Legal
Privacy Policy
Effective: 17 October 2026
Who we are
Odd Parity Ltd (trading as CLUX) is the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Company number 17522699, registered office 124 City Road, London EC1V 2NX, England and Wales. Contact for anything in this policy: help@clux.io. We are registered with the Information Commissioner's Office (ICO). We have not appointed a data protection officer; the law does not require one for a company of our size and activity.
The short version
- We collect what we need to sign you in, run evaluations, bill you and answer you. No advertising, no analytics cookies, no selling of data.
- Your pasted transcripts go to Anthropic (US) to be graded. Known secrets are replaced with labels before that happens. Anthropic does not train on them.
- Reports are stored for 180 days. To delete one sooner, email help@clux.io with its link or the transcript.
What we collect, why, and on what legal basis
| Data | Where it comes from | Why | Legal basis (UK GDPR Article 6) |
|---|---|---|---|
| GitHub login and Clerk user ID | GitHub sign-in via Clerk | To give you an account and tell your evaluations apart from everyone else's | Contract (6(1)(b)) |
| Email address | Your GitHub account, held by Clerk. Today CLUX's own database stores no email; Clerk holds it | Sign-in emails, notices about your account, receipts | Contract (6(1)(b)); legal obligation for receipts (6(1)(c)) |
| Pasted transcripts (a command's input and output) and the reports we generate | You | To run the evaluation and let you open the report again | Contract (6(1)(b)) |
| Rulesets and style guides you upload or we extract | You | To check commands against your conventions | Contract (6(1)(b)) |
| Early-access form: name, work email, company, role, what you hope to achieve, which features you asked for, which page you came from, and whether you agreed to be contacted | You | To reply to your request and, if you agreed, to tell you when the feature is ready | Legitimate interest (6(1)(f)) for replying; consent (6(1)(a)) for follow-up contact, which you can withdraw by replying "stop" |
| Usage ledger: for each model call, its kind, the model used, tokens and estimated cost, linked to your account | Generated by the service | To count your free allowance and credits, to bill you, and to keep our own costs in check | Contract (6(1)(b)); legitimate interest (6(1)(f)) in cost control |
| Audit log: who changed what in an account (for example, a plan change), with before and after values | Generated by the service | Security, support, and proving what happened in a billing dispute | Legitimate interest (6(1)(f)) |
| Payment details (once card checkout launches) | Stripe | Billing. We will receive a payment confirmation and the last four digits of a card; we will never see the full card number | Contract (6(1)(b)); legal obligation to keep tax records (6(1)(c)) |
| IP address | Your browser | Rate limiting and abuse prevention | Legitimate interest (6(1)(f)) in keeping the service up |
| Audit customers: your CLI's source code, the report, and emails with you | You | To deliver the audit | Contract (6(1)(b)) |
You need to give us your GitHub sign-in data to have an account; without it we cannot run the service for you. Everything else on this list is optional or generated by the service as you use it.
IP addresses. To count free evaluations and sign-ups per visitor and to limit abuse, we store a one-way hash of your IP address combined with the date in our Redis store (US) for up to two days; it cannot be linked across days. The share endpoint keeps your IP address in the server's memory for up to an hour. Our hosting provider, Vercel, keeps its own request logs for a period set by its plan terms. We do not write IP addresses to our database.
What we do not do. No advertising. No analytics or marketing cookies. No tracking pixels. We do not sell personal data, and we do not use your transcripts to train any model.
Cookies
clux.io uses only storage that is strictly necessary to run the service, so under the Privacy and Electronic Communications Regulations 2003 (PECR), regulation 6, we do not ask for consent and there is no cookie banner: Clerk's session cookies, which keep you signed in; Vercel BotID, which stores a token in your browser to tell a real browser from an automated one when you run an evaluation or sign up (we are verifying exactly what BotID stores and will update this page); and your local evaluation history (below). When card checkout launches, Stripe's checkout page will set Stripe's own cookies under Stripe's privacy policy. We use no advertising, analytics or tracking cookies. If we ever add analytics we will ask first and update this page. Source: ICO, "Cookies and similar technologies", https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/.
Your browser also keeps a local history of your recent evaluations in its own storage (localStorage). That never leaves your device; clearing site data removes it.
Secrets in transcripts
Before a transcript reaches the model, our cache, a share link or your browser's history, CLUX replaces known secret shapes with typed labels, for example [REDACTED:api-key]: API keys from common providers, private keys, JSON web tokens, bearer tokens, passwords in URLs, password=/token= style assignments, and email addresses. The original is never stored. This is a safety net, not a guarantee: please do not paste credentials. If you did and the redaction missed it, rotate the secret and email help@clux.io so we can delete the stored report.
Where your data goes: processors and international transfers
We are in the UK. Several of our providers are in the United States. A transfer from the UK to the US is a "restricted transfer" under UK GDPR Chapter V; we rely on the UK Extension to the EU–US Data Privacy Framework ("UK–US data bridge", in force 12 October 2023) where the provider is certified for it, and otherwise on the provider's data processing agreement with the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. Source: ICO, "International transfers", https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-transfers-a-guide/.
| Provider | What it does for us | Country | Transfer mechanism | Agreement |
|---|---|---|---|---|
| Anthropic, PBC | Grades transcripts and reads the rulesets and style guides you upload; looks up a command's public documentation by web search | US | Anthropic's DPA, which includes a UK Addendum | https://www.anthropic.com/legal/data-processing-addendum · Commercial Terms (no training on API content, section B): https://www.anthropic.com/legal/commercial-terms · Deletes API inputs and outputs within 30 days: https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-personal-data (each as published by Anthropic at the date at the top of this page) |
| Vercel, Inc. | Hosts the website and runs the application; bot detection | US (edge locations worldwide) | Data Privacy Framework with the UK extension | https://vercel.com/legal/dpa · DPF status: https://vercel.com/kb/guide/is-vercel-certified-under-dpf |
| Neon (a Databricks company) | Postgres database: accounts, usage ledger, early-access requests, rulesets | US (AWS us-east-1) | We are confirming this and will update this page by 13 November 2026. | https://neon.com/pdf/DPA.pdf · https://neon.com/platform-terms |
| Upstash, Inc. | Redis store: saved reports and share links | US | Data Privacy Framework with the UK extension | https://upstash.com/trust/dpa.pdf · https://upstash.com/trust/privacy.pdf · https://trust.upstash.com/subprocessors |
| Clerk, Inc. | Sign-in with GitHub; holds your email and session | US | Data Privacy Framework with the UK extension | https://clerk.com/legal/dpa · https://clerk.com/legal/dpf · https://clerk.com/legal/subprocessors.md |
| Resend, Inc. | Emails us when someone requests the audit or the founding program; the email contains what they entered on the form | US | We are confirming this and will update this page by 13 November 2026. | https://resend.com/legal/dpa |
| Stripe Payments UK Ltd / Stripe, Inc. | Payments and receipts, once card checkout launches. Stripe will process your payment as a separate controller under its own privacy policy (https://stripe.com/gb/privacy); we will receive the payment status and the last four digits of the card | UK / US | Stripe's DPA (includes transfer terms); a UK Stripe account contracts with Stripe's UK entity | https://stripe.com/legal/dpa |
| Google LLC (Google Workspace) | Our email (help@clux.io): anything you email us | US (with EU/UK data regions available) | We are confirming this and will update this page by 13 November 2026. | https://workspace.google.com/terms/dpa_terms.html |
| GitHub, Inc. | Identity provider: you sign in with GitHub. GitHub is not our processor; it acts under its own privacy statement. When you sign in, GitHub gives Clerk your public profile, username and primary email address; CLUX asks for no repository access. You can revoke CLUX's authorization at any time in your GitHub settings under Applications | US | — | https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement |
We will update this table before adding a provider that handles personal data.
We do not share personal data with anyone else, except if the law requires it (for example, a court order), to protect someone's safety, or with a buyer of the business, who would be bound by this policy.
How long we keep things
| Data | How long we keep it |
|---|---|
| Saved reports and shared report links (Redis) | 180 days from when they are saved, then deleted automatically. |
| Transcripts at Anthropic | Deleted by Anthropic within 30 days, as published by Anthropic at the date at the top of this page. |
| Account record (Clerk ID, GitHub login) | Deleted within 30 days of you closing your account. |
| Usage ledger and credit ledger | Kept for 6 years from the end of the financial year, for accounting records, with the account id replaced so the rows no longer identify you once your account is deleted. |
| Audit log of account changes | Kept for 6 years, pseudonymized in the same way. |
| Early-access requests | Deleted 12 months after our last contact with you, or when you ask. |
| Email with us | Deleted after 2 years unless it is part of a contract or a dispute. |
| Audit customers' source code | Deleted 30 days after the re-check window closes (see Terms, section 6). |
| Payment records (Stripe, once card checkout launches) | 6 years from the end of the financial year, for tax. |
| IP addresses | A dated one-way hash, up to 2 days in Redis; the raw address, up to an hour in the share endpoint's memory. Vercel's request logs are kept for a period set by its plan terms. |
Your rights
Under UK GDPR you can ask us to:
- Access the personal data we hold about you (Article 15) and get a copy;
- Correct it (Article 16);
- Delete it (Article 17), including your early-access request and any stored report or share link you send us the link or transcript for. Reports are stored under a hash of their content, not under your name, so we need the link or the text to find one; deleting it also removes the stored report for anyone else who evaluated the identical transcript;
- Restrict or object to processing based on legitimate interest (Articles 18 and 21);
- Port the data you gave us, in a machine-readable form (Article 20);
- Withdraw consent where we rely on it, such as early-access follow-up emails, at any time without affecting what happened before.
Email help@clux.io from the address on your account, or from the address you used on the early-access form. We will reply within one month; the law allows us to extend by two months for complex requests, and we will say so if we need to. We do not charge for these requests unless they are clearly unfounded or excessive. We may ask you to confirm your identity (usually a reply from the GitHub-linked email is enough).
We do not make decisions about you by automated means that have legal or similarly significant effects (Article 22). A report grades a command-line tool, not you.
Complaints
If you are unhappy with how we handle your data, tell us first at help@clux.io and we will try to put it right. You also have the right to complain to the UK regulator, the Information Commissioner's Office: https://ico.org.uk/make-a-complaint/, or by phone on 0303 123 1113. If you live in the EU or EEA, you may complain to your local supervisory authority instead.
Children
CLUX is for working engineers and is not aimed at children. We do not knowingly collect personal data from anyone under 18. If you think a child has given us data, email help@clux.io and we will delete it.
Security
Everything travels over TLS. Secrets are redacted before storage or transmission. Access to production systems is limited to the company's director. Reports are stored under a hash of their content, not under your name. If a personal data breach puts you at risk we will tell you without undue delay, and the ICO within 72 hours where the law requires (Articles 33 and 34).
Changes
We will post changes here with a new effective date, and email you about any change that affects what we do with your data at least 30 days before it takes effect, matching Terms section 15.
Contact
Odd Parity Ltd, trading as CLUX Registered in England and Wales, company number 17522699 124 City Road, London EC1V 2NX help@clux.io