Legal

Privacy Policy

How Aglyn LLC collects, uses and protects personal information across the platform, the console, tenant sites and our APIs.

Last updated: October 19, 2026

This Privacy Policy explains how Aglyn LLC, a Texas limited liability company ("Aglyn," "we," "us," or "our"), collects, uses, discloses, and protects personal information in connection with the Aglyn platform and related websites and services, including aglyn.com, app.aglyn.com (the console), the Besigner site builder, tenant sites on aglyn.app, docs.aglyn.com, our APIs, plugins, and the Aglyn marketplace (collectively, the "Services").

Two roles — please note the difference:

When we act as a controller (business): For personal information of our account holders, prospective customers, and visitors to our own sites, Aglyn decides how and why the information is processed. This Policy governs that processing.
When we act as a processor (service provider): When you (a customer) build a website, storefront, form, dataset, or CRM using the Services and collect personal information from your End Users, you are the controller of that information and we process it on your behalf under our Terms of Service and Data Processing Addendum. Your own privacy policy — not this one — governs your End Users, and you are responsible for it.

1. Information We Collect

1.1 Information you provide.

Account & identity: name, email address, password or authentication credentials, and profile details, established through our identity provider (Google Firebase Authentication), which may include third-party sign-in identifiers (e.g., Google account identifiers).
Phone number: a mobile or other telephone number, where you give us one — at signup, in your user or organization profile, or as a billing or support contact — or where your organization's single sign-on identity provider includes a phone number in the assertion it sends us when you sign in. Providing a phone number is optional. See Section 2 for how we use it and Section 11 for how to opt out of marketing calls and texts.
Organization & membership: organization details, team member and invitee email addresses, roles, and permissions.
Billing: plan selection, billing contact, subscription and transaction identifiers, and add-on/seat quantities. Payment card details are collected and processed directly by our payment processor (Stripe); Aglyn does not store full card numbers.
Domain registration: the domain names you search for and, when you buy a domain name through the Services, the registrant contact details you give — name, email address, telephone number, postal address, and a company name if you give one — which we pass to our registrar partner to register the name (see Section 3). We keep only the registrant's name and email address, with the domain's registration record: its prices and charges, its registration, renewal, and expiry dates, its auto-renew setting, the renewal notices we sent, whether the registrant's email address has been verified, and a short history of what has happened to it. Some of this record comes from the registrar.
Content & data you submit: websites, screens, layouts, media/assets, datasets, products, forms, contacts/CRM records, and other Customer Content — which may itself contain personal information about your End Users. When you upload an audio file, we ask you to confirm that you own it or have a license to use it on your site, and we store your confirmation with the file: the statement you confirmed, who confirmed it (your user identifier, or the API key used), and when.
Support & communications: messages, feedback, and information you share when you contact us.

1.2 Information collected automatically.

Usage & device data: log data, IP address, browser and device type, pages/screens viewed, actions taken, timestamps, referring URLs, and similar analytics.
Cookies & similar technologies: as described in our Cookie Policy.
Security & anti-abuse: information used for authentication, session management, rate limiting, and bot protection (including Google reCAPTCHA), and audit/activity logs.

1.3 Information from third parties. We may receive information from authentication providers (e.g., Google), our payment processor (e.g., subscription status), and infrastructure providers, as needed to operate the Services.

Business contact information about prospective customers. We may collect business contact information about people who work at organizations we believe may benefit from Aglyn — such as name, job title, employer, work email address and public professional profile — from publicly available sources, including company websites and professional networking sites, and from business contact data providers. We use it only to contact you about Aglyn, and we do not sell it.

1.4 Data we process on your behalf (as processor). When End Users interact with your Hosts (e.g., submit a form, create an account/membership, make a purchase, or browse a storefront), the Services process personal information such as contact details, order and payment metadata, membership/subscription data, and site-analytics data on your behalf and under your instructions. See the DPA.

Advertising conversions on sites built with Aglyn. If a site owner connects their own Meta, TikTok or Pinterest ad account to their site, Aglyn reports that site's purchases and form submissions to that account on the site owner's behalf, using the owner's own access token. This happens only for visitors whose cookie choices on that site allow advertising (where the law requires the site to ask first, only after they accept; elsewhere, unless they have turned advertising off), and whose browser does not send a Global Privacy Control signal. For a purchase, a report carries the order ID, value excluding tax, currency and items. For a form, it carries only that it was submitted; nothing else typed into it is sent, apart from the hashed details below. The visitor's email, phone, name, city, state, postal code and country are sent only as SHA-256 hashes; the visitor's IP address, browser user agent, the page address (without its query string) and the ad platform's own browser identifiers are sent unhashed. No payment details are sent, and the records Aglyn holds to send these reports expire after 14 days.

2. How We Use Information (as Controller)

We use personal information to:

provide, operate, maintain, secure, and improve the Services;
create and manage accounts, organizations, and authentication;
process subscriptions, billing, and usage metering, and prevent payment fraud;
register, renew, connect, and transfer domain names you buy through the Services, check requested names against names that imitate well-known brands, and send the verification reminders, renewal notices, and other messages about them that registration rules and our Terms of Service require;
provide support and respond to requests;
send service, transactional, and administrative messages (via our email provider, Resend);
contact you about your own account — including billing, invoicing, payment problems, and collection of overdue amounts, and service, security, and administrative notices — by email and, where you or your identity provider have given us a phone number, by telephone call or text message;
with your consent where required, send product updates and marketing;
contact you for sales and marketing purposes — including plan upgrades, add-ons, new features, and other product offers — by email and, where permitted by law and with your prior express consent where the law requires it, by telephone call or text message to a phone number we hold for you;
monitor, analyze, and improve performance, reliability, and features, including developing new features;
detect, investigate, and prevent fraud, abuse, security incidents, and violations of our terms; and
comply with legal obligations and enforce our agreements.

Legal bases (EEA/UK): performance of a contract; our legitimate interests (operating, securing, and improving the Services); consent (where required, e.g., certain cookies and marketing); and compliance with legal obligations.

AI features. Some features use third-party AI providers — currently Anthropic and, for creating images, Google — to generate assistance or content. These include Aglyn Assist, the in-console helper that answers questions about using Aglyn, can carry out actions in the console that you confirm first, and can propose changes to the page, component, or layout you have open in the Besigner, which take effect only if you choose to apply or save them; the editor's writing and layout assistance; AI generation, which creates drafts and proposals for your site from a brief you write, such as copy, layouts, templates, search titles and descriptions, and theme changes; AI insights, which answer your questions about your own figures, such as your site's traffic, sales, bookings, forms, campaigns, A/B tests and datasets, and, if you ask for them, write a weekly summary of them; and AI assistance in the CRM, which summarizes a contact, company, deal, or lead for you and suggests a next step, drafts a one-to-one email for you to review and send yourself, and suggests how the columns of a spreadsheet you import match your CRM's fields.

What AI features send. When you use one of these features, we send the provider what that feature needs to return a result: your question, instruction, or brief, with the earlier messages of the same Aglyn Assist conversation, and the content of the page, element, post, or section you are working on; on some plans, your organization's name and the console page and site you are working in; for a change proposed in the Besigner, an outline of the page, component, or layout you have open — its elements, their names, their shortened settings and text, and the styles of the element you selected; for AI generation, a summary of your site — the names and addresses of its screens and collections, the names of its components, layouts, templates, forms, and datasets and of their settings and fields, and your theme's summary, colors, and fonts; for AI insights, your question and tables of totals, counts, and rates computed from your records — such as page views and your most viewed pages and referring sites, each form's views and submissions, revenue, orders, and your best-selling products, bookings by service, each campaign's delivery, open, and click rates, and each A/B test's conversions, and, for a dataset you can see, the names and types of its fields, its record counts and number ranges, and totals grouped by the values of one field that at least three records share — with email addresses and phone numbers removed, and never an individual visitor, contact, customer, order, booking, form submission, or dataset record; for a theme change, your site's current theme settings, and brand colors taken from your organization's brand settings, from your site logo in your media library, or from a public web page your brief links to, of which only the colors are sent; and, for features that review or write search information for your site, the text and structure of the pages concerned; for features that write product copy, your store's name, the product's name, type, description, tags, options, and search title and description, the names of your store's product categories, and the product's first photo from your media library, sent as a smaller copy (at most 768 pixels on its longer side) without the original file's embedded details such as the camera, date, or location — no other photo, file, or file name from your media library is sent, and no price, stock level, order, or customer information is sent; for features that propose products, categories, or discounts from a brief, your store's name and the names of your store's existing product categories; and, for AI assistance in the CRM, the contact, company, deal, or lead you open, as the CRM shows it to you, with all of its standard and custom fields — including email addresses, phone numbers, postal addresses, marketing consent, notes, its timeline, and the names of the people and records it is related to — but never a password, sign-in token, account identifier, or record identifier; for an email draft, also your request and the names of the merge fields the record can fill; and for an import, your file's column headers and the kind of values in each column, never a row of the file. When you ask AI to draft an automation, we also send which of the CRM, webhooks and bookings your plan includes. When you ask AI to explain an automation, we send an outline of how it is set up: what starts it, its conditions, and each step with the text you gave it and the names of the lists, campaigns, workflows, webhooks and datasets it uses. When you ask why a run failed, we also send when that run happened, what it did and the errors it recorded. We remove email addresses from the outline before sending it, and we never send the details of the event that started a run, such as what a visitor entered in a form. For creating images in your media library other than SVG illustrations, we send your description and the shape you choose to Google, our provider for image generation, and nothing else from your account or site; for SVG illustrations, icons, patterns and logo marks, we send our AI provider your description, the kind and shape of picture, and your site's theme colors or the colors you choose. We do not send your account identifiers, email address, or authentication tokens to the provider. Do not submit sensitive personal information to AI features unless necessary, and review outputs before use.

Aglyn Assist conversations. We keep a record of your use of Aglyn Assist: the question you asked, the answer it gave, which console page you were on when you asked, and the number of tokens the exchange used. When an answer proposes changes in the Besigner, the record also notes how many changes it proposed and whether you applied them, and applying them is recorded in your site's activity log. If you rate an answer using the thumbs control, we keep that rating alongside the exchange. The record is stored against your Organization, is accessible to us, and is used for five purposes — to find what our documentation and our product fail to explain so we can improve both, to improve the assistant's answers, to meter and price the feature, to help you when you or your Organization asks us for support or to fix a problem with an answer, and to investigate abuse, security incidents, and violations of our terms. We do not use it to build a profile of you, we do not use it for advertising, and we do not sell it. Retention and deletion are described in Section 5.

AI generation jobs. When you, another member of your Organization, or a collaborator on one of your sites starts AI generation, we keep a record of the job: the brief and the options chosen for it, who started it and when, the plan it proposed and who confirmed it, its progress and the AI credits each step used, and what it produced — a link to each draft it created and, for a result that is not saved as a draft of its own, such as a piece of copy or a proposed theme change, the result itself. The record is stored against your Organization and is visible to its members and to us. Besides running the job, we use it to help you when you or your Organization asks us for support or to fix a problem with the job, and to investigate abuse, security incidents, and violations of our terms. Authorized Aglyn staff may review an account's or Organization's AI requests — its Aglyn Assist questions and answers and its AI generation briefs, options, and results — for support and for those investigations, and each review is recorded in our staff access log. Your Organization's activity log and our internal audit log record that a job was started and what it created, without the text of its brief or of what it wrote. Drafts a job creates become part of your site's content. For AI insights, the answer and the tables it was written from are kept beside the job record rather than on it, and are shown only to the member who asked or, for a weekly summary, to members who can access the site, and to us. If you turn on weekly insights for an Organization, we record that choice on your account and, each Monday, send you a summary for its busiest sites you can access, in the console and by email. You can turn it off in your notification settings. For AI assistance in the CRM, the result — a summary with its suggestions, an email draft, or a column matching — is kept beside the job record rather than on it. A summary is shown to members who can open the record in the CRM, and an email draft or a column matching only to the person who asked; each is also accessible to us. AI never sends an email; you review a draft and send it yourself. Retention and deletion are described in Section 5.

AI usage and allotments. For each person in each Organization, we keep a monthly record of their use of AI features: the AI credits they used and our estimated cost of serving them, how many requests they made and how many were refused, and how that usage divides by kind of request and by site. It can be seen by the person it is about, by members of the Organization who can view its billing or audit log, and by us. For an Organization on the Free plan, we also count AI usage against the account of its owner, so that the Free plan's limits apply across all the Organizations that account owns on the Free plan. The people who manage your Organization's billing, and a site's administrators for that site's collaborators, can set an AI allotment for a member, a site collaborator, or a site; an allotment records whom it applies to, its monthly limit, any models it allows, and who set it. When usage passes a notice threshold on an allotment, we tell your Organization's owners and administrators and, for an allotment that applies to a person, that person, in the console and by email. We use these records to operate, meter, and bill AI features, to show usage to you and your Organization, and to prevent abuse. Retention and deletion are described in Section 5.

We do not sell personal information. We may share information with:

Subprocessors / service providers who help us operate the Services (hosting, database, storage, payments, email, text messaging, shipping, security, analytics, AI, video hosting). See our Subprocessors list. Current core providers include Google (Firebase/Cloud, including reCAPTCHA), Vercel, Stripe, and Resend, and our AI features use Anthropic and, for creating images, Google Cloud Vertex AI, as described in Section 2. Commerce features can use Twilio to send a store’s customers text messages about their orders, and Shippo or EasyPost for shipping rates, labels and tracking. Sales tax services a merchant connects with its own account, such as Avalara or TaxJar, act for that merchant, as Section 10 describes. Films on our own marketing site are hosted and streamed by Wistia, whose player loads when you press play or, on a page built to show a single film, with the page if your privacy choices permit analytics.
Payment processor (Stripe) to process subscriptions and, for commerce features, to facilitate your sales via Stripe Connect.
Domain registrars and registries — when you buy a domain name through the Services, we send the registrant contact details to our registrar partner, Vercel, which registers the name through the ICANN-accredited registrar that sponsors it. That registrar and the registry that operates the domain's ending (such as .com), which may be outside the United States, hold the details as the domain's registrant record, as ICANN's rules require, and use them under their own terms and privacy policies. Public registration data lookups (WHOIS and RDAP) show details such as the domain's registrar, dates, status, and name servers. The registrant's personal contact details are redacted from them where the registry allows, and the registrar or registry may disclose them where the law or ICANN policy requires, such as to someone with a legitimate legal claim or in a domain name dispute.
Other organization members — information may be visible to members/administrators of your Organization.
Legal & safety — to comply with law, legal process, or governmental requests; to enforce our terms; and to protect the rights, property, or safety of Aglyn, our users, or others.
Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
With your direction or consent.

"Sale"/"sharing" under U.S. state laws. We do not "sell" personal information for money. With your consent, we do "share" personal information for cross-context behavioral advertising as U.S. state privacy laws define that term: our own sites use advertising and measurement technologies from third-party advertising platforms, such as Google, Meta, and LinkedIn, so that we can show you Aglyn ads on other sites and services and understand whether they worked. We also show Aglyn ads to people who already have an Aglyn account, and leave them out of ads meant for people who don't: for account holders in the United States, we send Google, Meta, and LinkedIn a hashed (one-way scrambled) copy of the email address on the account; each platform matches it against its own users, uses a match only to show or exclude our ads, and discards addresses it can't match. The categories involved are online identifiers, device and browser information, your activity on our own sites, and, for account holders, that hashed email address. Advertising technology runs on our own marketing site, console and documentation site; it does not run on customer Hosts unless the Host operator enables it themselves. Where the law requires us to ask first — the EU, the UK, and anywhere we cannot determine your region — it does not load until you accept. Elsewhere it runs from your first visit and you can turn it off whenever you like. You can withdraw at any time using the "Your Privacy Choices" control on any page, which stops the sharing, signals the platforms to stop, and clears the related cookies from your browser; clearing them stops future joins but cannot retract information a platform has already received. To stop us sending your hashed email address, email privacy@aglyn.com; we will stop including it and remove it from the lists we have already sent. We also honor opt-out preference signals: if your browser sends Global Privacy Control, we treat that as an opt-out and no advertising technology loads at all. We use analytics on our own sites to understand how they are used; where analytics is connected to advertising it operates under the same consent and the same opt-out, and where it is not it is neither a "sale" nor a "share" as those laws define them. Our service providers process personal information only to provide the Services under contracts that restrict them accordingly.

4. Cookies & Tracking

We and our providers use cookies and similar technologies for authentication, security, preferences, and analytics. For details and choices, see the Cookie Policy.

5. Data Retention

We retain personal information for as long as needed to provide the Services, maintain your account, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods vary by data type and context. Some specific periods we operate today: when you request deletion of your organization, a 7-day reversible hold precedes the permanent erasure, so an accidental or malicious request can be canceled; after the hold, the erasure is a genuine recursive delete and we keep no copy of the erased content — only an internal record that the erasure happened, retained for a limited period. Database backups are kept on a 14-week cycle and deleted media is recoverable for 7 days, so residual copies of deleted data can persist in backups for up to that period before expiring. For data we process on your behalf, retention is governed by your instructions and the DPA. You may request deletion as described in Section 7, subject to legal and operational limits. You are responsible for maintaining your own backups of your content.

AI features. The questions you ask Aglyn Assist and the answers you receive, including answers that propose changes in the Besigner, are deleted automatically 180 days after the exchange. We keep a record of each exchange for longer — which documentation it drew on, which model answered, what it cost, any rating you gave, and how many changes it proposed and whether they were applied — but that record contains neither your question, your answer, nor your user identifier, and we use it only to improve our documentation and the assistant and to operate and meter the feature. The record of an AI generation job — its brief and options, its plan, and any result kept on it, or kept beside it for AI insights with the tables it was written from — is deleted automatically 180 days after the job is started, and the result of AI assistance in the CRM, which is kept beside that record, is deleted automatically 14 days after it is produced; drafts a job creates are part of your site's content and are kept until you delete them. Monthly records of each person's AI usage are deleted automatically 13 months after the end of the month they describe. AI allotments are kept until they are changed or removed. Your choice to receive weekly insights is kept with your account until you change it. All of this is erased with your Organization in any case, under the 7-day reversible hold described above. The monthly count of AI usage we keep against an account for the Free plan's limits is kept with the account. When a person's account is erased, the erasure also deletes that count, their monthly AI usage records in every Organization, and the AI allotments set for them in the Organizations they belong to when the erasure runs. You may request deletion sooner as described in Section 7.

Domain names. We do not keep the registrant's telephone number or postal address once the registration has been placed with the registrar. We keep the registrant's name and email address and the domain's registration record for as long as the domain is registered through us, and afterward for as long as we need them for billing, tax, dispute, and other legal purposes. The registrar and the registry keep registrant data under their own retention rules, which ICANN requires to continue for a period after a registration ends.

6. Security

We use reasonable technical and organizational measures designed to protect personal information, including authentication controls, access restrictions, encryption in transit, and infrastructure provided by reputable vendors. However, no system is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your credentials and configuring your Hosts securely. See our security-disclosure process at security@aglyn.com.

7. Your Privacy Rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal information, to object to processing, and to withdraw consent.

EEA/UK (GDPR): rights of access, rectification, erasure, restriction, portability, objection, and to lodge a complaint with a supervisory authority.
California (CCPA/CPRA) and similar U.S. state laws: rights to know, access, delete, correct, and to opt out of "sale"/"sharing" and certain targeted advertising. Because we share for cross-context behavioral advertising where you have consented, that right is live: use "Your Privacy Choices" on any page, or send Global Privacy Control, and we will stop. We do not sell personal information for money. You also have the right not to be discriminated against for exercising these rights.

To exercise rights, contact privacy@aglyn.com. We will verify your request as required by law. If your request concerns personal information we process on behalf of a customer (as processor), please contact that customer directly; we will assist them as required by the DPA. You may authorize an agent to act on your behalf where permitted by law.

8. International Data Transfers

We and our providers may process and store information in the United States and other countries where our providers operate. These countries may have different data-protection laws than yours. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers. By using the Services, you understand your information may be transferred to and processed in such countries.

9. Children's Privacy

The Services are not directed to children under 13 (or the applicable minimum age), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact privacy@aglyn.com and we will take appropriate steps. If your Host collects information from children, you are responsible for compliance with applicable children's-privacy laws (e.g., COPPA, GDPR-K).

10. Third-Party Sites & Services

The Services link to and integrate with third-party sites and services that we do not control. Their privacy practices are governed by their own policies. We are not responsible for third-party practices. A service you connect with your own account, such as a shipping or sales tax service, acts for you under your agreement with it and is not our subprocessor. If you use one-click DNS to connect a domain you registered elsewhere, we send the domain name to that domain's DNS provider through its Domain Connect service, to check whether the provider supports it, and then open the provider's own approval page. The provider changes your DNS records only after you sign in with it and approve, and we never receive your sign-in details for that provider.

11. Marketing Communications

You may opt out of marketing emails using the unsubscribe link or by contacting us. If we emailed you as a prospective customer, you can also opt out by replying to that message; we will stop contacting you and keep only your email address on a limited internal do-not-contact list used for nothing else. You may opt out of marketing telephone calls and text messages at any time — reply STOP to any marketing text to stop texts, tell us during a call, or email privacy@aglyn.com to stop calls, texts, or both — and you may ask us to delete the phone number we hold for you. If you do, we will delete it from your account and keep it only on a limited internal do-not-contact list, used for nothing else: that record is the only way we can recognize your number and avoid contacting it again. We may still send you non-promotional, service-related messages, including account, billing, payment, security, and administrative notices, by email and, where we hold a phone number for you, by call or text.

12. Changes to this Policy

We may update this Policy at any time. Material changes will be indicated by updating the "Last updated" date and, where appropriate, by additional notice. Your continued use of the Services after changes take effect constitutes acceptance.

13. Contact Us

Aglyn LLC (a Texas limited liability company)

Privacy: privacy@aglyn.com

General: info@aglyn.com