Privacy Policy

This policy explains what Umang Kumar, trading as Cirvix (“Cirvix”, “we”, “us”) collects and does with information, across two surfaces: this marketing website (https://www.cirvix.com) and the Cirvix AgentControl product once you have an account. Cirvix is in private beta — some of what follows describes how the product will handle data as it becomes generally available, and is written that way explicitly rather than implied to be already live.

1. Who this covers

This policy applies to visitors of the Cirvix website, to private-beta and future customers of Cirvix AgentControl, and to anyone who contacts us directly. It does not apply to data your organization processes through your own tools — Cirvix is infrastructure your agents call through, not a destination for your business data in general; see “What we store” below for the specific, narrow set of records Cirvix itself keeps.

2. What we collect

The website

Our hosting provider records standard server logs (IP address, request path, timestamp, user agent) for operating and securing the site — this is infrastructure-level logging common to any web host, not a separate analytics product we’ve installed. We do not currently run third-party analytics or advertising trackers on this site. If that changes, this policy and the site’s cookie disclosure will change first.

The early-access and enterprise contact forms collect what you type into them — name, work email, company, and any notes — but only inside your browser. Submitting builds a pre-filled mailto: link to umang@cirvix.com rather than posting to a Cirvix server; the data leaves your device only when your mail client actually sends the message, at which point it becomes an email like any other you send us.

The product (once you have an account)

Account and workspace information (name, work email, company, billing contact once billing exists); agent identity records; the policies you configure; and decision records for calls Cirvix authorizes — agent, action, resource, verdict, policy, approver, and timestamp. Full detail, including what is deliberately never stored, is on the Security page; the short version is that secret values never enter Cirvix — agents receive an opaque handle, and the credential itself is substituted at the network boundary.

3. How we use it

To operate the service (authorize calls, evaluate policy, produce the audit trail); to respond when you contact us; to send service-related notices (security, billing once it exists, material changes to this policy); and to improve the product. We do not use customer decision records to train a general-purpose model, and we do not sell personal data.

4. Sharing and subprocessors

We share data with the infrastructure providers that operate the service on our behalf (hosting, log aggregation, transactional email) under contracts that limit their use of it to providing that infrastructure. The current subprocessor policy — including the commitment to give advance notice before adding a new one for a customer under contract — is on the Security page and in the DPA. We do not sell personal data or share it for cross-context behavioural advertising.

5. Retention

Decision and audit records are retained for the life of the deployment. Cirvix does not currently prune them automatically — the audit chain is tamper-evident, and removing records from the middle of it would break the property it exists to provide. Where you self-host, retention is bounded by your own infrastructure and your own policy. Export and removal are manual today. Form submissions that reach us by email are retained as ordinary correspondence. Account data is retained for the life of the account and deleted or anonymized within a reasonable period after closure, subject to any legal-hold or audit obligation that requires otherwise.

6. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete personal data we hold about you, and to object to or restrict certain processing. Email umang@cirvix.com to exercise any of these — as an individual-led, private-beta operation, requests are handled personally rather than through an automated portal, and we will tell you plainly if something isn’t possible yet rather than leaving the request unanswered.

7. International transfers

Cirvix operates from India and prices in both USD and INR. Infrastructure providers may process data in other regions; single-tenant and on-premise Enterprise deployments can pin processing to a region you choose — see the Enterprise page.

8. Children

Cirvix is a developer and enterprise infrastructure product. It is not directed at, and we do not knowingly collect data from, anyone under 16.

9. Changes to this policy

If this policy changes materially, we will update the date at the top and, for active customers, tell you directly rather than relying on you to notice a diff.

10. Contact

Umang Kumar, trading as Cirvix — umang@cirvix.com.

This document is provided for transparency and is not a substitute for legal advice. It has not been reviewed by counsel on your behalf, and if privacy compliance is a requirement for your organization, have your own counsel review it — and the DPA — before relying on it.