Staxly privacy policy

Staxly is run by Staxly LLC. This page says what Staxly collects, why, who else receives it, and what you can ask us to do.

What Staxly collects about you

Your name and email address. If you sign in with GitHub, also your GitHub username and a link to your GitHub profile picture.
If you sign in with an email address and a password, Staxly keeps the password only in a scrambled form that cannot be turned back into it.
Your organisation’s name, who belongs to it, and each person’s role.
For each sign-in, the internet address and the browser it came from.
A log of what people in your organisation do in Staxly, such as connecting a cloud account or applying a fix, with the internet address it came from where Staxly has one.
If you send an enquiry: your business name, your name, your email address, what you want help with, and anything else you choose to give: a phone number, a website, which cloud you use, a message.
If you pay: your billing details, which Stripe holds. Staxly does not see your full card number.

What Staxly reads in your cloud

Only once your cloud is connected to Staxly. The trust page explains how; these are the same lists. staxly.io/trust

Reads

The list of what you run, and how each part is configured
Who has been given access to what
Microsoft’s own security and cost recommendations
What each part costs
The activity log: who did what, and when
Only if an admin turns it on: counts from app monitoring of which app calls which and how many of those calls failed; and, only if an admin also turns on watching for unusual failures, how many requests each app answered and how many failed
Only if you turn logging on and let Staxly read it: answers to fixed questions about requests to your storage, such as how many used outdated encryption, and from which addresses
Staxly keeps your resources' tags, names and values, as part of the description of your estate.

Never reads

Storage keys or Key Vault secrets
The contents of your files, databases or messages
Error messages, the web addresses people visit, or database queries, in your logs or monitoring data

Why Staxly uses it

To run Staxly for your organisation: reading your cloud, showing what is wrong in each application, making fixes, and keeping the record of them. To answer enquiries and support requests, and to send the emails the service sends. Staxly does not sell your information and does not use it for advertising.

Where it is kept

Staxly runs on Microsoft Azure, in the Central US region. Its servers, its database and its backups, and its own logs, are all there.

Who else receives it

Company	Why	What it receives
Anthropic	Writes plain-language summaries	Resource names, types, groups, regions, sizes, tags, costs and finding text, plus any feedback you send. Never stored configuration.
Microsoft Azure	Hosts Staxly	What Staxly stores
Resend	Sends email	Email address and the message
Stripe	Takes payment	Your billing details
GitHub	Sign-in, and pull requests if you install it
Jira or ServiceNow	Only if your organisation connects one: a ticket for each change Staxly makes	The ticket text: which application, what the problem was, what changed, who approved it, and a link back to Staxly. With ServiceNow change requests, Staxly also reads whether each change request was approved, and tries to read who approved it.

Cookies

Staxly’s cookies sign you in and keep you signed in, remember which of your organisations you are looking at, and carry an invitation through sign-in when you accept one. Staxly does not use analytics or advertising cookies, and its public pages load no scripts from advertising or analytics companies. Your browser also keeps a few choices on your own device, such as light or dark mode, and whether you asked Staxly not to count your visits.

How Staxly counts visits to its public pages

When you open a public page on staxly.io, your browser sends one message to Staxly’s own server saying which page it was, how you got there (the site that linked you, and any campaign tags in the link), and which kind of device and browser you used. Staxly uses this to count visits and to see which pages and links people find useful. It does not use it for advertising and does not give it to anyone else. Pages you see while signed in are not counted.

Staxly does not keep your internet address or your browser’s full description. It turns them into a code with a secret that is thrown away within two days, so Staxly can tell that two visits on the same day came from the same browser, but cannot tell who you are or recognise you on another day.

Staxly also looks up which network your internet address belongs to, in a list of networks it downloads and keeps on its own servers, and keeps the network’s name and its country: for example a company, a university or a broadband provider. A network is whoever runs your connection, which is not necessarily who you work for. Home broadband, phone networks, cloud providers and VPNs are not shown to anyone by name. If you are in the European Union, the European Economic Area or the United Kingdom, Staxly keeps only the country, not the network, unless you arrived from a link Staxly sent to you personally. Nothing about your visit is sent to whoever publishes the list: Staxly only downloads it.

If you arrive from a link Staxly sent to you personally, Staxly can tell that it was you who followed it, which pages you read that day, and whether you then sent an enquiry, and keeps that with its record of your conversation with Staxly.

Staxly relies on its legitimate interest in understanding how its public pages are used, and in following up with people it has contacted. You can object at any time: press the button below and this browser stops sending the message, or write to support@staxly.io and Staxly will remove what it holds about you. If your browser sends the Global Privacy Control signal, Staxly counts nothing from it.

How long Staxly keeps it

If you disconnectDisconnecting a cloud account deletes what Staxly found about it: every part, every finding and every grouping, and the times its applications failed more than usual. It also deletes the record of when each check passed or failed, unless you choose to keep it, or another of your connections still reads that subscription. The record of fixes Staxly applied, and the evidence log, are kept while your account is open; they do not change.

If you close your accountIf you close your account, Staxly stops reading your cloud straight away. 90 days after you close it, Staxly deletes your organisation’s data from its database, including the record of fixes and the evidence log; until then you can reopen it. Staxly’s database backups are kept for 14 days after that, and its own system logs for up to 30 days. Stripe, Resend, Anthropic and GitHub keep their own copies of what they received, under their own policies. Staxly keeps an anonymous note that an account was deleted, with the dates and how many records went.

First, download your evidenceThe download has every entry in your evidence log and every fix Staxly made, with what an engineer working with your auditor needs to check that nothing was changed. Keep it: once it is deleted, Staxly cannot give it to you again. An admin can download it in Settings → Organisation, before closing and until the account is deleted.

People who also belong to another organisation keep their sign-in, and so do Staxly staff. Other people’s sign-ins are deleted at the same time, unless another organisation’s records still name them.

The record of each visit and each link followed is kept for 90 days, then only the daily totals are kept. The names of networks seen are kept while Staxly uses them. The record of a link that Staxly sent to you personally is kept as long as Staxly keeps its record of talking to you.

What you can ask us to do

You can ask to see the information Staxly holds about you, to correct it, or to delete it. Write to support@staxly.io. An admin can also close your organisation’s account in Settings → Organisation.

Children

Staxly is a service for businesses and is not meant for anyone under 18.

Contact

Staxly LLC · support@staxly.io