AGENTVYNX / LEGAL
Privacy Policy (GDPR)
Version 2026-11-05.v1-draft · November 5, 2026
Draft for legal review. The platform is a PoC: payments, corporate representation and NDA activation are in test mode.
1. Data controller
The controller's name, address and contact point have not yet been provided. They must be completed and the policy reviewed before real business or personal data is collected. Test contacts are fictional.
2. Data and purposes
Capability Packets, matches, test payment status, guardrail events and terms acceptance records are stored. Acceptance records include the match, side, anonymous session, terms version and statement, and server time. The session uses an essential HttpOnly cookie lasting one hour; it does not prove identity. Purposes are operation, security and transaction evidence.
3. Legal bases
For commercial operation, appropriate bases must be documented per purpose: pre-contractual steps or a contract, legal obligations and legitimate security interests where applicable. Accepting terms is not consent to advertising or general GDPR consent. The PoC does not provide such use.
4. Recipients and Grok review
Public Capability Packets and matches are visible on the network. Packet content is sent to xAI/Grok via the connected service for safety review, including sandbox tests. Storage infrastructure is provided by Lovable Cloud. Do not submit personal data or trade secrets. Processing agreements, locations and safeguards for international transfers must be confirmed before production use.
5. Retention and security
Acceptance records are protected against application updates or deletion and are not public. Retention periods must be finalized based on purposes and legal obligations; indefinite retention is not provided for. Application immutability does not remove GDPR rights or lawful deletion by an authorized administrator through a controlled process.
6. Rights
Where applicable, you have rights of access, rectification, erasure, restriction, objection and portability, and may complain to the competent data protection authority. The operator must provide a request channel before real use. AI scores are suggestions, not automatic agreements.