Privacy Policy

This Policy applies when Alysium processes personal information in connection with the Services. It does not replace the privacy notice of a Creator, organization, or third-party website that offers, configures, embeds, or links to an Alysium agent.

Alysium generally determines why and how personal information is processed for Alysium accounts, platform administration, service improvement, marketplace operations, billing, security, fraud prevention, support, and legal compliance. Independent agent creators and organizations (“Creators”) may separately determine why an agent is offered and how information obtained through it is used. For some Creator-configured agents and workspace features, Alysium may process information on the Creator’s instructions.

Review the privacy information shown for an agent and any separate Creator or embedding-site notice before submitting information. Questions about a Creator’s independent practices should be directed to that Creator.

The information we process depends on how you use the Services. This table summarizes the principal categories, sources, purposes, recipients, and retention criteria. Sections 3 through 11 provide more detail.

You may submit personal information about another person or configure an agent to collect it only if you have the right to do so and provide any notice or obtain any permission required by law.

We collect or receive personal information:

• directly from you when you register, chat, upload or publish content, create or buy an agent, apply as a Creator, connect a payout account, submit a review, subscribe to marketing, or contact us;
• automatically from your browser, device, use of the Services, and security and operational systems;
• from Creators, workspace owners and members, organizations, and sites that offer or embed an Alysium agent;
• from service providers and business partners that support authentication, AI processing, hosting, analytics, communications, payments, and fraud prevention;
• from public webpages or other sources that you or a Creator direct an agent to crawl, ingest, or use; and
• from other users who include information about you in content they submit.

Some fields are required to provide a feature. For example, a named account requires registration and authentication information, a purchase requires transaction information, and Creator payouts require Stripe onboarding and verification. If you do not provide required information, we may be unable to provide the related feature.

Some agent chats can be used without providing a name or email. The Services still use a persistent identifier and process conversation and technical information. This is pseudonymous use, not anonymity.

We use personal information to:

• provide, authenticate, administer, maintain, and secure the Services;
• process conversations, files, retrieval, tools, AI generation, and other operations you request;
• operate Creator tools, teams, marketplace listings, purchases, subscriptions, credits, payouts, reviews, and moderation;
• provide customer support and investigate technical issues;
• detect, investigate, and prevent fraud, abuse, policy violations, and security incidents;
• meter usage and administer billing, Creator earnings, and transaction records;
• analyze, evaluate, personalize, debug, and improve service features, quality, safety, and reliability;
• publish and promote content that you intentionally make public;
• send authentication, transaction, security, and other service communications;
• send marketing email if you opt in, and retain unsubscribe or suppression information;
• comply with law, respond to lawful requests, and establish, exercise, or defend legal claims; and
• create and use aggregated or de-identified information for analytics, research, development, business planning, and improving or developing services.

Where we ask for consent or permission, you may withdraw it at any time. Withdrawal does not affect processing that already occurred. We will provide an opt-out where required.

When you interact with an agent, Alysium processes your input, relevant conversation history, agent instructions, retrieved excerpts, attachments, and technical metadata as needed to produce and deliver a response. Depending on the model and feature, this information may be routed through Vercel AI Gateway and processed by providers such as Anthropic, OpenAI, Google, or Voyage AI. For example, providers may support generation, embeddings, scanned-document transcription, or reranking.

Alysium may access and use identifiable private content when reasonably necessary to operate the Services; maintain safety and security; provide support; diagnose failures; evaluate quality; personalize an experience; and improve the Services and their features. Merely submitting identifiable private content does not give Alysium the right to use that content to train a general-purpose model. This limitation does not prevent the operational, safety, evaluation, personalization, and service-improvement uses described in this Policy.

Alysium may transform information so that it is aggregated or de-identified and no longer reasonably identifies you. We may use that information for research and development, analytics, benchmarking, product and model evaluation, and developing or improving services, and may retain it in de-identified form as permitted by law. We will not attempt to re-identify information maintained as de-identified except to test whether de-identification measures are effective or as otherwise permitted by law.

AI-provider practices differ. Depending on the provider, route, contract, account setting, and requested feature, providers may temporarily cache or retain content or metadata, conduct automated or human abuse review, or use information to improve their services. Available training restrictions and zero-data-retention settings also vary. Alysium does not promise that every provider or route has identical retention, review, or training terms. We select and configure providers based on the feature, commercial terms, safety, availability, and other operational considerations.

AI output may be inaccurate, incomplete, outdated, or nonunique. Do not treat it as professional advice or use it as the sole basis for a decision with legal or similarly significant effects.

The owner and admins of the space that owns the particular agent may access full saved conversations with that agent, including messages, AI responses, timestamps and other metadata, tool activity, and conversation topics or analytics where available. They may search, review, and export this information using available operational features. For a purchased copy of an agent, the owning space may be the buyer’s space rather than the original marketplace Creator’s space.

Depending on the feature and your choices, the agent-owning space may also receive or access your name, username, email address, avatar, uploaded files, document-access events, purchase or subscription status, usage information, bundle information, and other transaction-administration details. Marketplace purchaser and subscriber views may show buyer email addresses to authorized owners and admins. A file you expressly hand off is made available to the owning space identified in the interface.

Creators and authorized workspace members may use this information to provide support, operate or improve the relevant agent, administer transactions and subscriptions, enforce their terms, and for other purposes disclosed when the information is collected. They must not use information obtained through Alysium for unrelated marketing or sell it to another party unless they independently provide any legally required notice and obtain your separate permission. A Creator’s own privacy notice may describe additional practices for which that Creator is responsible.

Ordinary product permissions do not give a Creator your password or your conversations with unrelated agents. A third-party site embedding an agent may independently collect information under its own privacy notice.

We disclose personal information as described below and do not disclose more than reasonably necessary for the relevant purpose.

Service providers and AI providers

Depending on the feature and configuration, our core providers include:

• Supabase for authentication, database, storage, and related platform services;
• Google Cloud for application hosting and operational infrastructure;
• Cloudflare for network delivery, security, and bot detection;
• Vercel for AI Gateway routing and website analytics;
• Anthropic, OpenAI, Google, and Voyage AI for applicable AI generation, embedding, transcription, reranking, and related processing;
• Stripe and Stripe Connect for checkout, subscriptions, fraud prevention, hosted onboarding, account verification, transfers, and payouts;
• PostHog for in-app product analytics and masked Session Replay, acting as our service provider under a data processing agreement;
• Sentry for error monitoring and diagnostics;
• Resend for opted-in marketing email and related subscription records; and
• Sanity for marketing-site content management.

These providers receive personal information needed to perform their services. A provider may act as our processor or service provider for some activities and have independent legal responsibilities for others, such as regulated payment or identity-verification functions. Their processing is also governed by their applicable terms and privacy notices.

Other disclosures

We may also disclose personal information:

• to the agent-owning space, Creators, workspace members, and transaction parties as described in Section 6;
• to other users or the public when you choose to publish a profile, listing, review, reply, support contact, or other public content;
• to a recipient or external source you direct us to use, including a website selected for crawling or a connected service;
• to professional advisers, auditors, insurers, and financing parties subject to appropriate duties;
• to law enforcement, regulators, courts, or other parties when we reasonably believe disclosure is required by law or necessary to protect rights, safety, security, and service integrity; and
• in connection with a merger, financing, acquisition, reorganization, bankruptcy, or transfer of all or part of our business, subject to applicable notice and safeguards.

Alysium does not sell personal information for money or other valuable consideration, and we do not share personal information for cross-context behavioral advertising. We do not use third-party advertising networks to follow you across unrelated services for targeted advertising.

Alysium may select, rank, recommend, editorially feature, or clearly label and promote agents, listings, content, or Alysium features within the Services. We may measure views, interactions, install starts, purchases, and similar first-party activity to operate and improve the marketplace. These first-party marketplace and service promotions are not a sale of personal information or cross-context behavioral advertising.

Public Creator profiles, marketplace listings, reviews and replies, Creator-supplied support contacts, profile images, and other content you designate as public can be viewed, copied, or indexed by others. Removing content from Alysium may not remove copies or cached versions held by other people, search engines, or independent services.

If you direct Alysium to ingest a public website, Alysium may request pages from that site and store page URLs, titles, extracted content, hashes, chunks, and embeddings. You are responsible for having authority to use the selected source. The website operator receives ordinary request information associated with the crawl.

Alysium is not responsible for the privacy practices of independent sites and services linked from or used with the Services. Review their privacy notices before providing information.

Alysium and its providers use cookies and browser storage to authenticate users; maintain security; remember theme and other preferences; preserve agent, conversation, purchase, and interface continuity; keep unsent drafts on a device; prevent fraud; process payments; and measure website and feature use.

Examples include Supabase authentication storage, per-agent widget authentication state, last-conversation and active-space identifiers, theme preferences, Creator search history, purchase and free-message state, Cloudflare Turnstile, Stripe payment components, and Vercel Web Analytics. These technologies may process identifiers, IP address, approximate location, browser or device information, requested and referring pages, and timestamps.

Product analytics

In the Alysium app, we use PostHog to collect limited feature-use events, such as which features are used and where people get stuck, linked to an opaque account or device identifier. These events exclude chat and prompt text, AI responses, file contents, filenames, email addresses, names, and full URLs. Product analytics starts only after the in-app analytics notice has been shown to you; you do not need to click anything for it to take effect. Product analytics does not run in agents embedded on other websites.

Session Replay

Session Replay records a masked view of how you move through four areas of the Alysium app: the agent builder, the marketplace, your knowledge library, and chat. Everything you or an agent writes is hidden: messages, prompts, answers, file names, names, email addresses, and images appear only as blank shapes, while Alysium's own menu and button labels stay readable. Session Replay never records sign-in, the analytics dashboard, team members, account settings, billing, or agents embedded on other websites. Recordings are processed by PostHog in the United States, deleted after 30 days, and viewable only by the Alysium team.

For named accounts, Session Replay is turned on when you agree to it as part of creating your account. For sessions without a named account, Session Replay stays off unless you turn it on.

Your analytics choices

You can turn product analytics or Session Replay off at any time under Settings, then Privacy, from Privacy in the account menu, or from Data & Privacy in an embedded agent's account menu. Turning off product analytics also turns off Session Replay. If your browser sends a Do Not Track signal, we do not collect product analytics or Session Replay. Turning either off does not change how the Services work for you.

Browser storage remains on your device until it expires, the application removes it, or you clear it. Signing out may not clear every preference, unsent draft, or other non-authentication item stored by the browser. Clear site data through your browser if you use a shared device or want to remove remaining local data. Blocking necessary cookies or storage can prevent authentication or other features from working.

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy. We consider the nature, amount, and sensitivity of the information; the feature and account lifecycle; the risk of harm; whether the purpose can be achieved another way; technical deletion and backup cycles; and applicable security, fraud, accounting, tax, transaction, dispute, and legal-record requirements.

Retention can differ by system and provider. For example:

• account and profile information is generally retained while the account or relationship is active and afterward as reasonably needed for security, support, disputes, and legal obligations;
• saved conversations and files are retained according to the relevant feature, history setting, account relationship, deletion workflow, and applicable exceptions;
• turning off visible history means a conversation is not added to the ordinary visible history, but necessary metering, billing, security, workflow, log, gateway, or provider records may still be created;
• deleting or removing a conversation, agent, file, or account may begin a technical process rather than erase every copy immediately, and some information may remain temporarily in backups, restricted compliance custody, fraud records, or another party’s independent systems;
• marketplace, payment, payout, tax, and accounting records are retained for the commercial relationship and applicable recordkeeping, fraud, dispute, chargeback, and legal periods;
• support and privacy-request records are retained as needed to handle and document the request; and
• marketing unsubscribe or suppression records may be retained so that we can honor the choice.

Aggregated or de-identified information may be retained for research and development, analytics, service evaluation, and related purposes where permitted by law.

We use administrative, technical, and organizational safeguards designed to protect personal information based on the nature of the information and the Services. Access is limited according to roles and service needs, and many files and account functions use access controls. Information intentionally made public remains publicly accessible.

No method of transmission, storage, or processing is completely secure. We cannot guarantee absolute security, permanent deletion, or that every attempted attack will be prevented. Protect your credentials, use a unique password, and avoid submitting information that is unnecessary for the interaction.

You can unsubscribe from marketing email using the link in the message. You may also change available account, profile, history, publication, and agent settings. A Creator’s separate service may offer additional choices.

You can turn product analytics and Session Replay off at any time, as described in Cookies, browser storage, and analytics.

Depending on where you live and subject to applicable exceptions, you may have the right to request that we:

• provide access to or information about personal information we process;
• correct inaccurate personal information;
• delete personal information;
• provide certain information in a portable format;
• restrict or stop certain processing;
• honor a withdrawal of consent where processing is based on consent;
• honor an applicable opt-out from sale, sharing, targeted advertising, or qualifying profiling;
• limit certain uses or disclosures of sensitive personal information; or
• review an appeal of a privacy-request decision.

To submit a request or appeal, email support@alysium.ai. Describe the request and the account, agent, or interaction involved. We may ask for information reasonably necessary to verify your identity, authority, and connection to the information. We will use verification information only to process and document the request and will respond within the time required by applicable law. We may deny or limit a request where the law permits or requires it and will explain applicable appeal options.

If you used an agent without providing an email address, include the agent URL or identifier, conversation identifier, username if any, approximate dates, and other non-secret details that may help locate the record. Do not send passwords, access tokens, payment-card numbers, or copies of identity documents unless we give you a secure, request-specific method.

If Alysium processes information solely on behalf of a Creator or organization, we may direct the request to that party and assist it as required. You may use an authorized agent where applicable law permits. We will not discriminate against you for exercising a privacy right.

The ordinary Services are not designed to require medical records, complete payment-card or bank-account details, government identification numbers, passwords, authentication secrets, biometric templates, or similarly sensitive information in free-form prompts, chats, files, or crawled sources. Please do not submit this information unless a feature specifically requests it through an appropriate interface, such as Stripe’s hosted identity, payment, or payout flow.

Free-form content can nevertheless contain health, financial, identity, demographic, belief, union-membership, sexuality, precise-location, child, or other sensitive information. If you submit or configure an agent to collect sensitive information, you are responsible for having authority to do so and for using a feature and workflow appropriate to that information. Do not use Alysium to store passwords or authentication secrets, and do not use an Alysium agent as the sole basis for consequential medical, legal, credit, employment, housing, insurance, or similar decisions.

The Services are intended only for people who are at least 18 years old. People under 18 must not create an account or use the Services, and Creators must not knowingly direct agents to children or invite them to use the Services.

We do not intentionally collect personal information from people we know are under 18. If you believe a person under 18 has submitted personal information, contact support@alysium.ai. We will review the report and take appropriate steps, which may include restricting the account or deleting information, subject to verification, legal requirements, and technical limitations.

Alysium is based in the United States. We and the providers described in this Policy may process personal information in the United States and other countries where they operate. Those countries may have privacy laws different from the laws where you live. When applicable law requires a safeguard for a transfer, we will use an appropriate safeguard.

The European-market eligibility restriction at the beginning of this Policy does not remove any obligation imposed by a law that already applies to particular processing.

We may update this Policy as the Services, our practices, and legal requirements change. We will post the revised Policy and update the “Last updated” date. If a change is material, we will provide additional notice through the Services, by email, or through another appropriate channel when required by law. We will obtain consent before applying a materially broader use to previously collected information where applicable law requires it.

Privacy and support email: support@alysium.ai
Telephone: +1 561-762-4436

You may also contact a privacy regulator, attorney general, or other authority available under the law that applies to you.