Last updated: April 5, 2026
Troxy ("we", "us", "our") operates the Troxy payment control platform. This Privacy Policy explains what data we collect, how we use it, and your rights regarding your personal data.
Account data: Your email address, used for authentication (magic link login) and transactional notifications.
Transaction metadata: When your AI agent calls the Troxy API, we log the merchant name, amount, currency, agent identifier, card alias, and the decision made (ALLOW, BLOCK, ESCALATE, NOTIFY). We never store full card numbers — only the alias you create.
API usage: Request timestamps, IP addresses (via Cloudflare), and API key identifiers for security and debugging purposes.
Policy configuration: The rules and spending limits you define in the dashboard.
We do not use your data for advertising, marketing, or profiling. We do not sell your data to third parties.
Your data is stored in AWS (us-east-1, Northern Virginia). We use industry-standard security practices including encrypted databases, secrets management (AWS Secrets Manager), and private network isolation for our database. All API traffic is encrypted via TLS.
We retain your account data and transaction logs for as long as your account is active. When you delete your account, all associated data is permanently deleted within 30 days. Audit logs older than 12 months may be archived or deleted earlier.
You have the right to:
The Troxy dashboard uses a single session cookie to maintain your login state (JWT token stored in localStorage). We do not use tracking cookies or third-party analytics.
The Service is not directed at children under 16. We do not knowingly collect data from children.
We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. The "Last updated" date at the top of this page reflects the most recent revision.
For privacy-related questions or requests, contact us at gaslan@troxy.io.