Skip to content
Why we built Vorthix XOR-1 to answer “insufficient evidence” when it has not earned a conclusion

Legal · Privacy

Privacy Policy

What personal and business data we collect, why we collect it, and what you can do about it. Your code is never sold.

Last updated: October 12, 2026Never sold
§1

Who is responsible for your data

Vorthix provides autonomous AI-driven security research software, including XOR-1. This policy explains what we collect, why, and what you can do about it.

Data controller

Vorthix
Registered address to be published once company registration is complete

Contact

contact@vorthix.com

§2

What we collect

Choose a source to see exactly what falls under it.

Account & contact

Name, email, company, job title, phone (if provided).

Billing

Billing address and payment details via our payment provider. We do not store full card numbers.

Communications

Support requests, sales inquiries, feedback.

Most sensitive

Codebase & engagement data

Source code, repository access and related material you submit, plus the findings generated from it.

§3

How we use your data

We do not sell your personal data. We do not sell or share your submitted source code or findings with third parties for their own purposes.

What we do use it for
  • Provide, operate and maintain the service, including analysis of codebases you submit
  • Communicate about your account, engagement, support and updates
  • Process payments and manage billing
  • Improve and develop our product and services
  • Maintain the security and integrity of our systems
  • Comply with legal obligations
  • Send marketing, only with your consent (opt out any time)
§4

Legal basis (EU / EEA / UK)

Where these laws apply, we rely on one or more of the following.

Contract

To deliver the service you signed up for.

Legitimate interests

To operate, secure and improve our business, where this does not override your rights.

Consent

For optional activity such as marketing. Withdraw it at any time.

Legal obligation

Where the law requires us to process or retain data.

§5–6

Who we share with

Only in four circumstances. Your code and findings never leave your engagement except as described.

Your datastays with youService providersLegal & safetyBusiness transfersYour direction

Service providers

Trusted subprocessors (hosting, payments, email) bound by confidentiality and data-protection duties. Request the current list at security@vorthix.com, or see our Security page.

Legal & safety

If required by law, regulation, legal process or governmental request, or to protect rights, property or safety.

Business transfers

In a merger, acquisition or asset sale, subject to this policy’s commitments.

With your direction

When you explicitly ask us to share with a named third party.

International transfers

Your data may be transferred internationally. Where required, we rely on safeguards such as standard contractual clauses or equivalent mechanisms. Our website is hosted on Vercel, form protection is provided by Cloudflare, and enquiry emails go through our email delivery providers, so data may be processed in the United States and other countries where these providers operate.

§7

How long we keep it

The bars show the shape of each lifecycle, not exact durations.

Account data

While active + a reasonable period

Kept while your account is active, then for a reasonable period to meet legal, accounting or reporting duties.

Codebases & findings

Engagement only

Kept only as long as needed to deliver and support your engagement, then deleted on schedule: 30 days after engagement completion. Ask for earlier deletion at any time.

Billing records

As tax law requires

Kept as applicable tax and accounting law requires.

§8

Your rights

Depending on where you live, you may have these rights. We respond within the timeframe applicable law requires.

Access

Get a copy of the personal data we hold about you.

privacy-request.txt
# send to contact@vorthix.com
To:       contact@vorthix.com
Subject:  Privacy request: [access | correct | delete | restrict | port | withdraw]

Account email:  you@company.com
Request:        Describe what you want us to do
§9

Cookies & tracking

How our website uses cookies and similar technologies.

Always on

Essential

Remembers your light or dark theme choice in your browser, and uses Cloudflare Turnstile on our forms to prevent spam.

Aggregate

Analytics

We use Vercel Analytics to measure overall site traffic in a privacy-focused, aggregate way.

Not used

Marketing

We do not use advertising or marketing cookies.

Cookie settings: we do not currently show a cookie banner, and if we add non-essential cookies we will update this page and add cookie controls.

§10–14

Security & contact

Security

We use technical and organizational measures to protect your data, described on our Security page. No method is 100% secure, and we cannot guarantee absolute security.

Changes

We post updates here with a new date, and give extra notice when changes are material.

Governing law

Laws of the State of Delaware, United States, without regard to conflict-of-law principles.

Contact

contact@vorthix.com
Registered address to be published once company registration is complete

Questions about the rules of use? Read our Terms of Service, or contact us.