At SXXDigital, your privacy is paramount. We do not sell your personal information to data brokers, we never use your proprietary inputs to train foundational AI models, and we collect only the minimal data strictly required to deliver our studio-grade generation platform.
Legal Scope & Framework: This Privacy Policy complies with international data privacy standards including the EU General Data Protection Regulation (GDPR), the UK Data Protection Act, California Consumer Privacy Act (CCPA), and Turkish Law No. 6698 (KVKK).
1. Data Controller and Contact
SXXDigital operates as the data controller for the personal information processed through our platform and websites.
For inquiries regarding this policy, privacy practices, or to exercise your statutory privacy rights, contact us at [email protected].
2. Information We Collect
We collect information directly from you and automatically as you interact with our services:
- Account Information: Email address and cryptographically salted password hashes (Argon2). We never store raw passwords.
- Billing Information: Subscription plan identifiers, credit ledger balances, and invoice records. Payment card data is processed directly by PCI-DSS Level 1 compliant processors (Stripe for global transactions, iyzico for Turkey). Card numbers never touch our servers.
- Generation Inputs & Prompts: Architecture briefs, UI specifications, and parameters you provide to generate digital products.
- Telemetry & Session Information: Origin country derived from edge headers, browser user-agent, session authentication token (sxx-session), and locale preference (sxx-locale).
3. Purposes and Legal Bases for Processing
We process your personal information under the following legal frameworks:
- Performance of Contract: Providing studio generation capabilities, authenticating sessions, and maintaining your credit ledger.
- Legal Compliance: Fulfilling tax, corporate reporting, and regulatory audit obligations.
- Legitimate Interests: Defending platform integrity, preventing automated abuse, and ensuring resilient infrastructure delivery.
4. AI Model Inference and Zero-Training Guarantee
We hold an absolute zero-training commitment regarding customer content:
Your input prompts, codebases, and generated artifacts are strictly processed for runtime inference and are NEVER used to train, retrain, or improve foundational AI models.
For users selecting Bring-Your-Own-Key (BYOK), API requests route directly using your personal credentials under your personal provider agreements.
5. Sub-Processors and Third Parties
We partner exclusively with rigorously vetted service providers who maintain strict confidentiality and security standards:
- Payment Processors: Stripe, Inc. (Global) and iyzico / PayU (Turkey).
- AI Model Providers: OpenRouter, Anthropic, and vetted enterprise inference partners under zero-data-retention agreements.
- Infrastructure & Hosting: Edge-distributed cloud network infrastructure featuring end-to-end encryption.
6. Data Retention and Security Architecture
All communication is secured in transit via TLS 1.3 and at rest via AES-256 encryption. Account data is retained for the lifetime of your account. Upon account deletion, all personal data, credit history, and generation records are permanently expunged, subject only to statutory tax retention periods.
7. Your Privacy Rights
Depending on your jurisdiction (such as under GDPR, CCPA, or KVKK), you have the right to:
- Access and receive a copy of your personal data in a structured, machine-readable format (Data Portability).
- Rectify inaccurate or incomplete information.
- Request permanent erasure ("Right to be Forgotten").
- Restrict or object to processing under legitimate interest grounds.
- Lodge a complaint with your local data protection supervisory authority.