Privacy Policy

1. Who we are, and our two roles

Proxelion is operated by Hylix Consulting LLC ("we", "us"). Privacy contact: support@hy-lix.com.

2. What we collect and where it comes from

We do not collect special-category data on purpose, and our customers must not upload it. We do not sell personal data, and we do not use it for advertising.

3. Why we use it, and our legal bases

For the people our customers contact, the customer is responsible for having a lawful basis, which for business-to-business outreach is often legitimate interests, and for respecting objections and opt-outs.

4. Google and Microsoft account data

Google. Signing in with Google gives us your name, email address and picture. If you also connect a Google Workspace mailbox, we request only the permission to send email on your behalf and to see your email address. We do not read, scan or store your Gmail inbox, contacts or calendar. We use that access only to send messages you compose and approve.

Microsoft. If you connect Outlook or Microsoft 365, we request permission to send mail as you, to read mail so we can find replies from people you emailed, to see your basic profile, and to stay connected without asking you to sign in again. We use it only to send your emails and to show you the replies from your contacts. We do not use mailbox content for advertising, to build profiles, or to train any model.

Proxelion's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Data from these connections is shared with no one except as needed to provide the service you asked for, to comply with law, or with your consent. No person at Hylix Consulting LLC reads your mailbox content, except where you ask us for support, where it is needed to investigate abuse or a security issue, or where the law requires it.

You can disconnect either account in Settings, which deletes the stored credentials, and revoke access from your Google or Microsoft account at any time.

5. Emails we send for you

• Every email sent through the service carries an unsubscribe link. When a recipient uses it, we record the opt-out for that sender and no further emails go to that address from that sender's account.
• Where the mail program supports it, we add the standard one-click unsubscribe headers.
• When you send through a Google Workspace connection, we may add an invisible image and wrap links so you can see opens and clicks. Other sending routes do not add tracking.
• If a mail server tells us at the moment of sending that an address does not exist, we add it to your do-not-email list.

6. People who receive emails sent through the service

If you received an email sent through Proxelion, the sender chose to contact you and is responsible for that message. We process your business contact details and any reply you send on the sender's behalf. You can:

• click the unsubscribe link in the email to stop all further emails from that sender;
• write to support@hy-lix.com to ask what data a sender holds about you, to correct or delete it, or to object. We pass the request to the sender, and we can block your address for them;
• report abuse to the same address, with the email or its headers, and we will act on the sender's account.

7. AI processing

We use AI models to draft emails, summarise research, score fit and classify replies. To do this we send the relevant text, such as the prospect's details, your offer, or the text of a reply, to our AI providers, who return a result. We do not use your content to train AI models. AI output is a draft for you to review. We do not make decisions about individuals that have legal or similarly significant effects; you decide who to contact and what to send.

8. Who we share data with

These service providers process data on our behalf, under contracts that limit what they may do with it:

• Supabase — Database and sign-in. Account details, contacts and emails you save, encrypted mailbox credentials.
• Vercel — Application hosting. Requests to the service, including content you submit.
• Stripe — Subscription billing and tax. Billing name, email, address and payment details (card data is handled by Stripe and never stored by Proxelion).
• AI model providers, via OpenRouter — Writing and analysing emails. The prospect details and text you submit for a generation, and the text of replies you ask the AI to classify.
• Hunter.io — Finding professional contact details. Company domains and role keywords you search for.
• Google — Sign-in, and optional Google Workspace sending. Name, email address and, if you connect it, permission to send email as you.
• Microsoft — Optional Outlook / Microsoft 365 connection. Your mailbox address and permission to send and read replies as you.
• Crisp — Support chat. Messages you send to support and basic visitor details.
• Upstash — Rate limiting. IP addresses, for short periods, to stop abuse.

We may also disclose information when the law or a valid legal request requires it, or to protect people and the service from fraud and abuse. If the business is sold or reorganised, data may move to the new owner under the same protections. We never sell personal data.

9. Transfers outside your country

Our providers may process data in the United States and other countries. Where the law requires a transfer mechanism, such as the European Commission's standard contractual clauses, we use one.

10. Security

• Mailbox passwords and sign-in tokens are encrypted before they are stored (AES-256-GCM); traffic uses HTTPS.
• Each account's data is access-controlled, and the keys that can read everything stay on the server and never reach a browser.
• Fields that control plans and credits cannot be changed from a browser.
• Opt-out links use signed tokens, so a link cannot be changed to remove someone else.

No system is perfectly secure. If a breach affects your data we will tell you without undue delay and explain what happened and what to do.

11. How long we keep data

You can delete your account in Settings, which removes your profile, content, contacts, campaigns, replies, follow-ups and sign-in.

12. Cookies and similar technologies

We use only what the service needs to work. We do not use advertising or analytics cookies.

You can block cookies in your browser, but you will not be able to sign in without the session cookies.

13. Your rights

Depending on where you live, you may have the right to:

• be informed about how we use your data (this policy);
• access your data and receive a copy in a common format;
• have inaccurate data corrected;
• have your data deleted;
• restrict, or object to, our use of it, including for direct marketing;
• withdraw consent at any time, without affecting what was done before;
• complain to your data protection authority.

Write to support@hy-lix.com. We may ask you to prove your identity, and we respond within 30 days. If we act as a processor for the data you ask about, we will pass your request to the customer responsible for it.

California residents. We do not sell or share personal information as those terms are defined in California law, and you can ask what we hold about you or to delete it using the address above.

14. Children

The service is for businesses and is not directed to anyone under 16. If you believe a child has given us data, write to us and we will delete it.

15. Changes to this policy

We may update this policy as the service or the law changes. The date at the top shows the latest version. For material changes we will tell you by email or in the product before they take effect.

16. Contact

Hylix Consulting LLC. Email support@hy-lix.com.