reasons, to specific processing of your data.

How to exercise your ARCO rights. Send a request to privacy@scytala.com. To process it, your request must include: (i) your full name and a means of contact to communicate our response; (ii) a copy of an official identification document that proves your identity (or that of your legal representative, with the corresponding power of attorney); (iii) a clear description of the data and the right(s) you wish to exercise; and (iv) any element that helps us locate the relevant data. We will respond to your request within 20 business days of receiving it and, if it is granted, will make it effective within the 15 business days that follow, as provided by the LFPDPPP. There is no cost to submit a request, although reproduction or shipping costs permitted by law may apply.

7. Consent and Its Revocation

By creating an account and accepting this notice at signup, you consent to the processing of your personal data for the primary purposes described in Section 3.1, and, unless you opt out, for the secondary purposes in Section 3.2.

You may revoke your consent at any time by writing to privacy@scytala.com. We will process your revocation in accordance with the LFPDPPP. Please note that revocation may, in some cases, mean we can no longer provide part or all of the Service, and that revocation does not affect processing already carried out or processing we are legally required to continue.

8. Data Retention and Security

We keep your personal data only for as long as it is needed for the purposes above and to comply with applicable obligations:

• Account data: retained while your account is active and for a reasonable period after closure for legal and operational purposes, after which it is deleted or anonymized.
• Session and credential data: tied to the session lifecycle. Session-scoped proxy tokens are revoked when the session ends; workspace contents on the ephemeral container are destroyed when the container terminates. Encrypted secret references persist only while you keep them configured.
• Audit, security, and billing data: retained for the periods required for security investigation and for tax and accounting obligations.

Security measures. We apply technical and organizational measures appropriate to the data, including encryption at rest for credentials and sensitive data, encryption in transit, access controls, audit logging, and the credential-proxy / zero-trust model described in Section 4.

9. Use of Cookies and Similar Technologies

We use minimal tracking technologies to operate the Service and, for secondary purposes, to measure usage. For details on the cookies and similar technologies we use and how to manage them, see our Cookie Policy.

10. Changes to This Notice

We may update this notice to reflect changes in the Service, our practices, or the law. We will communicate material changes by posting the updated notice on our website with a new "Last updated" date and, where appropriate, by notifying you by email. Where permitted by law, your continued use of the Service after an update takes effect constitutes acceptance of the updated notice.