Privacy
The policy Aminyx publishes today, plus the disclosures European law requires of a company selling into the EU. Where a fact is missing, this page says so.
Last updated
June 2026
Aminyx sells B2B into Europe, so this policy is written to Articles 13 and 14 of the GDPR. Some of what those articles require has not been published by the company yet. Rather than fill those gaps with plausible text, each one is tagged in place and listed here.
Aminyx is an agentic workspace for B2B teams. This policy explains what personal data is processed when you visit aminyx.ai or use the Aminyx platform, why it is processed, and what you can ask us to do about it.
It is written in plain language on purpose. A policy nobody can read is not transparency, whatever its word count.
The controller for the processing described here is the Aminyx entity that operates this website and provides your workspace.
That entity is not identified in anything Aminyx publishes today. Article 13(1)(a) requires the controller's identity and contact details to appear in the policy itself, so this cannot stay open at launch.
The published privacy contact is privacy@aminyx.biz, and it is the right address for everything in this policy.
To be completed before launch
Registered legal entity name, registered address and company registration number. Also: whether a data protection officer has been appointed, and whether an Article 27 representative in the EU is required and who it is.
Two different sets of data run through Aminyx, and the roles are not the same for both.
For account and workspace administration — the details needed to open, configure and bill a workspace — Aminyx is the controller, and this policy governs.
For the content you load into the platform, including personal data about your own leads, customers and contacts, your organisation is the controller and Aminyx acts as a processor on your instructions.
That second relationship needs a written data processing agreement under Article 28, covering sub-processors, security measures and assistance with data-subject requests. It is not published on this site.
To be completed before launch
The Article 28 data processing agreement, its sub-processor annex and the schedule of technical and organisational measures must exist and be available to customers before launch.
Three kinds of information, and nothing beyond what the platform needs to run:
Every purpose is tied to a legal basis under Article 6. A purpose with no basis is a purpose that should not be running.
To be completed before launch
Each legitimate-interest purpose above needs a documented balancing test, and this table has to stay in step with the record of processing activities under Article 30.
Content you submit — leads, articles, outreach messages, documents — is sent to AI models so the modules can produce output.
Calls to third-party model providers are governed by contractual data-processing terms, and you control what content is sent to agents in the first place.
What the published policy does not answer is whether that content may ever be used to train or improve a model, Aminyx's own or a provider's. One sentence decides the purpose, the legal basis, and what our customers have to tell their own contacts, so it has to be answered explicitly rather than left to inference.
To be completed before launch
State plainly whether customer content is used to train, fine-tune or evaluate models — for Aminyx or for any provider — and if so, on what basis and how to opt out.
Aminyx runs agents. They score and rank leads, draft content, move pipeline items and propose next actions, which is profiling as Article 4(4) defines it.
The product is built so that people keep direction and approvals: agents propose, a person releases the work. Configured that way, there is no decision based solely on automated processing producing legal or similarly significant effects, and Article 22 is not engaged.
A workspace can be configured with less human involvement than that. Where it is, the assessment has to be made again — by your organisation for decisions about your contacts, and by Aminyx for decisions about you.
To be completed before launch
Record which workspace configurations remove meaningful human review, and document the Article 22(3) safeguards that apply when they do.
Aminyx does not publish the names of its vendors, and this page does not invent them. Data reaches these categories of provider:
To be completed before launch
Maintain a dated sub-processor list naming each provider and its location, make it available on request, and give customers advance notice of additions so they have a chance to object.
Aminyx serves operators across markets and time zones, and the provider categories above make it likely that some personal data is processed outside the EEA.
Chapter V of the GDPR allows that only under a specific mechanism: an adequacy decision, Standard Contractual Clauses with supplementary measures where they are needed, or another listed safeguard.
Which mechanism applies to which provider is not published. Until it is, EU customers cannot complete their own transfer records, so this is a launch blocker rather than a detail.
To be completed before launch
Document, per provider category, the destination country and the Chapter V mechanism relied on, and make the Standard Contractual Clauses and the transfer impact assessment available to customers.
Traffic between you and the platform is encrypted with TLS 1.2 or higher, and workspace data is encrypted at rest on enterprise cloud infrastructure.
Access is role-based inside the product; production access is restricted and audited. Dependencies are monitored, vulnerabilities are assessed regularly, and there is a documented process for detection, containment and customer communication.
When a workspace is closed, data is deleted or anonymized within 90 days, unless the law requires it to be kept longer. Export anything you need before closure.
This website loads no analytics, advertising or marketing scripts, and sets no tracking cookies. Fonts are self-hosted and served from this domain, so visiting the site makes no request to a third-party font provider.
The only thing the site keeps on your device is your answer to the cookie banner. It is stored in your browser under the local-storage key aminyx.consent, with the value essential or all.
That entry is strictly necessary to remember your choice. It holds no identifier, it is never sent to a server, and it does not leave your device.
Because no optional script exists yet, choosing Accept all currently enables nothing that Essential only does not. If that ever changes, the banner and this section will name what is being loaded, and nothing non-essential will run before you agree to it.
To change or withdraw your choice, clear this site's stored data in your browser — usually behind the padlock in the address bar, or under Settings, Privacy, site data. The banner will ask again on your next visit.
Under the GDPR you can:
Send any of the requests above to privacy@aminyx.biz. Article 12(3) sets the deadline at one month, extendable by two further months for genuinely complex requests, and we have to tell you if that extension is taken.
If your data sits in a customer's workspace rather than in an Aminyx account — you are a lead or a contact of an Aminyx customer — that customer is the controller. Send your request to them; Aminyx supports them in answering it.
If you think your data has been handled badly, tell us first at privacy@aminyx.biz. It is usually the fastest route to a fix.
You can also complain to a supervisory authority without going through us at all. Article 77 lets you choose the authority in the EU or EEA country where you live, where you work, or where the problem happened.
The lead supervisory authority for Aminyx itself follows from where its main establishment is, which is not published.
To be completed before launch
Name the lead supervisory authority and its contact details once the registered entity and main establishment are settled.
The date at the top is the version in force. When the policy changes, that date changes with it.
Where a change materially affects how personal data is processed, account holders are told before it takes effect.
Privacy questions and data-subject requests go to the privacy address. General enquiries and vulnerability reports have their own.
A postal address will be published together with the controller details above.
Related
How the platform is secured, the terms that govern using it, and a real person for anything this page did not answer.
