Privacy Policy

Your data, on your terms.

We collect the minimum needed to run an ISP platform, and we're transparent about all of it.

Effective: 26 August 2026 · Version 1.2 · privacy@trafyx.ai

1. Who we are

Trafyx is a product of Riser Technologies LLC, registered in SHAMS, Sharjah, United Arab Emirates. In this policy, "we", "us", and "Trafyx" refer to Riser Technologies LLC. If you're using Trafyx because your ISP or MSP put you on it, that ISP is the data controller for your account; Trafyx is the data processor.

2. What we collect

Account data

Name, email, phone number, billing address, and any ID document you upload to satisfy KYC or regulatory requirements set by your ISP or by your local telecommunications regulator (for example, UAE TDRA, Ofcom, ACMA, TRAI, FCC — whichever applies to your jurisdiction).

Service data

Your plan, session logs (start/end times, bytes in/out, IP addresses, NAS/router the session was on), payment records, tickets you open, and the contents of your interactions with the Mira AI agent.

Technical data

Browser type, device fingerprint, IP address, and cookie identifiers when you use the admin or subscriber portal.

3. What we don't do

  • We don't sell your data. Ever. Not to advertisers, data brokers, or "partners".
  • We don't train third-party AI models on your data. When Mira calls Anthropic's Claude API, we use zero-retention mode: your prompt and response are not logged, not stored, not used for training.
  • We don't share your data across ISP tenants. Row-level security in our database enforces this at the query layer.

4. Why we process your data

  • To provide the service — activate you on the network, bill you, answer your support tickets, show you your usage.
  • To meet legal obligations — telecommunications regulators worldwide (UAE TDRA, Ofcom, ACMA, TRAI, FCC and others) typically require ISPs to retain certain session logs for a defined period; we help our ISP customers meet whichever obligation applies in their jurisdiction.
  • To improve the platform — aggregate, anonymised usage patterns help us decide what to build next. Your individual data is never identifiable in this analysis.

5. Where your data lives

Primary storage: Supabase managed Postgres. Default region is eu-west-1 (Ireland); we also offer us-east-1 (Virginia) and ap-south-1 (Mumbai) on request. Backups: encrypted at rest in the same region as the primary, with 30-day retention. Data residency is available on the MSP / Carrier tier — pick any supported region and we'll pin your data to it.

6. Who else sees your data

Only the sub-processors we need to operate. Currently: Supabase (hosting), Vercel (application delivery), Resend (email), Anthropic (Mira AI, zero-retention), your chosen payment gateway (Telr, PayTabs, Stripe, PayPal, or others depending on your region), and your chosen SMS provider. Full list on request, and 30 days' notice before any change.

7. How long we keep it

Account data: for as long as your account is active, plus 90 days after closure. Session logs: as required by law in your jurisdiction, or 12 months, whichever is shorter. Payment records: 7 years for tax purposes. Tickets: 3 years. You can request earlier deletion — see below.

8. Your rights

You can ask us to: show you what we have on you, correct it, delete it, export it in a machine-readable format, restrict how we process it, or object to specific processing. Email privacy@trafyx.ai. We respond within 30 days. If we can't fulfil a request (e.g. legal retention), we'll say why.

9. Cookies

We use only strictly-necessary cookies for authentication and session management. No advertising cookies. No tracking pixels. No third-party analytics that phone home. If we ever add analytics, it will be a self-hosted, privacy-first tool with no cross-site tracking.

10. Changes to this policy

When we change this policy, we'll update the version number and date at the top and email you if the changes are material. The previous version stays available on request.

11. Contact

Privacy questions: privacy@trafyx.ai
Security disclosures: security@trafyx.ai
Postal: Riser Technologies LLC, SHAMS, Sharjah, UAE

This policy is written for humans. If you'd like the version for your compliance team with citations to specific regulations that apply to your jurisdiction — GDPR, CCPA, UAE Federal Law No. 45 of 2021, India DPDPA, Australia Privacy Act, or others — email privacy@trafyx.ai and we'll send it.