Your data stays yours.

Tyrex AI ("Tyrex", "we", "us", or "our") operates the Tyrex AI assistant platform available at tyrex.id, including its web application, the KENAL onboarding interview, the private knowledge base ("Data Studio"), workflows, connectors, and the Tyrex Marketplace (collectively, the "Service").

This Privacy Policy explains what personal data we collect, why we collect it, how we protect it, and the choices you have over it. It applies to everyone who visits our website, creates an account, uses the Service, or buys or sells on the Marketplace. We are built in Indonesia and serve users around the world; we comply with the data protection laws that apply to you wherever you are located.

The controller of your personal data is PT Xyntera Teknologi Indonesia (trading as Tyrex AI), a subsidiary of PT Bukharindo Makmur Sejahtera, Puri Indah A7 No 10, Puri Indah, Jakarta Barat 11610, Indonesia.

Our core promise is simple: your files power only your AI. We do not sell your personal data, and we do not use your private content to train models shared with other users.

We collect information you give us directly, information generated as you use the Service, and limited information from the devices and browsers you use. Specifically:

• Account information. Name, email address, and a securely hashed password when you register. If you log in with Google, we receive the profile information that provider makes available.
• Profile & persona information. Your answers to the KENAL onboarding interview (your role, occupation, communication style, preferences, and rules), your avatar, nickname, and any instructions you give your AI.
• Files & knowledge base content. The documents, images, spreadsheets, and other files you upload to build your private knowledge base, together with derived data such as searchable chunks, summaries, and embeddings created from those files.
• Chat & usage data. Your messages, the AI's responses, feedback you give (thumbs up/down, ratings), tool invocations, the model used (RAPTOR, CARNO, or REX), token consumption, and session metadata such as timestamps.
• Marketplace data. If you list or buy on the Marketplace: your listings, reviews, transaction history, and any public profile information you choose to display. Personal data is automatically stripped from data listings before they go live.
• Payment data. We process payments through a third-party payment processor (which may vary by region). We store transaction references, plan, and amounts — but never your full card number, which is handled entirely by our payment processor.
• Device & technical data. IP address, browser type, operating system, device identifiers, approximate location (only if you enable location metadata, which is off by default), and standard web analytics.
• Communications. Emails or messages you send to [email protected] and any recordings or transcripts where applicable.

We use your information to operate and improve the Service, including to:

• Build your personal AI from your KENAL interview, persona, and preferences, and let it respond in your voice and follow your rules.
• Answer your questions using your private knowledge base (retrieval-augmented generation), along with platform documentation and public reference knowledge when relevant.
• Manage your account, authenticate you, prevent fraud and abuse (including duplicate-account and rate-abuse detection), and enforce our Terms of Service.
• Process payments, issue invoices, and manage subscriptions and refunds.
• Operate the Marketplace: list, sell, purchase, deliver, and rate listings.
• Provide support, send service notifications, and — only with your consent or where we have a legitimate basis — send product updates.
• Improve the Service through aggregated, de-identified analytics. We never improve shared models with your private content.

Where data protection laws require a legal basis (such as the EU GDPR or similar laws in your jurisdiction), we rely on:

• Performance of a contract — providing the Service you asked for, including billing.
• Legitimate interests — security, fraud prevention, abuse detection, and product improvement, balanced against your rights.
• Consent — where you opt in (for example, enabling location metadata, marketing communications, or selling on the Marketplace). You may withdraw consent at any time.
• Legal obligations — such as tax records, or responding to valid legal requests from authorities.

We take reasonable technical and organizational measures to protect your data, including:

• Encryption in transit (TLS) for all traffic between your browser, our web app, and our API.
• Encryption at rest for stored data, including your knowledge base and chat history.
• Per-account isolation: your files, chat history, and AI are scoped to your account and are never shared with other users' AIs.
• Role-based access controls, secrets management, and routine review of internal access.
• Infrastructure hosted on secure cloud providers (including Google Cloud in the Asia-Pacific region) fronted by Cloudflare's edge network.

No method of transmission or storage is 100% secure. While we work hard to protect your data, we cannot guarantee absolute security, and you also play a part — use a strong, unique password and keep your login credentials private.

When you chat with your AI, your message, relevant content from your private knowledge base, and the results of tools your AI used (for example a web page it read for you) are sent to the AI model that serves your request, and used solely to generate the response you asked for.

• Tyrex models (tyrex1.5 Raptor, Carno, Rex and Coder, plus image, video and 3D generation) run on GPU infrastructure we operate through our cloud compute provider, Modal.
• Third-party models you can choose in the model menu (such as Claude, DeepSeek and Kimi) are served through DeepInfra, an inference provider. When you or your persona use one of these models, the same content is sent to DeepInfra to generate the response, under its own terms and privacy policy.

We do not train shared models on your data. Your files and conversations are not used to improve a model that other users access, and they are not sold. If you choose to sell a dataset on the Marketplace, personal data is automatically stripped before the listing goes live, and the marketplace listing is separate from your private knowledge base.

When you connect third-party services (for example Gmail, Google Drive, or GitHub), your AI may access those services only within the permission scopes you approve during connection, and you can revoke access at any time from your Settings.

Tyrex's on-premise AI models are based on open-source model families including Qwen (Apache-2.0, developed by Alibaba Cloud's Tongyi Lab), Gemma (developed by Google), and FLUX.1 Schnell (developed by Black Forest Labs) for image generation.

We keep your data for as long as your account is active and as long as needed to provide the Service, comply with legal obligations (for example tax records), resolve disputes, and enforce our agreements.

• Your chat history, files, and persona are retained while your account exists and deleted — or permanently deleted on request — when you delete them or your account.
• Billing records are retained as required by applicable tax law.
• Aggregated analytics that cannot identify you may be retained longer.
• Backups are kept on a rolling basis and are deleted according to their retention schedule; content deleted from the live database may persist briefly in backups before being overwritten.

We do not sell your personal data. We share data only in the following, limited circumstances:

• Service providers. Processors who help us run the Service — cloud infrastructure, GPU compute for our models (Modal), the inference provider for third-party models (DeepInfra), edge/network services, payments (Midtrans, Google Play, and Paddle.com, which is the Merchant of Record for orders paid through Paddle), OAuth/connector infrastructure, email, and product analytics (PostHog, only if you accept analytics cookies). Each processor is bound by contract to use your data only to provide services to us.
• Marketplace counterparties. When you buy or sell a listing, the limited information needed to complete the transaction (such as the seller's display name and rating).
• Legal requirements. When required by law, regulation, legal process, or a valid government request — and we will tell you where we are legally permitted to do so.
• Business transfers. In connection with a merger, acquisition, reorganization, or sale of assets, your data may be transferred as part of that transaction, subject to this Policy.
• With your consent. In any other case, we will ask first.

Connectors let you link third-party services (Google, GitHub, Slack, and others) so your AI can act in them on your behalf. Catalog connectors run through Composio, an OAuth provider that holds the connection and performs the API calls. When you connect a service:

• You are sent to Composio's authorization page and you approve the permission scopes shown there. We never request more than that page displays.
• Composio stores the access and refresh tokens for the connection and refreshes them. For catalog connectors those tokens are not kept in our database; we store the connection identifier that points to the account you authorized.
• Data your AI reads or writes through a connector passes through Composio's infrastructure to reach the connected service, and Composio processes it under its own privacy policy and terms along with ours. We use it only to carry out the actions you ask for, and we do not sell it or use it for advertising.
• Custom MCP connectors that you add yourself are the exception: for those we store the URL and any credentials you provide, encrypted, in our own database, and we call the server directly.
• You can disconnect a connector at any time from Settings, Connectors. We revoke it with Composio, so it stops working immediately for every persona and project that used it. You can also revoke Tyrex's access from the connected service's own account settings.
• The connected service's own privacy policy and terms apply to your data in that service too, and we encourage you to read them.

Your AI coworkers can use a computer for you in three ways. Each one only runs when you or your AI start a task, and each one is off until you set it up.

1. Bot Computer (your AI's own cloud computer). A browser and desktop that run on our servers, one per account. Pages it opens, what it types and the results it reads are processed like any other tool result. Its browser keeps a profile between sessions, so sites you sign in to there (through Take over) stay signed in until you sign out of them. Screenshots it saves are shown to you; the AI does not keep them.

2. Your own computer (Tyrex AI desktop app). When you choose "Connect this computer" in the desktop app, your AI can open apps, read windows and files, click, type and run short scripts on your Mac or PC.

• You approve each app the first time it is used, and each script before it runs. You can pause or disconnect at any time from the app or from Settings, Computers.
• Window contents, file contents, screenshots and command output are sent to your AI only for the step that needs them. Password fields are refused.
• We keep an activity log of the actions (for example "Opened Excel") with a short summary. It never includes the text that was typed, script contents or file contents.

3. Your Chrome (Tyrex for Chrome extension). The extension lets your AI see and use websites in your own Chrome, with the accounts you are signed in to.

• What it reads. Only tabs your AI opens (kept in a separate window under an orange "Tyrex" tab group) and tabs you choose to share. It never reads your other tabs, your browsing history, bookmarks, downloads or cookies.
• What it sends to Tyrex. When your AI runs a step: the page address and title, the page text, a list of the links, buttons and fields on the page, and, when asked, a screenshot of the visible part of the page. This is processed like any other tool result (including by the model provider described in How Your Data Powers Your AI).
• What it never does. It never reads or fills password, card or one-time-code fields. Banking, e-wallet, payment, password-manager and account-security sites are always blocked.
• Which sites. Your Web access setting (Settings, Capabilities) decides which websites your AI may open: all sites, a list you choose, or none. Sending, posting, paying, deleting or signing in asks you first, according to your approval settings.
• Your activity. To stop the moment you take over, the extension notices when you click or type in a Tyrex tab or a shared tab. It only notes that you did; what you typed is not recorded or sent.
• On your device. The extension stores your Tyrex sign-in session, your account email, a device identifier and its paused state in Chrome's local extension storage. Signing in records the IP address of the sign-in, as any Tyrex sign-in does.
• Stopping it. Click Stop on the page, Pause in the extension, sign out from the extension, disconnect it in Settings, Computers, or remove the extension from Chrome.

Retention for all three. What your AI saw or did becomes part of the conversation: the chat keeps a short excerpt of each result (about 2,000 characters) so your AI can refer back to it. Screenshots passed to the AI are held in memory for at most 15 minutes and are not stored with the conversation. Activity logs and conversations are deleted when you delete them or your account. The Bot Computer's browser profile is kept while your account is active; to have it erased, sign out of the sites in it or email [email protected].

We do not sell this data, use it for advertising, or use it to train models shared with other users.

We use cookies and browser local storage for essential purposes: keeping you signed in, remembering your session, and storing lightweight preferences. We do not use third-party advertising cookies, and we do not sell advertising based on your data. You can clear cookies or use private browsing at any time; doing so may sign you out.

Analytics cookies are optional. On your first visit we ask whether you accept them. If you accept, PostHog sets cookies that record page views, clicks and session recordings so we can see where the product is confusing. In the signed-in app, recordings hide all text and every input, so the content of your chats and files is never captured. If you decline, no analytics cookies are set and we only count visits with an anonymous daily hash computed by PostHog. Clearing your cookies brings the question back.

Depending on where you live (for example, under the GDPR in the EU or similar data protection laws in your jurisdiction), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data or your entire account.
• Port your data in a structured, machine-readable format.
• Restrict or object to certain processing, including direct marketing.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with your local data protection authority.

You can exercise most of these directly from your account settings. For anything else, email us at [email protected] and we will respond within 30 days (or the period required by applicable law).

Your data is primarily stored on servers in the Asia-Pacific region. When data is transferred to other jurisdictions (for example, to service providers operating globally), we rely on appropriate safeguards — including standard contractual clauses where required — to protect your data in line with this Policy.

The Service is not directed at children under 13, and we do not knowingly collect personal data from them. In jurisdictions with a higher minimum age, we comply with the local threshold. If you believe a child has given us personal data, contact us and we will delete it promptly.

If a security incident affects your personal data, we will notify you and the relevant supervisory authority as required by applicable law (for example, within 72 hours where the GDPR applies), describing the nature of the incident and the steps we have taken.

We may update this Policy from time to time. When we make material changes, we will notify you by email or an in-product notice before they take effect. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

Questions, requests, or concerns about this Policy or your data? Contact us at:

PT Xyntera Teknologi Indonesia (Tyrex AI) — Data Protection
Email: [email protected]
Puri Indah A7 No 10, Puri Indah, Jakarta Barat 11610, Indonesia