Privacy policy
This policy explains what personal information Steelax collects, why we collect it, who we share it with and what you can ask us to do about it. It is written to be read.
1. Who we are
Steelax, LLC is a California limited liability company with its registered address at 5111 Avenida Oriente, Tarzana, CA 91356, United States. In this policy, Steelax, we and us mean that company.
For personal information about visitors to our website and the people who administer a Steelax workspace, we act as a controller. For content a customer connects to or creates inside their workspace, including code, issues, documents and sessions, we act as a processor on that customer's instructions. Where you use Steelax through your employer, their own privacy notice governs how they decide to use the service.
2. Information we collect
2.1 Information you give us
- Account details: name, work email address, role and the workspace you belong to.
- Enquiry details: anything you send through our contact form or by email, including the description of your product and stack.
- Billing details: company name, billing address, tax identifiers and invoice history. Card numbers are handled by our payment processor and never reach our systems.
- Support correspondence: the messages you send us and our replies.
2.2 Information from connected systems
When your workspace connects an issue tracker, document tool, design tool or code repository, Steelax reads the content within the scopes your administrators grant. That content may incidentally contain personal information, such as the names and email addresses of the people who wrote an issue, authored a commit or commented on a document. We process it only to operate the service for your workspace.
2.3 Information collected automatically
- Service logs: sign-in events, requests to our application, feature usage, errors and performance data.
- Device and connection data: IP address, browser type and operating system, used for security and diagnostics.
- Agent run logs: the commands run, files read or written and test output for each coding agent run in your workspace.
2.4 What we do not collect
We do not collect special categories of personal data, we do not buy personal information from data brokers, and we do not build advertising profiles. Steelax has no mechanism for connecting to production databases, customer records or live application traffic.
3. How we use information
- To provide the service: indexing connected systems, answering questions, shaping work, generating tasks and running the coding agent.
- To secure the service: detecting abuse, investigating incidents, rate limiting and preserving an audit trail.
- To support you: answering questions, diagnosing problems and notifying you about changes that affect your use of the service.
- To bill you: processing payments, issuing invoices and meeting tax and accounting obligations.
- To improve the service: analysing aggregated usage patterns and error rates. This never involves reading customer content for product development, and it never involves training models on your content.
- To meet legal obligations: responding to lawful requests and enforcing our terms.
4. Training and model providers
Your code, documents, issues, sessions and generated tasks are never used to train or fine-tune any machine learning model, ours or a third party's. This applies on every plan and there is no setting that changes it.
To generate answers and tasks, Steelax sends relevant excerpts of your content to model providers listed on our security page, under commercial agreements that prohibit them from retaining that content or using it for model improvement. We do not send access tokens, secrets, environment values, billing records or content from any other customer workspace.
5. Legal bases for processing
Where the General Data Protection Regulation or United Kingdom data protection law applies, we rely on the following bases.
- Performance of a contract: providing the service to the customer that engaged us and to its authorised users.
- Legitimate interests: securing our systems, preventing abuse, improving reliability and communicating with business contacts about a service they asked about. We balance these against your rights and interests.
- Legal obligation: retaining records required by tax, accounting and company law.
- Consent: where we ask for it specifically, such as subscribing to product announcements. You can withdraw consent at any time.
6. Sharing
We do not sell personal information and we do not share it for cross-context behavioural advertising. We share information only in these circumstances.
- With subprocessors who run parts of the service on our behalf, under written terms that restrict their use of the data. The current list is published on our security page, and we give 30 days notice before adding a subprocessor that handles customer content.
- With other members of your workspace, where the service is designed to show shared work such as sessions and tasks.
- With professional advisers such as accountants and lawyers, bound by confidentiality.
- Where required by law, after reviewing the request and, unless legally prohibited, telling the affected customer first.
- In a merger, acquisition or sale of assets, in which case we will notify affected customers and this policy will continue to apply until replaced.
7. International transfers
Steelax operates in the United States and the European Union. Workspaces created with European residency keep their application data, indexes and agent run environments in the European Union. Model inference may still be processed in the United States.
Where personal information is transferred out of the European Economic Area or the United Kingdom, we rely on the European Commission's standard contractual clauses together with the United Kingdom addendum, and we carry out transfer risk assessments. Copies of the relevant clauses are available on request.
8. Retention
| Category | Retention period |
|---|---|
| Source code | Not retained. Held only in an ephemeral run environment and destroyed with it |
| Indexes of code, issues and documents | Deleted within 7 days of disconnecting the source |
| Sessions and generated tasks | Your workspace retention setting, from 90 days to indefinite |
| Agent run logs | 12 months |
| Service and security logs | 12 months |
| Account records | For the life of the account, then 30 days |
| Billing and tax records | 7 years, as required by law |
| Enquiries that do not become accounts | 24 months |
Deleting a workspace removes its indexes, sessions, tasks and logs within 30 days, including from backups on their normal rotation. We will confirm deletion in writing on request.
9. Your rights
Depending on where you live, you may have the right to access the personal information we hold about you, to correct it, to delete it, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent where we rely on it. You also have the right not to be discriminated against for exercising these rights.
If you use Steelax through an employer or client, direct your request to them first. They control the workspace, and we will assist them in responding to you.
To make a request directly, write to our privacy address from the email address associated with your account. We respond within 30 days and will tell you if we need longer, which is rare. We do not charge for responding unless a request is manifestly excessive.
If you are in the European Economic Area or the United Kingdom and you are unhappy with how we have handled your information, you may complain to your local supervisory authority. We would rather you told us first so we can put it right.
10. Security
We encrypt data in transit with TLS 1.3 and at rest with AES-256. Access tokens are stored in a managed secret store with per-workspace keys. Production access requires hardware-backed multi-factor authentication and is logged. The coding agent runs in a disposable container per task with restricted network egress.
If an incident affects your personal information, we will notify affected customers without undue delay and in any case within 72 hours of confirming it, with what we know, what we have done and what you should do. Our security page describes these measures in more detail.
11. Cookies and analytics
Our marketing site sets no cookies and runs no third party analytics, advertising or tracking scripts. There is no cookie banner because there is nothing to consent to.
The Steelax application sets a small number of strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. These are required for the application to work and cannot be switched off while you are signed in. We use a privacy-preserving, self-hosted analytics tool inside the application that records page views and feature usage without cookies and without cross-site identifiers.
12. Children
Steelax is a business product and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, write to us and we will delete it.
13. Changes to this policy
If we make a material change, we will email workspace administrators at least 30 days before it takes effect and update the date at the top of this page. Changes that only clarify existing practice take effect when published. Previous versions are available on request.
14. How to contact us
Write to privacy@steelax.net for anything in this policy, including rights requests. For security reports use security@steelax.net. Postal mail reaches us at Steelax, LLC, 5111 Avenida Oriente, Tarzana, CA 91356, United States.
We have not appointed a data protection officer because we are not required to. Privacy requests are handled by a member of the engineering team rather than an outsourced desk.